Last call to make your voice heard! Our 2022 Developer Survey closes in less than a week. Take survey.

Questions tagged [packet-analysis]

(Packet-analysis) aka Network Traffic analysis is the process of capturing network traffic and inspecting it closely to determine what is happening on the network Providesthe details of network activities and their communication pattern in a network

Filter by
Sorted by
Tagged with
0 votes
1 answer
41 views

Wireshark: Cannot find frame type of packets

I am getting used to Wireshark operation and currently, I am investigating different frames (control, management, data frame) and using filter in these links (https://mrncciew.com/2014/10/02/cwap-802-...
user avatar
0 votes
1 answer
39 views

What does this Wireshark capture filter do

I was reading through a guide where I saw the following Wireshark capture filter used. (tcp[2:2] > 1500 and tcp[2:2] < 1550) I had a brief look over Wireshark's website which listed their ...
user avatar
0 votes
1 answer
33 views

Can an application on two separate devices share a packet to similar resource?

Can packets requested for an image by an app on a phone be sent to same app on another phone by another user?
user avatar
0 votes
1 answer
47 views

Packet capture shows packets larger than MTU

I have been doing some tests with two CentOS computers located in a local network and I don't understand the results. We have a simple application where a client (x.y.z.204) sends text strings to a ...
user avatar
  • 107
0 votes
1 answer
114 views

Size of an ethernet frame carrying an arp request using ip (no options) & ethernet?

OKay so I found that this frame has size 72 bytes with no explanation and I can't seem to be able to figure out why . Ethernet payload will be : ip header + arp packet Arp packet with ip & ethrnet ...
user avatar
0 votes
0 answers
39 views

Understanding IE Content - calculate checksum

I'm trying to understand article about calculate probe request 6-byte footprint. this what it say: First, a 6-byte footprint is initialized to zero (00: 00: 00: 00: 00: 00). The IEs of each Wi-Fi ...
user avatar
0 votes
1 answer
96 views

Probe Request getting\understanding Information Elements (IEs)

I'm trying to read Information Elements (IEs) from the probe request can't seem to understand the stracture of it as I undersatnd it size can be 0-2312 bytes but how do I know how many there are? I ...
user avatar
1 vote
2 answers
45 views

Is this description of data transmission over L3 switch correct?

So I'm trying to describe how data is transmitted over a layer 3 switch (within same Vlan and between Vlan) but I'm not sure if I have understood it correctly. Can anybody verify if this description ...
user avatar
1 vote
2 answers
82 views

Calculating Checksum for ICMPv6 Packet

I have a packet that has a checksum of 0xffff, and a calculated checksum of 0x0000. I know in UDP, a checksum of 0x0000 is not allowed, and is instead replaced with 0xffff, thus the packet should be ...
user avatar
2 votes
1 answer
53 views

Which command is used in Cisco ASA Firewall to display the whole packet flow?

Which command is used in Cisco ASA Firewall to display the whole packet flow on the firewall? This same command allows you to see if traffic is allowed, NATed, or going through a VPN tunnel?
user avatar
2 votes
1 answer
70 views

How does deep packet inspection (DPI) extract metadata from packets?

DPI software extracts metadata (as an additional function apart from classifying applications / protocols) But how does it do this? For classification, I get that you can use pattern matching or port-...
user avatar
0 votes
0 answers
14 views

Some random client requests fails with unexpected TCP [RST] packets [duplicate]

I have a service doing listen that serves clients over a TCP sockets connection with a raw binary protocol. The principle is basic: the connection is established, the client sends a request with data, ...
user avatar
  • 1
0 votes
1 answer
62 views

Homeplug av frame

I want to check differences between a frame sent by a pc connected to an homeplug and one pc connected directly with the gateway/router. When i sniff packets i cannot see any differences in the frame, ...
user avatar
0 votes
2 answers
122 views

Detecting Ethernet over power by packets

If someone plugs an Ethernet over power (EOP, Homeplug) into the switch and then connect elsewhere in the building, can I detect this device by sniffing the packets with tools like Wireshark or ...
user avatar
0 votes
0 answers
42 views

Man in the middle legitimate packet inspection

we're trying to debug a faulty Panasonic Mobile softphone SIP app (both Android & Apple versions), as many calls are randomly dropped unexpectedly. This is the conceptual connection diagram: We ...
user avatar
  • 161
0 votes
2 answers
134 views

Ethernet frame encapsulation - multiple

is it possible to encapsulate two Ethernet frame packets into one ether packet? My search seems to indicate that there is not a way to do this, unless one was using something like VPN packets, be ...
user avatar
1 vote
1 answer
1k views

How do I set a display filter in wireshark that sorts by destination broadcast?

