As of May 31, 2023, we have updated our Code of Conduct.

Questions tagged [packet-analysis]

(Packet-analysis) aka Network Traffic analysis is the process of capturing network traffic and inspecting it closely to determine what is happening on the network Providesthe details of network activities and their communication pattern in a network

Filter by
Sorted by
Tagged with
0 votes
1 answer
21 views

Bittwiste unexpected behaviour when changing MAC address

bittwiste version 2.0 libpcap version 1.9.1 on Catalina vía Homebrew I have a pcap file foo.pcap with conversation between MAC addresses a2:f6:51:d0:0e:13 and ac:93:c4:be:6b:8c I run: bittwiste -I ...
mariano-daniel's user avatar
2 votes
2 answers
69 views

Is there parallelism in packet-switching?

Let's say there are two hosts h1 and h2 separated by a switch w set up in this manner [h1]----link1----[w]----link2----[h2] If we are to send a file divided evenly into two packets from h1to h2 using ...
lambduh's user avatar
  • 23
2 votes
3 answers
92 views

Difference between Zero Trust Architecture and VPN + MitM Access Rights Management at Gateway

I am currently evaluating Next-Generation Firewall concepts and features and remembered about the Zero Trust networking model. I do find the notion of "trust nothing" in the context of ...
alex's user avatar
  • 157
0 votes
1 answer
43 views

SPAN/RSPAN monitoring VLAN vs Interface

I am a little lost with regards to the concept of capturing every traffic passing a core switch. If we set our monitor source to be all VLANs in a L3 switch, does that mean that traffic coming from a ...
Async's user avatar
  • 3
1 vote
1 answer
101 views

How do you redirect Fortigate packet sniffer CLI output to a log file?

I want to run the fortigate packet sniffer: https://community.fortinet.com/t5/FortiGate/Troubleshooting-Tip-Using-the-FortiOS-built-in-packet-sniffer/ta-p/194222 and when I do so, I only get CLI ...
Ryu S.'s user avatar
  • 123
0 votes
1 answer
202 views

Wireshark: Cannot find frame type of packets

I am getting used to Wireshark operation and currently, I am investigating different frames (control, management, data frame) and using filter in these links (https://mrncciew.com/2014/10/02/cwap-802-...
Nguyen Huy's user avatar
0 votes
1 answer
51 views

What does this Wireshark capture filter do

I was reading through a guide where I saw the following Wireshark capture filter used. (tcp[2:2] > 1500 and tcp[2:2] < 1550) I had a brief look over Wireshark's website which listed their ...
questioner's user avatar
0 votes
1 answer
70 views

Can an application on two separate devices share a packet to similar resource?

Can packets requested for an image by an app on a phone be sent to same app on another phone by another user?
Manny McStorm's user avatar
0 votes
1 answer
363 views

Packet capture shows packets larger than MTU

I have been doing some tests with two CentOS computers located in a local network and I don't understand the results. We have a simple application where a client (x.y.z.204) sends text strings to a ...
chus's user avatar
  • 107
0 votes
1 answer
1k views

Size of an ethernet frame carrying an arp request using ip (no options) & ethernet?

OKay so I found that this frame has size 72 bytes with no explanation and I can't seem to be able to figure out why . Ethernet payload will be : ip header + arp packet Arp packet with ip & ethrnet ...
tonythestark's user avatar
0 votes
1 answer
286 views

Probe Request getting\understanding Information Elements (IEs)

I'm trying to read Information Elements (IEs) from the probe request can't seem to understand the stracture of it as I undersatnd it size can be 0-2312 bytes but how do I know how many there are? I ...
Afik_Android's user avatar
1 vote
2 answers
49 views

Is this description of data transmission over L3 switch correct?

So I'm trying to describe how data is transmitted over a layer 3 switch (within same Vlan and between Vlan) but I'm not sure if I have understood it correctly. Can anybody verify if this description ...
Ole Kristian's user avatar
1 vote
2 answers
404 views

Calculating Checksum for ICMPv6 Packet

I have a packet that has a checksum of 0xffff, and a calculated checksum of 0x0000. I know in UDP, a checksum of 0x0000 is not allowed, and is instead replaced with 0xffff, thus the packet should be ...
user avatar
3 votes
1 answer
177 views

Which command is used in Cisco ASA Firewall to display the whole packet flow?

Which command is used in Cisco ASA Firewall to display the whole packet flow on the firewall? This same command allows you to see if traffic is allowed, NATed, or going through a VPN tunnel?
Alic Antunez Cruz's user avatar
2 votes
1 answer
119 views

How does deep packet inspection (DPI) extract metadata from packets?

