Stack Exchange Network

Stack Exchange network consists of 175 Q&A communities including Stack Overflow, the largest, most trusted online community for developers to learn, share their knowledge, and build their careers.

Visit Stack Exchange

Questions tagged [packet-analysis]

(Packet-analysis) aka Network Traffic analysis is the process of capturing network traffic and inspecting it closely to determine what is happening on the network Providesthe details of network activities and their communication pattern in a network

0
votes
0answers
5 views

Adding support for NetFlow on a service but a little lost [on hold]

My team develops a packet capture system, from which I should be able to recreate some NetFlow stats. Even if it's a basic template with src/dst ip and port info and packet count. From my ...
0
votes
1answer
23 views

How to plot and benchmark UDP response time?

Our application uses UDP protocol in the transport layer. I'm currently filtering the packet trace with the port and then manually checking the RTT by selecting the packet stream and by using " Set ...
0
votes
1answer
35 views

Does running a Wireshark application increase the monitored bandwidth? [on hold]

I'm working on an application to check the bandwidth requirements it has and I'm trying to monitor the bandwidth by connecting all the hosts to a single PC where I've set up ICS on Windows 7 (Internet ...
1
vote
0answers
23 views

Modifying linux ping icmp payload [closed]

On analyzing ping request and reply from a windows system to Linux. It was observed that the windows ping request payload was "abcdefghijklmnopqrstuvwabcdefghi" with size 32 bytes Could this ...
4
votes
3answers
554 views

What is responsible for dropping Layer 2 frames that's not addressed to it?

It's my understanding that if a network interface card (NIC) receives a Layer 1 packet, it will extract the Layer 2 frame from it, checks its destination MAC address, and if it is not addressed to it (...
3
votes
1answer
181 views

How can a UDP Client and a packet sniffer run on the same machine?

In my understanding, if you have a UDP socket client that is bound to a particular port, then a second UDP client on the same machine can't bind to the same port. If this is the case, then how can a ...
1
vote
1answer
110 views

How to filter a wireshark capture (pcapng) by source and destination IPv4 address

I have a bunch of wireshark captures I need to mine data from. Tshark seems to fit the bill but this doesn't support filtering (-f) by the look of it, I simply get: Using: tshark -x -r Run18....
1
vote
1answer
159 views

What does a “Frame” relate to in the WIreshark packet details pane?

Currently learning to use Wireshark. When I take a capture and click on one of it's rows, I see the following breakdown in the "Packet Details" pane: Frame Linux Cooked Capture Internet Protocol ...
0
votes
2answers
34 views

IP TTL value zero upon receipt [duplicate]

Is it possible that my user-space application using the UNIX sockets API would receive an UDP packet that would have the IP TTL value equal to zero, or is it the case that it always has to be one or ...
1
vote
2answers
42 views

Network Packet that allows maximum throughput

I created a basic wireless system between two microcontrollers. Each uses the on-chip UART and an HM-TRP radio module to communicate with each other. Eventually I'll have a master-slave setup where ...
2
votes
1answer
104 views

how to get RSSI information of WiFi users in wireshark?

If I'm able to get 802.11n traffic with my network adapter, would I be able to see the RSSI information? what should be the filter to see it?
5
votes
4answers
180 views

Packet Collison Avoidance

If a wireless network has collision avoidance, how comes the network slows down if more clients connect to it?
1
vote
1answer
212 views

Wireshark capture only TCP packets with the RST flag set

I'm quite new to networking and I got stuck while reading "Practical Packet Analysis: Using Wireshark to Solve...". On page 61 it is written: A common scenario is to capture only TCP packets ...
1
vote
0answers
23 views

Where can i find literature on how Firewall logs are generated? [closed]

How are firewall logs generated, I want to know how frequently (or how infrequently ) are logs generated from reading packet data if that is what it is. I want to detect anomaly on an enterprise ...
4
votes
1answer
139 views

VOIP timeout behind Cisco ASA after Duplicate ACK and Retransmissions

We have a RingCentral Polycom VVX series VOIP phone behind a Cisco ASA 5506 that will provision, work for about five minutes, go off-line for 20 minutes then reconnect and continue to work unless ...
2
votes
1answer
75 views

Extracting a bit rate

I'm trying to figure out what is the lowest layer of the OSI model that can be used to extract a bit rate (through a packet sniffer). I'm not sure if it's possible through only the physical layer, or ...
3
votes
1answer
2k views

How can I filter out particular MAC addresses when running tshark on a pcap trace?

