Questions tagged [packet-analysis]

(Packet-analysis) aka Network Traffic analysis is the process of capturing network traffic and inspecting it closely to determine what is happening on the network Providesthe details of network activities and their communication pattern in a network

Filter by
Sorted by
Tagged with
0
votes
0answers
7 views

Someone said I am being hacked. Were they right? [closed]

I paid an ethical hacker on a freelancing site to try and find evidence someone is hacking into my computer. He came to the conclusion my router is hacked, because a Huawei device, a certain IP which ...
0
votes
0answers
14 views

DPDK - RSS Offloads (Hash Calculation) Explanation [closed]

So I am currently working on understanding how to Receive Side Scaling (RSS) Offloads work inside DPDK (Data Plane Development Kit). So basically from my understanding depending on which offload you ...
0
votes
0answers
24 views

Man in the middle legitimate packet inspection

we're trying to debug a faulty Panasonic Mobile softphone SIP app (both Android & Apple versions), as many calls are randomly dropped unexpectedly. This is the conceptual connection diagram: We ...
0
votes
2answers
60 views

Ethernet frame encapsulation - multiple

is it possible to encapsulate two Ethernet frame packets into one ether packet? My search seems to indicate that there is not a way to do this, unless one was using something like VPN packets, be ...
1
vote
1answer
20 views

How do I set a display filter in wireshark that sorts by destination broadcast?

1 0.000000 Vmware_90:07:7b Broadcast ARP 60 Who has 192.168.185.144? Tell 192.168.185.7 27 0.995837 28.144.7.123 192.168.185.144 HTTP 1177 HTTP/1.1 200 OK (...
0
votes
0answers
20 views

Can Cumulative ACK number be higher than Selective ACK left edge number

I had recently been reading about selective ACK in TCP and had a question: Can Cumulative ACK's number be higher than Selective ACK's left edge number ? A hypothetical example: Receiver advertised ACK ...
0
votes
1answer
21 views

Capture traffic flowing through a Brocade switch remotely

I am currently doing packet capture through mirroring with Wireshark as mentioned in this post I can mirror the traffic to a port physically jacked into and analyze the packets redirected there w/ ...
0
votes
2answers
32 views

Why the most of packet sniffer require sudo when they executing? [closed]

I was just wondering why most of the packet sniffers require sudo? I'm guessing that they may work at the low-level areas to sniff packets, but I'd like to know the exact reason for their mechanism ...
0
votes
3answers
192 views

how to capture DHCP packets in wireshark

Hy! I want to capture DHCP packets in Wireshark but I did not receive any. Not my filter wrong, I don't get any. So I think I can't trigger the DHCP communications. my filters: dhcp bootp udp.port == ...
1
vote
0answers
14 views

What is the best way to match packets across pcap files from different capture points? [closed]

I have multiple pcap files which contain data from different capture points in the network. Previously I thought that by using the IP-ID field I can match the packets across the capture files but I ...
0
votes
0answers
12 views

How does the IPv4 Total Header Length field & Fragmentation work together? [duplicate]

I recently learnt that the maximum value of the IPv4 Total Header Length field is 65,535 which equals approx. 65.5KB. To my understanding, it is different from the IHL field as it includes the ...
0
votes
1answer
45 views

Do using proxies and surfing the internet create multiple headers in the packet? [closed]

Apologies for these silly questions. As I am new to networking. For example, If I configured my browser to use proxy of IP address: a.b.c.d and my IP address: e.f.g.h. And I visit example.com. What ...
0
votes
1answer
51 views

how to send a number of TCP packets and capture only those packets using tshark?

I'm using iperf3 to send 1005 TCP packets with the commands: iperf3 -s -i 1 -f m -p 5200 -D iperf3 -c 10.60.0.113 -k 1005 -bitrate 0 --reverse --omit 2 -p 5200 In server, client respectively. The ...
1
vote
1answer
57 views

How do I interpret this Wireshark log file?

I'm new to using Wireshark and I'd like some help with analyzing the log shown in the image. I also ran a nmap scan of the ports on my computer, but I'm not able to identify which of these lines are ...
1
vote
2answers
26 views

Determining that the entire packet was captured

New to packet and flow analysis. Some related basic Qs: Having a .PCAP file, how does one determine if the entirety of packets were captured? Would the size of the entire packet, and their collective ...
12
votes
2answers
2k views

Why does Ethernet use EtherType field to determine what type of packet is in a frame instead of just looking at the packet header?

