Stack Exchange Network

Stack Exchange network consists of 174 Q&A communities including Stack Overflow, the largest, most trusted online community for developers to learn, share their knowledge, and build their careers.

Visit Stack Exchange

(Packet-analysis) aka Network Traffic analysis is the process of capturing network traffic and inspecting it closely to determine what is happening on the network Providesthe details of network activities and their communication pattern in a network

-1
votes
0answers
7 views

can I use monitor mode on a Kali Linux virtual machine? [on hold]

I have a Windows 10 PC which doesn't support monitor mode, so I can't sniff wireless packets when using Wireshark. I read that Kali Linux can do it, so I wonder, if my Kali Linux machine, hosted in my ...
0
votes
0answers
8 views

Hardware requirements for 10Gbps line rate packet processing [on hold]

How do I calculate the horse power required for worst case packet processing scenarios? First, a little more background, I'm building a device for packet analysis. My test box currently runs on ...
0
votes
0answers
18 views

RTT and ACK RTT

In Wireshark I have TCP conversation with iRTT of 55ms, but I noticed in Wireshark that ACK RTT time is increasing constantly, starting from 60ms (without SYN ACK packet in which I see iRTT of 55ms) ...
0
votes
2answers
32 views

Network Packet that allows maximum throughput

I created a basic wireless system between two microcontrollers. Each uses the on-chip UART and an HM-TRP radio module to communicate with each other. Eventually I'll have a master-slave setup where ...
1
vote
1answer
36 views

how to get RSSI information of WiFi users in wireshark?

If I'm able to get 802.11n traffic with my network adapter, would I be able to see the RSSI information? what should be the filter to see it?
5
votes
4answers
169 views

Packet Collison Avoidance

If a wireless network has collision avoidance, how comes the network slows down if more clients connect to it?
0
votes
1answer
52 views

Wireshark capture only TCP packets with the RST flag set

I'm quite new to networking and I got stuck while reading "Practical Packet Analysis: Using Wireshark to Solve...". On page 61 it is written: A common scenario is to capture only TCP packets ...
1
vote
0answers
23 views

Where can i find literature on how Firewall logs are generated? [closed]

How are firewall logs generated, I want to know how frequently (or how infrequently ) are logs generated from reading packet data if that is what it is. I want to detect anomaly on an enterprise ...
4
votes
1answer
68 views

VOIP timeout behind Cisco ASA after Duplicate ACK and Retransmissions

We have a RingCentral Polycom VVX series VOIP phone behind a Cisco ASA 5506 that will provision, work for about five minutes, go off-line for 20 minutes then reconnect and continue to work unless ...
1
vote
1answer
71 views

Extracting a bit rate

I'm trying to figure out what is the lowest layer of the OSI model that can be used to extract a bit rate (through a packet sniffer). I'm not sure if it's possible through only the physical layer, or ...
2
votes
1answer
634 views

How can I filter out particular MAC addresses when running tshark on a pcap trace?

I've tried a number of things, but none of them seem to do the trick. I want to run this command: tshark -r data.pcap -T fields -e frame.time_epoch -e frame.len but to have it ignore any packets ...
0
votes
1answer
30 views

Cable Internet Packet collecting

I've been reading Computer Networking: A top down approach and I don't understand something about cable internet. The book says that since cable internet is a shared medium, every packet sent by the ...
0
votes
3answers
72 views

how to filter only internet packets (not local) in TCP/IP?

I have a packet sniffer that mean i can read all packets sent or received to the computer(with all headers like src & dst IP:PORT). I want to filter packets that sent/received to/from internet (...
-1
votes
3answers
368 views

Minimum possible size of Ethernet/IGMP frames

I am writing an application that needs to ignore frames whose size is smaller than the minimum possible size of Ethernet/IGMP frames. I have researched extensively and found the following information: ...
1
vote
2answers
80 views

Network fluctuation / delay monitoring between two nodes

Problem background: Our application communicates with multiple other nodes over SCTP. A few times in past issues were reported because of network fluctuation or too much delays that appeared for very ...
0
votes
1answer
43 views

Is the auto-correlation of a frame transient based on the physical characteristics of a device?

