Questions tagged [packet-analysis]
(Packet-analysis) aka Network Traffic analysis is the process of capturing network traffic and inspecting it closely to determine what is happening on the network Providesthe details of network activities and their communication pattern in a network
153
questions
0
votes
1
answer
21
views
Bittwiste unexpected behaviour when changing MAC address
bittwiste version 2.0 libpcap version 1.9.1 on Catalina vía Homebrew
I have a pcap file foo.pcap with conversation between MAC addresses a2:f6:51:d0:0e:13 and ac:93:c4:be:6b:8c
I run:
bittwiste -I ...
- 101
2
votes
2
answers
69
views
Is there parallelism in packet-switching?
Let's say there are two hosts h1 and h2 separated by a switch w set up in this manner
[h1]----link1----[w]----link2----[h2]
If we are to send a file divided evenly into two packets from h1to h2 using ...
- 23
2
votes
3
answers
92
views
Difference between Zero Trust Architecture and VPN + MitM Access Rights Management at Gateway
I am currently evaluating Next-Generation Firewall concepts and features and remembered about the Zero Trust networking model. I do find the notion of "trust nothing" in the context of ...
- 157
0
votes
1
answer
43
views
SPAN/RSPAN monitoring VLAN vs Interface
I am a little lost with regards to the concept of capturing every traffic passing a core switch. If we set our monitor source to be all VLANs in a L3 switch, does that mean that traffic coming from a ...
- 3
1
vote
1
answer
101
views
How do you redirect Fortigate packet sniffer CLI output to a log file?
I want to run the fortigate packet sniffer:
https://community.fortinet.com/t5/FortiGate/Troubleshooting-Tip-Using-the-FortiOS-built-in-packet-sniffer/ta-p/194222
and when I do so, I only get CLI ...
- 123
0
votes
1
answer
202
views
Wireshark: Cannot find frame type of packets
I am getting used to Wireshark operation and currently, I am investigating different frames (control, management, data frame) and using filter in these links (https://mrncciew.com/2014/10/02/cwap-802-...
0
votes
1
answer
51
views
What does this Wireshark capture filter do
I was reading through a guide where I saw the following Wireshark capture filter used.
(tcp[2:2] > 1500 and tcp[2:2] < 1550)
I had a brief look over Wireshark's website which listed their ...
- 103
0
votes
1
answer
70
views
Can an application on two separate devices share a packet to similar resource?
Can packets requested for an image by an app on a phone be sent to same app on another phone by another user?
0
votes
1
answer
363
views
Packet capture shows packets larger than MTU
I have been doing some tests with two CentOS computers located in a local network and I don't understand the results. We have a simple application where a client (x.y.z.204) sends text strings to a ...
- 107
0
votes
1
answer
1k
views
Size of an ethernet frame carrying an arp request using ip (no options) & ethernet?
OKay so I found that this frame has size 72 bytes with no explanation and I can't seem to be able to figure out why .
Ethernet payload will be : ip header + arp packet
Arp packet with ip & ethrnet ...
- 103
0
votes
1
answer
286
views
Probe Request getting\understanding Information Elements (IEs)
I'm trying to read Information Elements (IEs) from the probe request
can't seem to understand the stracture of it
as I undersatnd it size can be 0-2312 bytes
but how do I know how many there are?
I ...
1
vote
2
answers
49
views
Is this description of data transmission over L3 switch correct?
So I'm trying to describe how data is transmitted over a layer 3 switch (within same Vlan and between Vlan) but I'm not sure if I have understood it correctly. Can anybody verify if this description ...
- 13
1
vote
2
answers
404
views
Calculating Checksum for ICMPv6 Packet
I have a packet that has a checksum of 0xffff, and a calculated checksum of 0x0000. I know in UDP, a checksum of 0x0000 is not allowed, and is instead replaced with 0xffff, thus the packet should be ...
user80254
3
votes
1
answer
177
views
Which command is used in Cisco ASA Firewall to display the whole packet flow?
Which command is used in Cisco ASA Firewall to display the whole packet flow on the firewall? This same command allows you to see if traffic is allowed, NATed, or going through a VPN tunnel?
2
votes
1
answer
119
views
How does deep packet inspection (DPI) extract metadata from packets?
DPI software extracts metadata (as an additional function apart from classifying applications / protocols)
But how does it do this? For classification, I get that you can use pattern matching or port-...
- 123
0
votes
0
answers
14
views
Some random client requests fails with unexpected TCP [RST] packets [duplicate]
I have a service doing listen that serves clients over a TCP sockets connection with a raw binary protocol.
The principle is basic: the connection is established, the client sends a request with data, ...
- 1
0
votes
1
answer
106
views
Homeplug av frame
I want to check differences between a frame sent by a pc connected to an homeplug and one pc connected directly with the gateway/router. When i sniff packets i cannot see any differences in the frame, ...
