Questions tagged [packet-analysis]

(Packet-analysis) aka Network Traffic analysis is the process of capturing network traffic and inspecting it closely to determine what is happening on the network Providesthe details of network activities and their communication pattern in a network

Filter by
Sorted by
Tagged with
0 votes
1 answer
177 views

How to determine which TCP payloads should be combined to form a complete PDU?

I understand that the TCP itself provides a byte stream connection, but has no idea nor does it care what its payload is and how it is segmented to fit into individual packets that travel on the wire. ...
miran80's user avatar
  • 103
0 votes
1 answer
49 views

Could a frame have different vendor specific fields?

I was analyzing a database of probe requests until I found the following packet which has 3 different vendor specific fields. How to interpret that ? Is it just a wrong packet ? RadioTap version=0 ...
Mohamed Chaaben's user avatar
0 votes
1 answer
51 views

Bittwiste unexpected behaviour when changing MAC address

bittwiste version 2.0 libpcap version 1.9.1 on Catalina vía Homebrew I have a pcap file foo.pcap with conversation between MAC addresses a2:f6:51:d0:0e:13 and ac:93:c4:be:6b:8c I run: bittwiste -I ...
mariano-daniel's user avatar
2 votes
2 answers
96 views

Is there parallelism in packet-switching?

Let's say there are two hosts h1 and h2 separated by a switch w set up in this manner [h1]----link1----[w]----link2----[h2] If we are to send a file divided evenly into two packets from h1to h2 using ...
lambduh's user avatar
  • 23
2 votes
4 answers
203 views

Difference between Zero Trust Architecture and VPN + MitM Access Rights Management at Gateway

I am currently evaluating Next-Generation Firewall concepts and features and remembered about the Zero Trust networking model. I do find the notion of "trust nothing" in the context of ...
alex's user avatar
  • 157
0 votes
1 answer
109 views

SPAN/RSPAN monitoring VLAN vs Interface

I am a little lost with regards to the concept of capturing every traffic passing a core switch. If we set our monitor source to be all VLANs in a L3 switch, does that mean that traffic coming from a ...
Async's user avatar
  • 3
1 vote
1 answer
334 views

How do you redirect Fortigate packet sniffer CLI output to a log file?

I want to run the fortigate packet sniffer: https://community.fortinet.com/t5/FortiGate/Troubleshooting-Tip-Using-the-FortiOS-built-in-packet-sniffer/ta-p/194222 and when I do so, I only get CLI ...
Ryu S.'s user avatar
  • 123
0 votes
1 answer
308 views

Wireshark: Cannot find frame type of packets

I am getting used to Wireshark operation and currently, I am investigating different frames (control, management, data frame) and using filter in these links (https://mrncciew.com/2014/10/02/cwap-802-...
Nguyen Huy's user avatar
0 votes
1 answer
58 views

What does this Wireshark capture filter do

I was reading through a guide where I saw the following Wireshark capture filter used. (tcp[2:2] > 1500 and tcp[2:2] < 1550) I had a brief look over Wireshark's website which listed their ...
questioner's user avatar
0 votes
1 answer
79 views

Can an application on two separate devices share a packet to similar resource?

Can packets requested for an image by an app on a phone be sent to same app on another phone by another user?
Manny McStorm's user avatar
0 votes
1 answer
613 views

Packet capture shows packets larger than MTU

I have been doing some tests with two CentOS computers located in a local network and I don't understand the results. We have a simple application where a client (x.y.z.204) sends text strings to a ...
chus's user avatar
  • 107
0 votes
1 answer
2k views

Size of an ethernet frame carrying an arp request using ip (no options) & ethernet?

OKay so I found that this frame has size 72 bytes with no explanation and I can't seem to be able to figure out why . Ethernet payload will be : ip header + arp packet Arp packet with ip & ethrnet ...
tonythestark's user avatar
0 votes
1 answer
374 views

Probe Request getting\understanding Information Elements (IEs)

I'm trying to read Information Elements (IEs) from the probe request can't seem to understand the stracture of it as I undersatnd it size can be 0-2312 bytes but how do I know how many there are? I ...
Afik_Android's user avatar
1 vote
2 answers
60 views

Is this description of data transmission over L3 switch correct?

So I'm trying to describe how data is transmitted over a layer 3 switch (within same Vlan and between Vlan) but I'm not sure if I have understood it correctly. Can anybody verify if this description ...
Ole Kristian's user avatar
1 vote
2 answers
607 views

Calculating Checksum for ICMPv6 Packet

I have a packet that has a checksum of 0xffff, and a calculated checksum of 0x0000. I know in UDP, a checksum of 0x0000 is not allowed, and is instead replaced with 0xffff, thus the packet should be ...
user avatar
3 votes
1 answer
269 views

Which command is used in Cisco ASA Firewall to display the whole packet flow?

Which command is used in Cisco ASA Firewall to display the whole packet flow on the firewall? This same command allows you to see if traffic is allowed, NATed, or going through a VPN tunnel?
Alic Antunez Cruz's user avatar
2 votes
1 answer
142 views

How does deep packet inspection (DPI) extract metadata from packets?