1 0.000000 Vmware_90:07:7b Broadcast ARP 60 Who has 192.168.185.144? Tell 192.168.185.7 27 0.995837 28.144.7.123 192.168.185.144 HTTP 1177 HTTP/1.1 200 OK (...
user avatar
0 votes
1 answer
266 views

Capture traffic flowing through a Brocade switch remotely

I am currently doing packet capture through mirroring with Wireshark as mentioned in this post I can mirror the traffic to a port physically jacked into and analyze the packets redirected there w/ ...
user avatar
0 votes
2 answers
269 views

Why the most of packet sniffer require sudo when they executing? [closed]

I was just wondering why most of the packet sniffers require sudo? I'm guessing that they may work at the low-level areas to sniff packets, but I'd like to know the exact reason for their mechanism ...
user avatar
  • 103
0 votes
3 answers
8k views

how to capture DHCP packets in wireshark

Hy! I want to capture DHCP packets in Wireshark but I did not receive any. Not my filter wrong, I don't get any. So I think I can't trigger the DHCP communications. my filters: dhcp bootp udp.port == ...
user avatar
1 vote
0 answers
48 views

What is the best way to match packets across pcap files from different capture points? [closed]

I have multiple pcap files which contain data from different capture points in the network. Previously I thought that by using the IP-ID field I can match the packets across the capture files but I ...
user avatar
  • 226
0 votes
1 answer
67 views

Do using proxies and surfing the internet create multiple headers in the packet? [closed]

Apologies for these silly questions. As I am new to networking. For example, If I configured my browser to use proxy of IP address: a.b.c.d and my IP address: e.f.g.h. And I visit example.com. What ...
user avatar
0 votes
1 answer
416 views

how to send a number of TCP packets and capture only those packets using tshark?

I'm using iperf3 to send 1005 TCP packets with the commands: iperf3 -s -i 1 -f m -p 5200 -D iperf3 -c 10.60.0.113 -k 1005 -bitrate 0 --reverse --omit 2 -p 5200 In server, client respectively. The ...
user avatar
  • 121
1 vote
1 answer
104 views

How do I interpret this Wireshark log file?

I'm new to using Wireshark and I'd like some help with analyzing the log shown in the image. I also ran a nmap scan of the ports on my computer, but I'm not able to identify which of these lines are ...
user avatar
  • 11
1 vote
2 answers
36 views

Determining that the entire packet was captured

New to packet and flow analysis. Some related basic Qs: Having a .PCAP file, how does one determine if the entirety of packets were captured? Would the size of the entire packet, and their collective ...
user avatar
  • 13
12 votes
2 answers
3k views

Why does Ethernet use EtherType field to determine what type of packet is in a frame instead of just looking at the packet header?

I'm studying for some networking concepts and have learned that a receiving host looks at an Ethernet frame's header to determine what protocol being used by the packet. It makes me wonder though, ...
user avatar
  • 131
2 votes
1 answer
68 views

Why do we need machine learning for QoS classification in SDNs if we have DSCP in IP address for QoS enforcement?

DiffServ (Differentiated services) uses a 6-bit differentiated services code point (DSCP) in the 8-bit differentiated services field (DS field) in the IP header for packet classification purposes. If ...
user avatar
5 votes
3 answers
2k views

Unknown EtherType

I am parsing an ethernet dataframe. It has the form : (destination_mac_6_bytes) + (source_mac_6_bytes) + (ether_type_2_bytes). Usually, I see ethertype like Ox86dd (IPv6). But I came across this ...
user avatar
  • 175
0 votes
2 answers
96 views

Can Northbound interfaces (REST API) in a Software Defined Network (SDN) be used to manipulate QoS parameters?

I am working on a project involving Quality of Service (QoS) manipulation in Software Defined Networks (SDNs). I know that the following parameters affect the QoS in an SDN: Time information (inter-...
user avatar
0 votes
3 answers
402 views

Analyzing TCP connection by running Wireshark in two endpoint

I am trying to find the number of lost packets in the network. I have 2 devices say DeviceA and DeviceB. IP addresses are respectively DeviceA : 192.168.0.104 and DeviceB: 192.168.0.105. In order ...
user avatar
  • 111
1 vote
0 answers
27 views

How can we capture traffic under WiFi AP connected with an WAN router?