I am currently studying ways to fingerprint Wi-Fi devices based on their physical characteristics and I was struck by a question after reading Section B of this paper http://www.ccs-labs.org/bib/...
0
votes
2answers
71 views

Can I find port number with the TCP checksum?

So I got a frame where the port information is missing but I have everything else, how can I retrieve the port that where used in the frame ? I was thinking about the tcp checksum, but is it ...
1
vote
2answers
134 views

Wireshark capturing device ip

ok so here's the scenario: Computer A captures some packets and saves the session into file 'traffic'. Later on, Computer B opens the 'traffic' file and wants to know who captured the file...the ip ...
0
votes
1answer
3k views

Wireshark No response seen sending ping request

I'm building my own packets and sending them through a raw socket. The packet is apparently A-OK, but I'm not getting any replies. Sequence block is generated with a for loop. Identifier block is ...
1
vote
1answer
195 views

Is it possible to create an IPv4 packet header larger than 20 bytes on an IPv4 connection?

Is it possible to generate an IPv4 packet with an IPv4 packet header larger than 20 bytes on an IPv4 connections?
1
vote
2answers
178 views

Connect to local network using WAN IP address

I have a simple network in my company, where I use my ISP's ADSL Router. The LAN is 192.168.1.0/24. Router's IP is 192.168.1.1. It also has DHCP enabled, which ranges from 2 to 250. I have a Digital ...
1
vote
1answer
563 views

Extremely large sequence and acknowledge numbers when using Scapy

I am using Scapy to try and read the seq and ack numbers of tcp packets using the following sample code: packet = sniff(iface=argv[1], prn=scan, filter="", count=1)[0] print "Found SEQ " + str(packet....
1
vote
0answers
649 views

Size of packets in Wireshark [closed]

I only getting familiar with Wireshark, and there is one thing that I can't put together: estimating sizes of messages. I want to understand how much traffic my desktop application generates during it'...
1
vote
0answers
20 views

Does increasing the FEC decreases the payload in the maximum packet size?

we can find the maximum packet size by the formula packet err rate = 1 - (1 - bit err rate)^(max packet size) so does this max packet size include the FEC bits? I assume this formula gives the max ...
1
vote
1answer
91 views

capturing ipv4 packets on a http port

I tried to listen for ipv4 packets on the HTTP port 80, however I just got received HTTP string back - is this the right way to go about things? My understanding was that a TCP packet would be ...
2
votes
1answer
155 views

`tcpdump bootp.type == 2` tcpdump: syntax error

tcpdump -i eth0 'bootp.type == 2' Results in a: tcpdump: syntax error However, bootp.type == 2 works fine in Wireshark. Also tcpdump -i eth0 'tcp[13] & 16!=0' works fine, no syntax error....
0
votes
1answer
68 views

IPFIX - consider only first n seconds of a flow

Is possible to consider via IPFIX only the first n seconds of a flow (statistics)? How to set this in OpenVSwitch if possible?
4
votes
2answers
110 views

How troubleshoot poor ipsec connection?

I have a site-to-site ipsec connection which has low throughput, but the ethernet connection itself between the same endpoints is good (ie without ipsec there is high throughput). The ipsec routers ...
1
vote
1answer
71 views

Ipfix in openvSwitch

The sampling parameter in openvswitch to enable IPFIX what it refers to? For example, a value of 1 means what? Furthermore, as the difference there is per-bridge sampling and per-flow sampling?
2
votes
3answers
161 views

ipfix - variance of size packets in a flow

I have the need to calculate the variance of the size of the packets in a flow. So it is impossible using IPFIX? There are new alternatives to IPFIX that would allow me to calculate that value? Thanks
1
vote
1answer
177 views

Packet sizes with ipfix

It is possible, through IPFIX, take each size packet in a flow? It seems to exist only the sum of the sizes and the number of packets.
0
votes
2answers
1k views

Does every packet contain headers from each layer of the OSI model?