DPI software extracts metadata (as an additional function apart from classifying applications / protocols) But how does it do this? For classification, I get that you can use pattern matching or port-...
Leena Lavanya's user avatar
0 votes
0 answers
14 views

Some random client requests fails with unexpected TCP [RST] packets [duplicate]

I have a service doing listen that serves clients over a TCP sockets connection with a raw binary protocol. The principle is basic: the connection is established, the client sends a request with data, ...
Ariel's user avatar
  • 1
0 votes
1 answer
106 views

Homeplug av frame

I want to check differences between a frame sent by a pc connected to an homeplug and one pc connected directly with the gateway/router. When i sniff packets i cannot see any differences in the frame, ...
claudio's user avatar
0 votes
2 answers
160 views

Detecting Ethernet over power by packets

If someone plugs an Ethernet over power (EOP, Homeplug) into the switch and then connect elsewhere in the building, can I detect this device by sniffing the packets with tools like Wireshark or ...
claudio's user avatar
0 votes
0 answers
85 views

Man in the middle legitimate packet inspection

we're trying to debug a faulty Panasonic Mobile softphone SIP app (both Android & Apple versions), as many calls are randomly dropped unexpectedly. This is the conceptual connection diagram: We ...
Riccardo's user avatar
  • 161
0 votes
2 answers
168 views

Ethernet frame encapsulation - multiple

is it possible to encapsulate two Ethernet frame packets into one ether packet? My search seems to indicate that there is not a way to do this, unless one was using something like VPN packets, be ...
SeattleGray's user avatar
1 vote
1 answer
2k views

How do I set a display filter in wireshark that sorts by destination broadcast?

1 0.000000 Vmware_90:07:7b Broadcast ARP 60 Who has 192.168.185.144? Tell 192.168.185.7 27 0.995837 28.144.7.123 192.168.185.144 HTTP 1177 HTTP/1.1 200 OK (...
Dr. Suess Official's user avatar
0 votes
1 answer
487 views

Capture traffic flowing through a Brocade switch remotely

I am currently doing packet capture through mirroring with Wireshark as mentioned in this post I can mirror the traffic to a port physically jacked into and analyze the packets redirected there w/ ...
Frankie Guzikowski's user avatar
0 votes
2 answers
467 views

Why the most of packet sniffer require sudo when they executing? [closed]

I was just wondering why most of the packet sniffers require sudo? I'm guessing that they may work at the low-level areas to sniff packets, but I'd like to know the exact reason for their mechanism ...
Hyunsoo's user avatar
  • 103
0 votes
3 answers
14k views

how to capture DHCP packets in wireshark

Hy! I want to capture DHCP packets in Wireshark but I did not receive any. Not my filter wrong, I don't get any. So I think I can't trigger the DHCP communications. my filters: dhcp bootp udp.port == ...
Finaria's user avatar
1 vote
0 answers
128 views

What is the best way to match packets across pcap files from different capture points? [closed]

I have multiple pcap files which contain data from different capture points in the network. Previously I thought that by using the IP-ID field I can match the packets across the capture files but I ...
dragosb's user avatar
  • 226
0 votes
1 answer
70 views

Do using proxies and surfing the internet create multiple headers in the packet? [closed]

Apologies for these silly questions. As I am new to networking. For example, If I configured my browser to use proxy of IP address: a.b.c.d and my IP address: e.f.g.h. And I visit example.com. What ...
karthik's user avatar
0 votes
1 answer
733 views

how to send a number of TCP packets and capture only those packets using tshark?

I'm using iperf3 to send 1005 TCP packets with the commands: iperf3 -s -i 1 -f m -p 5200 -D iperf3 -c 10.60.0.113 -k 1005 -bitrate 0 --reverse --omit 2 -p 5200 In server, client respectively. The ...
Natiya's user avatar
  • 121
1 vote
1 answer
208 views

How do I interpret this Wireshark log file?

I'm new to using Wireshark and I'd like some help with analyzing the log shown in the image. I also ran a nmap scan of the ports on my computer, but I'm not able to identify which of these lines are ...
bones's user avatar
  • 11
1 vote
2 answers
38 views

Determining that the entire packet was captured

New to packet and flow analysis. Some related basic Qs: Having a .PCAP file, how does one determine if the entirety of packets were captured? Would the size of the entire packet, and their collective ...
John's user avatar
  • 13
13 votes
2 answers
3k views

Why does Ethernet use EtherType field to determine what type of packet is in a frame instead of just looking at the packet header?

I'm studying for some networking concepts and have learned that a receiving host looks at an Ethernet frame's header to determine what protocol being used by the packet. It makes me wonder though, ...
ComputerWhacker's user avatar
2 votes
1 answer
86 views

Why do we need machine learning for QoS classification in SDNs if we have DSCP in IP address for QoS enforcement?

DiffServ (Differentiated services) uses a 6-bit differentiated services code point (DSCP) in the 8-bit differentiated services field (DS field) in the IP header for packet classification purposes. If ...
boomselector's user avatar
5 votes
3 answers
3k views

Unknown EtherType

I am parsing an ethernet dataframe. It has the form : (destination_mac_6_bytes) + (source_mac_6_bytes) + (ether_type_2_bytes). Usually, I see ethertype like Ox86dd (IPv6). But I came across this ...
DevShark's user avatar
  • 175
0 votes
2 answers
122 views

Can Northbound interfaces (REST API) in a Software Defined Network (SDN) be used to manipulate QoS parameters?

