1

So now that I can understand that there wont be any packets received at machine one, when there is a communication initiated between Machine2 and Machine3. Now I am testing API's using postman. First I am open wireshark and catpure filter by type tcp port 80 and click on the wlan interface and then open postman send a http request. then I see on the wrieshark GUI .Then I got some encrypted data list. But her shows incomplete data "56595sdfdfdf3d.....". So please help me what are the important points that I should take care of inside the packets. I got the encrypted data why it is incomplete..?

Calling local API to my machine. And Checking all the packets in wireshark. What should I analyse the content of each packet ?

I see the data shows incomplete why ? Here is an example -

Data (42 bytes)
Data: cf0b0800000100002000079898000b980000ffffffff0000...
0000 01 50 43 00 00 00 94 de 80 7e 7a fa 91 00 00 00
0010 40 fa cf 0b 08 00 00 01 00 00 20 00 07 98 98 00
0020 0b 98 00 00 ff ff ff ff 00 00 00 00 00 00 00 00
0030 00 00 00 00 00 00 00 00 00 00 00 00
0

What should I analyse the content of each packet ?

That depends on what type of packets you are looking at, and what you want to glean from the packets. For example, IPv4 and IPv6 have different packet headers.

IPv4 packet header:

    0                   1                   2                   3
    0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1
   +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
   |Version|  IHL  |Type of Service|          Total Length         |
   +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
   |         Identification        |Flags|      Fragment Offset    |
   +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
   |  Time to Live |    Protocol   |         Header Checksum       |
   +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
   |                       Source Address                          |
   +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
   |                    Destination Address                        |
   +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
   |                    Options                    |    Padding    |
   +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+

IPv4 packets can be fragmented, so multiple packets may be needed to recreate the original packet.

IPv6 packet header:

   +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
   |Version| Traffic Class |           Flow Label                  |
   +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
   |         Payload Length        |  Next Header  |   Hop Limit   |
   +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
   |                                                               |
   +                                                               +
   |                                                               |
   +                         Source Address                        +
   |                                                               |
   +                                                               +
   |                                                               |
   +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
   |                                                               |
   +                                                               +
   |                                                               |
   +                      Destination Address                      +
   |                                                               |
   +                                                               +
   |                                                               |
   +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+

IPv6 can also have different extension headers.

Based on the packet headers, you can discover the type of payload, and where the payload starts. Usually, but not always, the packet payload will be either TCP or UDP. TCP and UDP have their own headers.

UDP header:

              0      7 8     15 16    23 24    31  
             +--------+--------+--------+--------+ 
             |     Source      |   Destination   | 
             |      Port       |      Port       | 
             +--------+--------+--------+--------+ 
             |                 |                 | 
             |     Length      |    Checksum     | 
             +--------+--------+--------+--------+ 
             |                                     
             |          data octets ...            
             +---------------- ...                 

TCP header:

    0                   1                   2                   3
    0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1
   +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
   |          Source Port          |       Destination Port        |
   +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
   |                        Sequence Number                        |
   +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
   |                    Acknowledgment Number                      |
   +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
   |  Data |           |U|A|P|R|S|F|                               |
   | Offset| Reserved  |R|C|S|S|Y|I|            Window             |
   |       |           |G|K|H|T|N|N|                               |
   +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
   |           Checksum            |         Urgent Pointer        |
   +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
   |                    Options                    |    Padding    |
   +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
   |                             data                              |
   +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+

The payload for UDP or TCP is the application data being transferred. The contents of the payload are only meaningful in the context of the application using the protocol for transport. As you suggest, the data may be encrypted, and there are different encryption schemes used by different applications. Some applications have application-layer protocols with headers, and some do not, but application-layer protocols are explicitly off-topic here.

| improve this answer | |
  • You haven't given any information to indicate why. If you want to know that, you need to edit your question to show exactly what you have, in context. – Ron Maupin Feb 17 '17 at 14:12
  • I edited my post – toastmaster Feb 20 '17 at 7:26

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.