1

New to packet and flow analysis. Some related basic Qs:

  1. Having a .PCAP file, how does one determine if the entirety of packets were captured?

  2. Would the size of the entire packet, and their collective size, be the representation of the amount of data across the wire?

I've been using tcpdump.

3
  • Did any answer help you? If so, you should accept the answer so that the question doesn't keep popping up forever, looking for an answer. Alternatively, you can post and accept your own answer.
    – Ron Maupin
    Dec 17 '20 at 17:14
  • @RonMaupin ok I checked the one I thought was best, although both were helpful. Thanks
    – John
    Dec 17 '20 at 17:21
  • OK. I'm just going through the year-end cleanup to see if we can close open questions. Thanks!
    – Ron Maupin
    Dec 17 '20 at 17:23
2

I think you'll be really interested in this description of the PCAP format. It does include both the actual length of packet and the captured length as distinct fields. This allows you to do what you'd like, and see if you've got the whole packet captured; or only part of it.

1
  • Ah ha this actual length vs captured length sound familiar. I will check this out
    – John
    May 3 '20 at 14:43
2
  1. Define "entirety of packets". Network communication rarely stops completely. If you're referring to a specific session you should be able to locate its end. What that looks like depends on the protocol.
  2. No. Most often, a captured packet doesn't include the FCS field from the Ethernet frame (depends on capture tool, settings and NIC capabilities). Also, a capture never includes physical layer sequences like preamble/SOF, line encoding and special symbols (end-of-frame, idle, ...) that were physically on the wire.
2
  • I phrased it incorrectly. Rather that each individual packet was fully captured. I believe "snaplen" relates to this.
    – John
    May 3 '20 at 6:43
  • You mean the capturing driver might have truncated each frame by length? The most obvious indication should be that there are only frames up to a certain length. For TCP segments, you should see a discrepancy between segment length and ACKed data. Apart from that, there is no general indication.
    – Zac67
    May 3 '20 at 13:04

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.