I'm studying for some networking concepts and have learned that a receiving host looks at an Ethernet frame's header to determine what protocol being used by the packet. It makes me wonder though, ...
2
votes
1answer
49 views

Why do we need machine learning for QoS classification in SDNs if we have DSCP in IP address for QoS enforcement?

DiffServ (Differentiated services) uses a 6-bit differentiated services code point (DSCP) in the 8-bit differentiated services field (DS field) in the IP header for packet classification purposes. If ...
5
votes
3answers
1k views

Unknown EtherType

I am parsing an ethernet dataframe. It has the form : (destination_mac_6_bytes) + (source_mac_6_bytes) + (ether_type_2_bytes). Usually, I see ethertype like Ox86dd (IPv6). But I came across this ...
0
votes
2answers
56 views

Can Northbound interfaces (REST API) in a Software Defined Network (SDN) be used to manipulate QoS parameters?

I am working on a project involving Quality of Service (QoS) manipulation in Software Defined Networks (SDNs). I know that the following parameters affect the QoS in an SDN: Time information (inter-...
0
votes
3answers
215 views

Analyzing TCP connection by running Wireshark in two endpoint

I am trying to find the number of lost packets in the network. I have 2 devices say DeviceA and DeviceB. IP addresses are respectively DeviceA : 192.168.0.104 and DeviceB: 192.168.0.105. In order ...
0
votes
0answers
24 views

How can we capture traffic under WiFi AP connected with an WAN router?

My PC is connected to the internet via an WiFi access point. The AP is connected to the router that provides global IP address. In our network, some of the PCs (Say PCs1) are directly connected to the ...
1
vote
2answers
118 views

Which port determines the protocol?

If we have a common protocol port on both ends.. say source point is 443 and destination port is 80 (hypothetical situation, I know this combination of ports probably makes no sense).. how do we ...
3
votes
2answers
185 views

What is the advantage of Supervised Machine Learning over Deep Packet Inspection in Network Traffic Classification?

As per the definition of Deep Packet Inspection (DPI), it uses signatures for packet filtering. Supervised Machine Learning can help put a label on a packet which does not get identified by Deep ...
4
votes
3answers
2k views

How does Deep Packet Inspection work with encrypted packets?

I've been reading up on Deep Packet Inspection for Software Defined Networks. However, I know that some applications use encryption to evade Deep Packet Inspection. Is there any alternative (such as ...
0
votes
1answer
22 views

Question on windowing and determing connection speed

Hi i'm just learning computer networks and i have learned about windowing in tcp And my question is does we determine connection speed using windowing? I mean computer know the number of packets and ...
0
votes
1answer
473 views

Weird Wireshark protocol list (eth:ethertype:ip:data where is the “udp”?)

I am capturing incoming and outgoing WAN to LAN data at a particular host on my LAN (i.e., the one actually receiving/sending the data). Sometimes I get anomalous captured frames that are missing the ...
1
vote
1answer
175 views

Wireshark captures TCP packet with no flag [closed]

In our network, I captured a TCP packet by Wireshark that has no flag set. What's that mean? Is it normal?
1
vote
2answers
98 views

Do we send the same packets when we send the same data?

When we send the same data over a network twice, does this means that we are sending the same packets twice? I am trying to understand how my decoder works, so I command using an application on phone,...
4
votes
3answers
1k views

RIP Packet Format

I am trying to investigate a RIP packet. It clearly states that the packet is RIP v1. But its format does not match with the either RIP v1 or v2. Any ideas what this packet actually is?
1
vote
1answer
133 views

When is the HT Capability section in a probe request packet undefined?

I'm analyzing probe request packets and I'm seeing that some of them has an undefined values in HT Capabilities section. Why? Is it not required in all probe request packets?
0
votes
1answer
69 views

How to extract transfer rates from a beacon frame (or WLAN_BSS_ENTRY)?

How can I extract the transfer rates (actually I only need the maximum value) from a WLAN_BSS_ENTRY structure (obtained by WlanGetNetworkBssList)? The value wlanRateSet (WLAN_RATE_SET) seems pretty ...
0
votes
1answer
535 views

How to plot and benchmark UDP response time?