DPI software extracts metadata (as an additional function apart from classifying applications / protocols) But how does it do this? For classification, I get that you can use pattern matching or port-...
Leena Lavanya's user avatar
0 votes
0 answers
16 views

Some random client requests fails with unexpected TCP [RST] packets [duplicate]

I have a service doing listen that serves clients over a TCP sockets connection with a raw binary protocol. The principle is basic: the connection is established, the client sends a request with data, ...
Ariel's user avatar
  • 1
0 votes
1 answer
127 views

Homeplug av frame

I want to check differences between a frame sent by a pc connected to an homeplug and one pc connected directly with the gateway/router. When i sniff packets i cannot see any differences in the frame, ...
claudio's user avatar
0 votes
2 answers
203 views

Detecting Ethernet over power by packets

If someone plugs an Ethernet over power (EOP, Homeplug) into the switch and then connect elsewhere in the building, can I detect this device by sniffing the packets with tools like Wireshark or ...
claudio's user avatar
0 votes
0 answers
118 views

Man in the middle legitimate packet inspection

we're trying to debug a faulty Panasonic Mobile softphone SIP app (both Android & Apple versions), as many calls are randomly dropped unexpectedly. This is the conceptual connection diagram: We ...
Riccardo's user avatar
  • 163
0 votes
2 answers
192 views

Ethernet frame encapsulation - multiple

is it possible to encapsulate two Ethernet frame packets into one ether packet? My search seems to indicate that there is not a way to do this, unless one was using something like VPN packets, be ...
SeattleGray's user avatar
1 vote
1 answer
2k views

How do I set a display filter in wireshark that sorts by destination broadcast?

1 0.000000 Vmware_90:07:7b Broadcast ARP 60 Who has 192.168.185.144? Tell 192.168.185.7 27 0.995837 28.144.7.123 192.168.185.144 HTTP 1177 HTTP/1.1 200 OK (...
Dr. Suess Official's user avatar
0 votes
1 answer
595 views

Capture traffic flowing through a Brocade switch remotely

I am currently doing packet capture through mirroring with Wireshark as mentioned in this post I can mirror the traffic to a port physically jacked into and analyze the packets redirected there w/ ...
Frankie Guzikowski's user avatar
0 votes
2 answers
531 views

Why the most of packet sniffer require sudo when they executing? [closed]

I was just wondering why most of the packet sniffers require sudo? I'm guessing that they may work at the low-level areas to sniff packets, but I'd like to know the exact reason for their mechanism ...
Hyunsoo's user avatar
  • 103
0 votes
3 answers
17k views

how to capture DHCP packets in wireshark

Hy! I want to capture DHCP packets in Wireshark but I did not receive any. Not my filter wrong, I don't get any. So I think I can't trigger the DHCP communications. my filters: dhcp bootp udp.port == ...
Finaria's user avatar
1 vote
0 answers
179 views

What is the best way to match packets across pcap files from different capture points? [closed]

I have multiple pcap files which contain data from different capture points in the network. Previously I thought that by using the IP-ID field I can match the packets across the capture files but I ...
dragosb's user avatar
  • 226
0 votes
1 answer
77 views

Do using proxies and surfing the internet create multiple headers in the packet? [closed]

Apologies for these silly questions. As I am new to networking. For example, If I configured my browser to use proxy of IP address: a.b.c.d and my IP address: e.f.g.h. And I visit example.com. What ...
karthik's user avatar
0 votes
1 answer
1k views

how to send a number of TCP packets and capture only those packets using tshark?

I'm using iperf3 to send 1005 TCP packets with the commands: iperf3 -s -i 1 -f m -p 5200 -D iperf3 -c 10.60.0.113 -k 1005 -bitrate 0 --reverse --omit 2 -p 5200 In server, client respectively. The ...
Natiya's user avatar
  • 121
1 vote
1 answer
291 views

How do I interpret this Wireshark log file?

I'm new to using Wireshark and I'd like some help with analyzing the log shown in the image. I also ran a nmap scan of the ports on my computer, but I'm not able to identify which of these lines are ...
bones's user avatar
  • 11
1 vote
2 answers
39 views

Determining that the entire packet was captured

New to packet and flow analysis. Some related basic Qs: Having a .PCAP file, how does one determine if the entirety of packets were captured? Would the size of the entire packet, and their collective ...
John's user avatar
  • 13
13 votes
2 answers
4k views

Why does Ethernet use EtherType field to determine what type of packet is in a frame instead of just looking at the packet header?

I'm studying for some networking concepts and have learned that a receiving host looks at an Ethernet frame's header to determine what protocol being used by the packet. It makes me wonder though, ...
ComputerWhacker's user avatar
2 votes
1 answer
89 views

Why do we need machine learning for QoS classification in SDNs if we have DSCP in IP address for QoS enforcement?

