1

I have multiple pcap files which contain data from different capture points in the network.

Previously I thought that by using the IP-ID field I can match the packets across the capture files but I discovered that is not a reliable way of doing it.

I am looking for a solution that would work for both TCP and UDP.

Improve this question
11
  • TCP creates connections that are identified by the source and destination IP and TCP addresses. While UDP does not have connections, the same information can be used, but you cannot guarantee that it is the same conversation. – Ron Maupin♦ Sep 17 '20 at 13:34
  • Thanks but I am trying to match packets not conversations – dragosb Sep 17 '20 at 13:35
  • You first need to narrow down the packets to the connections, then you can compare them. Packets not in the same connection will not match. In any case, I really do not see how this is a network engineering problem. You probably want to find an application that can help you, but such recommendations are explicitly off-topic. – Ron Maupin♦ Sep 17 '20 at 13:38
  • I am trying to code this myself. I thought it would be a network engineering problem since its purely related to networking right? – dragosb Sep 17 '20 at 13:40
  • No, not everything related to networking is a network engineering problem. This is not something that network engineers would do in the normal course of business. Normally, we would use something like NetFlow (IPFIX) to gather statistics, but trying to match individual packets across a network seems rather pointless. – Ron Maupin♦ Sep 17 '20 at 13:42