I've tried a number of things, but none of them seem to do the trick. I want to run this command: tshark -r data.pcap -T fields -e frame.time_epoch -e frame.len but to have it ignore any packets ...
1
vote
1answer
38 views

Cable Internet Packet collecting

I've been reading Computer Networking: A top down approach and I don't understand something about cable internet. The book says that since cable internet is a shared medium, every packet sent by the ...
1
vote
3answers
77 views

how to filter only internet packets (not local) in TCP/IP?

I have a packet sniffer that mean i can read all packets sent or received to the computer(with all headers like src & dst IP:PORT). I want to filter packets that sent/received to/from internet (...
0
votes
3answers
668 views

Minimum possible size of Ethernet/IGMP frames

I am writing an application that needs to ignore frames whose size is smaller than the minimum possible size of Ethernet/IGMP frames. I have researched extensively and found the following information: ...
1
vote
2answers
93 views

Network fluctuation / delay monitoring between two nodes

Problem background: Our application communicates with multiple other nodes over SCTP. A few times in past issues were reported because of network fluctuation or too much delays that appeared for very ...
0
votes
1answer
44 views

Is the auto-correlation of a frame transient based on the physical characteristics of a device?

I am currently studying ways to fingerprint Wi-Fi devices based on their physical characteristics and I was struck by a question after reading Section B of this paper http://www.ccs-labs.org/bib/...
0
votes
2answers
81 views

Can I find port number with the TCP checksum?

So I got a frame where the port information is missing but I have everything else, how can I retrieve the port that where used in the frame ? I was thinking about the tcp checksum, but is it ...
1
vote
2answers
154 views

Wireshark capturing device ip

ok so here's the scenario: Computer A captures some packets and saves the session into file 'traffic'. Later on, Computer B opens the 'traffic' file and wants to know who captured the file...the ip ...
0
votes
1answer
4k views

Wireshark No response seen sending ping request

I'm building my own packets and sending them through a raw socket. The packet is apparently A-OK, but I'm not getting any replies. Sequence block is generated with a for loop. Identifier block is ...
1
vote
1answer
286 views

Is it possible to create an IPv4 packet header larger than 20 bytes on an IPv4 connection?

Is it possible to generate an IPv4 packet with an IPv4 packet header larger than 20 bytes on an IPv4 connections?
1
vote
2answers
270 views

Connect to local network using WAN IP address

I have a simple network in my company, where I use my ISP's ADSL Router. The LAN is 192.168.1.0/24. Router's IP is 192.168.1.1. It also has DHCP enabled, which ranges from 2 to 250. I have a Digital ...
1
vote
1answer
991 views

Extremely large sequence and acknowledge numbers when using Scapy

I am using Scapy to try and read the seq and ack numbers of tcp packets using the following sample code: packet = sniff(iface=argv[1], prn=scan, filter="", count=1)[0] print "Found SEQ " + str(packet....
1
vote
0answers
1k views

Size of packets in Wireshark [closed]

I only getting familiar with Wireshark, and there is one thing that I can't put together: estimating sizes of messages. I want to understand how much traffic my desktop application generates during it'...
1
vote
0answers
26 views

Does increasing the FEC decreases the payload in the maximum packet size?

we can find the maximum packet size by the formula packet err rate = 1 - (1 - bit err rate)^(max packet size) so does this max packet size include the FEC bits? I assume this formula gives the max ...
1
vote
1answer
181 views

capturing ipv4 packets on a http port

I tried to listen for ipv4 packets on the HTTP port 80, however I just got received HTTP string back - is this the right way to go about things? My understanding was that a TCP packet would be ...
2
votes
1answer
193 views

`tcpdump bootp.type == 2` tcpdump: syntax error

tcpdump -i eth0 'bootp.type == 2' Results in a: tcpdump: syntax error However, bootp.type == 2 works fine in Wireshark. Also tcpdump -i eth0 'tcp[13] & 16!=0' works fine, no syntax error....
1
vote
1answer
80 views

IPFIX - consider only first n seconds of a flow

Is possible to consider via IPFIX only the first n seconds of a flow (statistics)? How to set this in OpenVSwitch if possible?
4
votes
1answer
169 views

How troubleshoot poor ipsec connection?