Pretty straight-forward question. Read through Section One of the 802.3 standard, and I found a nice model of a MAC frame that gives me extra insight, but I see that this question is not asked ...
1
vote
1answer
47 views

What type of packet is 0x5577

I've been trying to find out what type of packet is 0x5577, based on this page. The following is a snapshot of the source code that indicates this values: f = myproto() f.timestamp = int(time....
2
votes
2answers
423 views

Switch SPAN Port Overload

I would like to monitor all traffic that passes between devices connected to a switch (no particular switch make or model - I would need to do this for many types of switches encountered on many ...
0
votes
2answers
337 views

Can the source mac address in an Ethernet header be used to identify the sender?

I have programmed raw socket programs in C/C++ to initiate small tasks such as TCP/IP 3-way-handshakes, UDP, RTMP, etc. However I became curious about the next layer below IP and I was looking at an ...
1
vote
1answer
55 views

How do computers connected to a Wi-Fi network communicate within the same network?

Let us assume Host A wants to contact Host B. Does it send the packet addressing (IP address of the Host B) and MAC address of router, or does it use ARP to send to the MAC address of the Host B?
0
votes
1answer
156 views

Software defined system

Over (Software defined network) what will happen when unknown Ethernet hits the first switch, using 4 OF switch and 8 host.
1
vote
1answer
89 views

How can OSI model allow packet sniffing pass through layer 1?

In an envrionment where there is no packet switching, say a simple hub that repeats the signal from a port to all other ports, or a splitter, how come a packet can be sniffed? I mean, if the packet's ...
0
votes
2answers
335 views

The difference between simple ACK and ACK aggregation improvement in TCP

I came across a new term in TCP ACK aggregation which is a bit new to me. I tried finding a good resource online that precisely explains this concept in a clear but unfortunately all of them are very ...
1
vote
1answer
105 views

Deep Packet Inspection

Which component (the traffic processor, the CPU or some other component) of a switch/router is responsible for packet classification/DPI? Also, where along the data path is this operation performed (...
0
votes
0answers
64 views

wireshark packet analysis

can anyone suggest me to investigate headers only in wireshark ? I have list of packets and I want to make them work if and only if I would able to see different headers attached to them. How can I ...
1
vote
1answer
221 views

Redundant acknowledgement numbers in TCP stream

I am currently working on making test scripts for regression testing of FreeBSD's TCP/IP stack using Google's packetdrill. However, there is a slight problem which I am having involving sequence ...
0
votes
2answers
32 views

Can servers find out which wifi AP was used to access the network?

If you connect to a website through a wifi network where there are a number of access points with the same ESSID and a different BSSID, would the servers of that website know which AP was used? So, ...
0
votes
2answers
610 views

Probe Request Frames

OBJECTIVE The end goal here s to build a python program with Scapy that detects all access points within range of my machine. UNDERSTANDING I understand this is normally done by using 802.11 Frame ...
0
votes
3answers
2k views

Maximum packet size Ethernet Frame and IP packet

I am a little bit confused about one fact. According to the specification, the ethernet frame maximum size is 1518 bytes, and the IPv4 packet size Length field in an IPv4 header can be up to 65535 ...
0
votes
2answers
71 views

How can I identify which device is which in my network just using my computer?

No engineer here, but I know some programming. I need to find out which device is which just using my computer. I tried using wireshark but since I only use windows 7 (don't ask but I can't use linux ...
1
vote
0answers
468 views

TCP retransmissions when we rapidly open multiple connections to the same host

We are experiencing a retransmission issue on some of our computers on our LAN, when connecting to external hosts. I first started trying to trace the issue when the npm typings install command was ...
2
votes
1answer
252 views

What happens in SACK when there are multiple gaps in the received packets?

Suppose a client has received 0 to 500, 900 to 1100 and 1300 to 2000 how will ACK and SACK look like? Does it look like this ACK: 500 SACK:900-1100 and then it asks for the packets 1100 to 1300 in new ...
0
votes
1answer
1k views

Extract packets with ECN notification set.

I am trying to understand DCTCP behavior. For that I am using RED queue discipline on switch port. I am generating traffic using iperf3 for 30 seconds. To capture the packets i am using tcpdump. ...
1
vote
1answer
3k views

tcpdump not capturing all TCP packets when capturing whole packets

I have a server and a client on different machines and on different locations. I'm trying to capture TCP packets with tcpdump on an interface of the server machine. I've injected an identifier in the ...