DiffServ (Differentiated services) uses a 6-bit differentiated services code point (DSCP) in the 8-bit differentiated services field (DS field) in the IP header for packet classification purposes. If ...
boomselector's user avatar
5 votes
3 answers
3k views

Unknown EtherType

I am parsing an ethernet dataframe. It has the form : (destination_mac_6_bytes) + (source_mac_6_bytes) + (ether_type_2_bytes). Usually, I see ethertype like Ox86dd (IPv6). But I came across this ...
DevShark's user avatar
  • 175
0 votes
2 answers
135 views

Can Northbound interfaces (REST API) in a Software Defined Network (SDN) be used to manipulate QoS parameters?

I am working on a project involving Quality of Service (QoS) manipulation in Software Defined Networks (SDNs). I know that the following parameters affect the QoS in an SDN: Time information (inter-...
boomselector's user avatar
0 votes
3 answers
450 views

Analyzing TCP connection by running Wireshark in two endpoint

I am trying to find the number of lost packets in the network. I have 2 devices say DeviceA and DeviceB. IP addresses are respectively DeviceA : 192.168.0.104 and DeviceB: 192.168.0.105. In order ...
I.K.'s user avatar
  • 111
1 vote
0 answers
74 views

How can we capture traffic under WiFi AP connected with an WAN router?

My PC is connected to the internet via an WiFi access point. The AP is connected to the router that provides global IP address. In our network, some of the PCs (Say PCs1) are directly connected to the ...
mallea's user avatar
  • 519
1 vote
2 answers
642 views

Which port determines the protocol?

If we have a common protocol port on both ends.. say source point is 443 and destination port is 80 (hypothetical situation, I know this combination of ports probably makes no sense).. how do we ...
Jack's user avatar
  • 13
2 votes
2 answers
445 views

What is the advantage of Supervised Machine Learning over Deep Packet Inspection in Network Traffic Classification? [closed]

As per the definition of Deep Packet Inspection (DPI), it uses signatures for packet filtering. Supervised Machine Learning can help put a label on a packet which does not get identified by Deep ...
boomselector's user avatar
5 votes
3 answers
5k views

How does Deep Packet Inspection work with encrypted packets?

I've been reading up on Deep Packet Inspection for Software Defined Networks. However, I know that some applications use encryption to evade Deep Packet Inspection. Is there any alternative (such as ...
boomselector's user avatar
0 votes
1 answer
29 views

Question on windowing and determing connection speed

Hi i'm just learning computer networks and i have learned about windowing in tcp And my question is does we determine connection speed using windowing? I mean computer know the number of packets and ...
Curllog's user avatar
  • 103
0 votes
1 answer
2k views

Weird Wireshark protocol list (eth:ethertype:ip:data where is the "udp"?)

I am capturing incoming and outgoing WAN to LAN data at a particular host on my LAN (i.e., the one actually receiving/sending the data). Sometimes I get anomalous captured frames that are missing the ...
Michael Goldshteyn's user avatar
2 votes
1 answer
747 views

Wireshark capture showing a TCP packet with no flags [closed]

In our network, I captured a TCP packet by Wireshark that has no flag set. What is the meaning of such packet ? Here is the dissection in text format : Frame 1: 54 bytes on wire (432 bits), 54 bytes ...
R1w's user avatar
  • 311
1 vote
2 answers
204 views

Do we send the same packets when we send the same data?

When we send the same data over a network twice, does this means that we are sending the same packets twice? I am trying to understand how my decoder works, so I command using an application on phone,...
yosra's user avatar
  • 113
4 votes
3 answers
1k views

RIP Packet Format

I am trying to investigate a RIP packet. It clearly states that the packet is RIP v1. But its format does not match with the either RIP v1 or v2. Any ideas what this packet actually is?
Bat's user avatar
  • 143
1 vote
1 answer
244 views

When is the HT Capability section in a probe request packet undefined?

I'm analyzing probe request packets and I'm seeing that some of them has an undefined values in HT Capabilities section. Why? Is it not required in all probe request packets?
ph1d0w's user avatar
  • 13
0 votes
1 answer
170 views

How to extract transfer rates from a beacon frame (or WLAN_BSS_ENTRY)?

How can I extract the transfer rates (actually I only need the maximum value) from a WLAN_BSS_ENTRY structure (obtained by WlanGetNetworkBssList)? The value wlanRateSet (WLAN_RATE_SET) seems pretty ...
CodeX's user avatar
  • 101
1 vote
0 answers
4k views

Modifying linux ping icmp payload [closed]

On analyzing ping request and reply from a windows system to Linux. It was observed that the windows ping request payload was "abcdefghijklmnopqrstuvwabcdefghi" with size 32 bytes Could this ...
PDHide's user avatar
  • 227
4 votes
3 answers
2k views

What is responsible for dropping Layer 2 frames that's not addressed to it?

It's my understanding that if a network interface card (NIC) receives a Layer 1 packet, it will extract the Layer 2 frame from it, checks its destination MAC address, and if it is not addressed to it (...
dayuloli's user avatar
  • 143
3 votes
1 answer
555 views

How can a UDP Client and a packet sniffer run on the same machine?

In my understanding, if you have a UDP socket client that is bound to a particular port, then a second UDP client on the same machine can't bind to the same port. If this is the case, then how can a ...
Fred's user avatar
  • 133