I am working on a project involving Quality of Service (QoS) manipulation in Software Defined Networks (SDNs). I know that the following parameters affect the QoS in an SDN: Time information (inter-...
boomselector's user avatar
0 votes
3 answers
433 views

Analyzing TCP connection by running Wireshark in two endpoint

I am trying to find the number of lost packets in the network. I have 2 devices say DeviceA and DeviceB. IP addresses are respectively DeviceA : 192.168.0.104 and DeviceB: 192.168.0.105. In order ...
I.K.'s user avatar
  • 111
1 vote
0 answers
61 views

How can we capture traffic under WiFi AP connected with an WAN router?

My PC is connected to the internet via an WiFi access point. The AP is connected to the router that provides global IP address. In our network, some of the PCs (Say PCs1) are directly connected to the ...
mallea's user avatar
  • 511
1 vote
2 answers
498 views

Which port determines the protocol?

If we have a common protocol port on both ends.. say source point is 443 and destination port is 80 (hypothetical situation, I know this combination of ports probably makes no sense).. how do we ...
Jack's user avatar
  • 13
2 votes
2 answers
434 views

What is the advantage of Supervised Machine Learning over Deep Packet Inspection in Network Traffic Classification? [closed]

As per the definition of Deep Packet Inspection (DPI), it uses signatures for packet filtering. Supervised Machine Learning can help put a label on a packet which does not get identified by Deep ...
boomselector's user avatar
4 votes
3 answers
4k views

How does Deep Packet Inspection work with encrypted packets?

I've been reading up on Deep Packet Inspection for Software Defined Networks. However, I know that some applications use encryption to evade Deep Packet Inspection. Is there any alternative (such as ...
boomselector's user avatar
0 votes
1 answer
29 views

Question on windowing and determing connection speed

Hi i'm just learning computer networks and i have learned about windowing in tcp And my question is does we determine connection speed using windowing? I mean computer know the number of packets and ...
Mohammad Ansari's user avatar
0 votes
1 answer
2k views

Weird Wireshark protocol list (eth:ethertype:ip:data where is the "udp"?)

I am capturing incoming and outgoing WAN to LAN data at a particular host on my LAN (i.e., the one actually receiving/sending the data). Sometimes I get anomalous captured frames that are missing the ...
Michael Goldshteyn's user avatar
2 votes
1 answer
623 views

Wireshark capture showing a TCP packet with no flags [closed]

In our network, I captured a TCP packet by Wireshark that has no flag set. What is the meaning of such packet ? Here is the dissection in text format : Frame 1: 54 bytes on wire (432 bits), 54 bytes ...
R1w's user avatar
  • 311
1 vote
2 answers
188 views

Do we send the same packets when we send the same data?

When we send the same data over a network twice, does this means that we are sending the same packets twice? I am trying to understand how my decoder works, so I command using an application on phone,...
yosra's user avatar
  • 113
4 votes
3 answers
1k views

RIP Packet Format

I am trying to investigate a RIP packet. It clearly states that the packet is RIP v1. But its format does not match with the either RIP v1 or v2. Any ideas what this packet actually is?
Bat's user avatar
  • 143
1 vote
1 answer
225 views

When is the HT Capability section in a probe request packet undefined?

I'm analyzing probe request packets and I'm seeing that some of them has an undefined values in HT Capabilities section. Why? Is it not required in all probe request packets?
ph1d0w's user avatar
  • 13
0 votes
1 answer
145 views

How to extract transfer rates from a beacon frame (or WLAN_BSS_ENTRY)?

How can I extract the transfer rates (actually I only need the maximum value) from a WLAN_BSS_ENTRY structure (obtained by WlanGetNetworkBssList)? The value wlanRateSet (WLAN_RATE_SET) seems pretty ...
CodeX's user avatar
  • 101
1 vote
0 answers
3k views

Modifying linux ping icmp payload [closed]

On analyzing ping request and reply from a windows system to Linux. It was observed that the windows ping request payload was "abcdefghijklmnopqrstuvwabcdefghi" with size 32 bytes Could this ...
PDHide's user avatar
  • 227
4 votes
3 answers
1k views

What is responsible for dropping Layer 2 frames that's not addressed to it?

It's my understanding that if a network interface card (NIC) receives a Layer 1 packet, it will extract the Layer 2 frame from it, checks its destination MAC address, and if it is not addressed to it (...
dayuloli's user avatar
  • 143
3 votes
1 answer
523 views

How can a UDP Client and a packet sniffer run on the same machine?

In my understanding, if you have a UDP socket client that is bound to a particular port, then a second UDP client on the same machine can't bind to the same port. If this is the case, then how can a ...
Fred's user avatar
  • 133
1 vote
1 answer
946 views

How to filter a wireshark capture (pcapng) by source and destination IPv4 address

I have a bunch of wireshark captures I need to mine data from. Tshark seems to fit the bill but this doesn't support filtering (-f) by the look of it, I simply get: Using: tshark -x -r Run18....
Robbie Dee's user avatar
3 votes
1 answer
7k views

What does a "Frame" relate to in the WIreshark packet details pane?

Currently learning to use Wireshark. When I take a capture and click on one of it's rows, I see the following breakdown in the "Packet Details" pane: Frame Linux Cooked Capture Internet Protocol ...
MarkMark's user avatar
  • 175