Our application uses UDP protocol in the transport layer. I'm currently filtering the packet trace with the port and then manually checking the RTT by selecting the packet stream and by using " Set ...
1
vote
0answers
1k views

Modifying linux ping icmp payload [closed]

On analyzing ping request and reply from a windows system to Linux. It was observed that the windows ping request payload was "abcdefghijklmnopqrstuvwabcdefghi" with size 32 bytes Could this ...
4
votes
3answers
722 views

What is responsible for dropping Layer 2 frames that's not addressed to it?

It's my understanding that if a network interface card (NIC) receives a Layer 1 packet, it will extract the Layer 2 frame from it, checks its destination MAC address, and if it is not addressed to it (...
3
votes
1answer
440 views

How can a UDP Client and a packet sniffer run on the same machine?

In my understanding, if you have a UDP socket client that is bound to a particular port, then a second UDP client on the same machine can't bind to the same port. If this is the case, then how can a ...
1
vote
1answer
454 views

How to filter a wireshark capture (pcapng) by source and destination IPv4 address

I have a bunch of wireshark captures I need to mine data from. Tshark seems to fit the bill but this doesn't support filtering (-f) by the look of it, I simply get: Using: tshark -x -r Run18....
2
votes
1answer
3k views

What does a “Frame” relate to in the WIreshark packet details pane?

Currently learning to use Wireshark. When I take a capture and click on one of it's rows, I see the following breakdown in the "Packet Details" pane: Frame Linux Cooked Capture Internet Protocol ...
0
votes
2answers
325 views

IP TTL value zero upon receipt [duplicate]

Is it possible that my user-space application using the UNIX sockets API would receive an UDP packet that would have the IP TTL value equal to zero, or is it the case that it always has to be one or ...
1
vote
2answers
49 views

Network Packet that allows maximum throughput

I created a basic wireless system between two microcontrollers. Each uses the on-chip UART and an HM-TRP radio module to communicate with each other. Eventually I'll have a master-slave setup where ...
2
votes
1answer
336 views

how to get RSSI information of WiFi users in wireshark?

If I'm able to get 802.11n traffic with my network adapter, would I be able to see the RSSI information? what should be the filter to see it?
5
votes
4answers
199 views

Packet Collison Avoidance

If a wireless network has collision avoidance, how comes the network slows down if more clients connect to it?
1
vote
1answer
515 views

Wireshark capture only TCP packets with the RST flag set

I'm quite new to networking and I got stuck while reading "Practical Packet Analysis: Using Wireshark to Solve...". On page 61 it is written: A common scenario is to capture only TCP packets ...
1
vote
0answers
25 views

Where can i find literature on how Firewall logs are generated? [closed]

How are firewall logs generated, I want to know how frequently (or how infrequently ) are logs generated from reading packet data if that is what it is. I want to detect anomaly on an enterprise ...
3
votes
1answer
257 views

VOIP timeout behind Cisco ASA after Duplicate ACK and Retransmissions

We have a RingCentral Polycom VVX series VOIP phone behind a Cisco ASA 5506 that will provision, work for about five minutes, go off-line for 20 minutes then reconnect and continue to work unless ...
2
votes
1answer
84 views

Extracting a bit rate

I'm trying to figure out what is the lowest layer of the OSI model that can be used to extract a bit rate (through a packet sniffer). I'm not sure if it's possible through only the physical layer, or ...
3
votes
1answer
5k views

How can I filter out particular MAC addresses when running tshark on a pcap trace?

I've tried a number of things, but none of them seem to do the trick. I want to run this command: tshark -r data.pcap -T fields -e frame.time_epoch -e frame.len but to have it ignore any packets ...
1
vote
1answer
55 views

Cable Internet Packet collecting

I've been reading Computer Networking: A top down approach and I don't understand something about cable internet. The book says that since cable internet is a shared medium, every packet sent by the ...
1
vote
3answers
86 views

how to filter only internet packets (not local) in TCP/IP?

I have a packet sniffer that mean i can read all packets sent or received to the computer(with all headers like src & dst IP:PORT). I want to filter packets that sent/received to/from internet (...
0
votes
3answers
1k views

Minimum possible size of Ethernet/IGMP frames

I am writing an application that needs to ignore frames whose size is smaller than the minimum possible size of Ethernet/IGMP frames. I have researched extensively and found the following information: ...
1
vote
2answers
136 views

Network fluctuation / delay monitoring between two nodes

Problem background: Our application communicates with multiple other nodes over SCTP. A few times in past issues were reported because of network fluctuation or too much delays that appeared for very ...