- 5
0
votes
2
answers
160
views
Detecting Ethernet over power by packets
If someone plugs an Ethernet over power (EOP, Homeplug) into the switch and then connect elsewhere in the building, can I detect this device by sniffing the packets with tools like Wireshark or ...
- 5
0
votes
0
answers
85
views
Man in the middle legitimate packet inspection
we're trying to debug a faulty Panasonic Mobile softphone SIP app (both Android & Apple versions), as many calls are randomly dropped unexpectedly.
This is the conceptual connection diagram:
We ...
- 161
0
votes
2
answers
168
views
Ethernet frame encapsulation - multiple
is it possible to encapsulate two Ethernet frame packets into one
ether packet?
My search seems to indicate that there is not a way to do this, unless one was using something like VPN packets, be ...
1
vote
1
answer
2k
views
How do I set a display filter in wireshark that sorts by destination broadcast?
1 0.000000 Vmware_90:07:7b Broadcast ARP 60 Who has 192.168.185.144? Tell 192.168.185.7
27 0.995837 28.144.7.123 192.168.185.144 HTTP 1177 HTTP/1.1 200 OK (...
0
votes
1
answer
487
views
Capture traffic flowing through a Brocade switch remotely
I am currently doing packet capture through mirroring with Wireshark as mentioned in this post
I can mirror the traffic to a port physically jacked into and analyze the packets redirected there w/ ...
0
votes
2
answers
467
views
Why the most of packet sniffer require sudo when they executing? [closed]
I was just wondering why most of the packet sniffers require sudo?
I'm guessing that they may work at the low-level areas to sniff packets, but I'd like to know the exact reason for their mechanism ...
- 103
0
votes
3
answers
14k
views
how to capture DHCP packets in wireshark
Hy!
I want to capture DHCP packets in Wireshark but I did not receive any. Not my filter wrong, I don't get any. So I think I can't trigger the DHCP communications.
my filters:
dhcp
bootp
udp.port == ...
- 1
1
vote
0
answers
128
views
What is the best way to match packets across pcap files from different capture points? [closed]
I have multiple pcap files which contain data from different capture points in the network.
Previously I thought that by using the IP-ID field I can match the packets across the capture files but I ...
- 226
0
votes
1
answer
70
views
Do using proxies and surfing the internet create multiple headers in the packet? [closed]
Apologies for these silly questions. As I am new to networking.
For example, If I configured my browser to use proxy of IP address: a.b.c.d and my IP address: e.f.g.h.
And I visit example.com. What ...
- 3
0
votes
1
answer
733
views
how to send a number of TCP packets and capture only those packets using tshark?
I'm using iperf3 to send 1005 TCP packets with the commands:
iperf3 -s -i 1 -f m -p 5200 -D
iperf3 -c 10.60.0.113 -k 1005 -bitrate 0 --reverse --omit 2 -p 5200
In server, client respectively.
The ...
- 121
1
vote
1
answer
208
views
How do I interpret this Wireshark log file?
I'm new to using Wireshark and I'd like some help with analyzing the log shown in the image.
I also ran a nmap scan of the ports on my computer, but I'm not able to identify which of these lines are ...
- 11
1
vote
2
answers
38
views
Determining that the entire packet was captured
New to packet and flow analysis. Some related basic Qs:
Having a .PCAP file, how does one determine if the entirety of packets were captured?
Would the size of the entire packet, and their collective ...
- 13
13
votes
2
answers
3k
views
Why does Ethernet use EtherType field to determine what type of packet is in a frame instead of just looking at the packet header?
I'm studying for some networking concepts and have learned that a receiving host looks at an Ethernet frame's header to determine what protocol being used by the packet. It makes me wonder though, ...
- 141
2
votes
1
answer
86
views
Why do we need machine learning for QoS classification in SDNs if we have DSCP in IP address for QoS enforcement?
DiffServ (Differentiated services) uses a 6-bit differentiated services code point (DSCP) in the 8-bit differentiated services field (DS field) in the IP header for packet classification purposes. If ...
- 103
5
votes
3
answers
3k
views
Unknown EtherType
I am parsing an ethernet dataframe.
It has the form : (destination_mac_6_bytes) + (source_mac_6_bytes) + (ether_type_2_bytes).
Usually, I see ethertype like Ox86dd (IPv6).
But I came across this ...
- 175
0
votes
2
answers
122
views
Can Northbound interfaces (REST API) in a Software Defined Network (SDN) be used to manipulate QoS parameters?
I am working on a project involving Quality of Service (QoS) manipulation in Software Defined Networks (SDNs). I know that the following parameters affect the QoS in an SDN:
Time information (inter-...