I have a site-to-site ipsec connection which has low throughput, but the ethernet connection itself between the same endpoints is good (ie without ipsec there is high throughput). The ipsec routers ...
1
vote
1answer
77 views

Ipfix in openvSwitch

The sampling parameter in openvswitch to enable IPFIX what it refers to? For example, a value of 1 means what? Furthermore, as the difference there is per-bridge sampling and per-flow sampling?
2
votes
3answers
178 views

ipfix - variance of size packets in a flow

I have the need to calculate the variance of the size of the packets in a flow. So it is impossible using IPFIX? There are new alternatives to IPFIX that would allow me to calculate that value? Thanks
2
votes
1answer
240 views

Packet sizes with ipfix

It is possible, through IPFIX, take each size packet in a flow? It seems to exist only the sum of the sizes and the number of packets.
1
vote
2answers
2k views

Does every packet contain headers from each layer of the OSI model?

Pretty straight-forward question. Read through Section One of the 802.3 standard, and I found a nice model of a MAC frame that gives me extra insight, but I see that this question is not asked ...
1
vote
1answer
57 views

What type of packet is 0x5577

I've been trying to find out what type of packet is 0x5577, based on this page. The following is a snapshot of the source code that indicates this values: f = myproto() f.timestamp = int(time....
2
votes
2answers
532 views

Switch SPAN Port Overload

I would like to monitor all traffic that passes between devices connected to a switch (no particular switch make or model - I would need to do this for many types of switches encountered on many ...
1
vote
2answers
484 views

Can the source mac address in an Ethernet header be used to identify the sender?

I have programmed raw socket programs in C/C++ to initiate small tasks such as TCP/IP 3-way-handshakes, UDP, RTMP, etc. However I became curious about the next layer below IP and I was looking at an ...
1
vote
1answer
60 views

How do computers connected to a Wi-Fi network communicate within the same network?

Let us assume Host A wants to contact Host B. Does it send the packet addressing (IP address of the Host B) and MAC address of router, or does it use ARP to send to the MAC address of the Host B?
0
votes
1answer
159 views

Software defined system

Over (Software defined network) what will happen when unknown Ethernet hits the first switch, using 4 OF switch and 8 host.
1
vote
1answer
105 views

How can OSI model allow packet sniffing pass through layer 1?

In an envrionment where there is no packet switching, say a simple hub that repeats the signal from a port to all other ports, or a splitter, how come a packet can be sniffed? I mean, if the packet's ...
0
votes
2answers
471 views

The difference between simple ACK and ACK aggregation improvement in TCP

I came across a new term in TCP ACK aggregation which is a bit new to me. I tried finding a good resource online that precisely explains this concept in a clear but unfortunately all of them are very ...
2
votes
1answer
134 views

Deep Packet Inspection

Which component (the traffic processor, the CPU or some other component) of a switch/router is responsible for packet classification/DPI? Also, where along the data path is this operation performed (...
2
votes
1answer
263 views

Redundant acknowledgement numbers in TCP stream

I am currently working on making test scripts for regression testing of FreeBSD's TCP/IP stack using Google's packetdrill. However, there is a slight problem which I am having involving sequence ...
0
votes
2answers
45 views

Can servers find out which wifi AP was used to access the network?

If you connect to a website through a wifi network where there are a number of access points with the same ESSID and a different BSSID, would the servers of that website know which AP was used? So, ...
1
vote
2answers
1k views

Probe Request Frames

OBJECTIVE The end goal here s to build a python program with Scapy that detects all access points within range of my machine. UNDERSTANDING I understand this is normally done by using 802.11 Frame ...
1
vote
3answers
2k views

Maximum packet size Ethernet Frame and IP packet

I am a little bit confused about one fact. According to the specification, the ethernet frame maximum size is 1518 bytes, and the IPv4 packet size Length field in an IPv4 header can be up to 65535 ...