- 103
0
votes
3
answers
433
views
Analyzing TCP connection by running Wireshark in two endpoint
I am trying to find the number of lost packets in the network.
I have 2 devices say DeviceA and DeviceB. IP addresses are respectively DeviceA : 192.168.0.104 and DeviceB: 192.168.0.105.
In order ...
- 111
1
vote
0
answers
61
views
How can we capture traffic under WiFi AP connected with an WAN router?
My PC is connected to the internet via an WiFi access point.
The AP is connected to the router that provides global IP address.
In our network, some of the PCs (Say PCs1) are directly connected to the ...
- 511
1
vote
2
answers
498
views
Which port determines the protocol?
If we have a common protocol port on both ends.. say source point is 443 and destination port is 80 (hypothetical situation, I know this combination of ports probably makes no sense).. how do we ...
- 13
2
votes
2
answers
434
views
What is the advantage of Supervised Machine Learning over Deep Packet Inspection in Network Traffic Classification? [closed]
As per the definition of Deep Packet Inspection (DPI), it uses signatures for packet filtering. Supervised Machine Learning can help put a label on a packet which does not get identified by Deep ...
- 103
4
votes
3
answers
4k
views
How does Deep Packet Inspection work with encrypted packets?
I've been reading up on Deep Packet Inspection for Software Defined Networks. However, I know that some applications use encryption to evade Deep Packet Inspection. Is there any alternative (such as ...
- 103
0
votes
1
answer
29
views
Question on windowing and determing connection speed
Hi i'm just learning computer networks and i have learned about windowing in tcp
And my question is does we determine connection speed using windowing?
I mean computer know the number of packets and ...
- 103
0
votes
1
answer
2k
views
Weird Wireshark protocol list (eth:ethertype:ip:data where is the "udp"?)
I am capturing incoming and outgoing WAN to LAN data at a particular host on my LAN (i.e., the one actually receiving/sending the data). Sometimes I get anomalous captured frames that are missing the ...
2
votes
1
answer
623
views
Wireshark capture showing a TCP packet with no flags [closed]
In our network, I captured a TCP packet by Wireshark that has no flag set.
What is the meaning of such packet ? Here is the dissection in text format :
Frame 1: 54 bytes on wire (432 bits), 54 bytes ...
- 311
1
vote
2
answers
188
views
Do we send the same packets when we send the same data?
When we send the same data over a network twice, does this means that we are sending the same packets twice?
I am trying to understand how my decoder works, so I command using an application on phone,...
- 113
4
votes
3
answers
1k
views
RIP Packet Format
I am trying to investigate a RIP packet. It clearly states that the packet is RIP v1. But its format does not match with the either RIP v1 or v2. Any ideas what this packet actually is?
- 143
1
vote
1
answer
225
views
When is the HT Capability section in a probe request packet undefined?
I'm analyzing probe request packets and I'm seeing that some of them has an undefined values in HT Capabilities section. Why? Is it not required in all probe request packets?
- 13
0
votes
1
answer
145
views
How to extract transfer rates from a beacon frame (or WLAN_BSS_ENTRY)?
How can I extract the transfer rates (actually I only need the maximum value) from a WLAN_BSS_ENTRY structure (obtained by WlanGetNetworkBssList)?
The value wlanRateSet (WLAN_RATE_SET) seems pretty ...
- 101
1
vote
0
answers
3k
views
Modifying linux ping icmp payload [closed]
On analyzing ping request and reply from a windows system to Linux. It was observed that the windows ping request payload was
"abcdefghijklmnopqrstuvwabcdefghi" with size 32 bytes
Could this ...
- 227
4
votes
3
answers
1k
views
What is responsible for dropping Layer 2 frames that's not addressed to it?
It's my understanding that if a network interface card (NIC) receives a Layer 1 packet, it will extract the Layer 2 frame from it, checks its destination MAC address, and if it is not addressed to it (...
- 143
3
votes
1
answer
523
views
How can a UDP Client and a packet sniffer run on the same machine?
In my understanding, if you have a UDP socket client that is bound to a particular port, then a second UDP client on the same machine can't bind to the same port.
If this is the case, then how can a ...
- 133
1
vote
1
answer
946
views
How to filter a wireshark capture (pcapng) by source and destination IPv4 address
I have a bunch of wireshark captures I need to mine data from. Tshark seems to fit the bill but this doesn't support filtering (-f) by the look of it, I simply get:
Using:
tshark -x -r Run18....
- 125
3
votes
1
answer
7k
views
What does a "Frame" relate to in the WIreshark packet details pane?
Currently learning to use Wireshark.
When I take a capture and click on one of it's rows, I see the following breakdown in the "Packet Details" pane:
Frame
Linux Cooked Capture
Internet Protocol ...
- 175