My PC is connected to the internet via an WiFi access point. The AP is connected to the router that provides global IP address. In our network, some of the PCs (Say PCs1) are directly connected to the ...
user avatar
  • 501
1 vote
2 answers
346 views

Which port determines the protocol?

If we have a common protocol port on both ends.. say source point is 443 and destination port is 80 (hypothetical situation, I know this combination of ports probably makes no sense).. how do we ...
user avatar
  • 13
2 votes
2 answers
407 views

What is the advantage of Supervised Machine Learning over Deep Packet Inspection in Network Traffic Classification? [closed]

As per the definition of Deep Packet Inspection (DPI), it uses signatures for packet filtering. Supervised Machine Learning can help put a label on a packet which does not get identified by Deep ...
user avatar
4 votes
3 answers
3k views

How does Deep Packet Inspection work with encrypted packets?

I've been reading up on Deep Packet Inspection for Software Defined Networks. However, I know that some applications use encryption to evade Deep Packet Inspection. Is there any alternative (such as ...
user avatar
0 votes
1 answer
24 views

Question on windowing and determing connection speed

Hi i'm just learning computer networks and i have learned about windowing in tcp And my question is does we determine connection speed using windowing? I mean computer know the number of packets and ...
user avatar
0 votes
1 answer
1k views

Weird Wireshark protocol list (eth:ethertype:ip:data where is the "udp"?)

I am capturing incoming and outgoing WAN to LAN data at a particular host on my LAN (i.e., the one actually receiving/sending the data). Sometimes I get anomalous captured frames that are missing the ...
user avatar
1 vote
1 answer
413 views

Wireshark captures TCP packet with no flag [closed]

In our network, I captured a TCP packet by Wireshark that has no flag set. What's that mean? Is it normal?
user avatar
  • 281
1 vote
2 answers
146 views

Do we send the same packets when we send the same data?

When we send the same data over a network twice, does this means that we are sending the same packets twice? I am trying to understand how my decoder works, so I command using an application on phone,...
user avatar
  • 113
4 votes
3 answers
1k views

RIP Packet Format

I am trying to investigate a RIP packet. It clearly states that the packet is RIP v1. But its format does not match with the either RIP v1 or v2. Any ideas what this packet actually is?
user avatar
  • 143
1 vote
1 answer
200 views

When is the HT Capability section in a probe request packet undefined?

I'm analyzing probe request packets and I'm seeing that some of them has an undefined values in HT Capabilities section. Why? Is it not required in all probe request packets?
user avatar
  • 13
0 votes
1 answer
109 views

How to extract transfer rates from a beacon frame (or WLAN_BSS_ENTRY)?

How can I extract the transfer rates (actually I only need the maximum value) from a WLAN_BSS_ENTRY structure (obtained by WlanGetNetworkBssList)? The value wlanRateSet (WLAN_RATE_SET) seems pretty ...
user avatar
  • 101
1 vote
0 answers
3k views

Modifying linux ping icmp payload [closed]

On analyzing ping request and reply from a windows system to Linux. It was observed that the windows ping request payload was "abcdefghijklmnopqrstuvwabcdefghi" with size 32 bytes Could this ...
user avatar
  • 227
4 votes
3 answers
1k views

What is responsible for dropping Layer 2 frames that's not addressed to it?

It's my understanding that if a network interface card (NIC) receives a Layer 1 packet, it will extract the Layer 2 frame from it, checks its destination MAC address, and if it is not addressed to it (...
user avatar
  • 143
3 votes
1 answer
460 views

How can a UDP Client and a packet sniffer run on the same machine?

In my understanding, if you have a UDP socket client that is bound to a particular port, then a second UDP client on the same machine can't bind to the same port. If this is the case, then how can a ...
user avatar
  • 133
1 vote
1 answer
698 views

How to filter a wireshark capture (pcapng) by source and destination IPv4 address

I have a bunch of wireshark captures I need to mine data from. Tshark seems to fit the bill but this doesn't support filtering (-f) by the look of it, I simply get: Using: tshark -x -r Run18....
user avatar
2 votes
1 answer
6k views

What does a "Frame" relate to in the WIreshark packet details pane?

Currently learning to use Wireshark. When I take a capture and click on one of it's rows, I see the following breakdown in the "Packet Details" pane: Frame Linux Cooked Capture Internet Protocol ...
user avatar
  • 165
0 votes
2 answers
567 views

IP TTL value zero upon receipt [duplicate]

Is it possible that my user-space application using the UNIX sockets API would receive an UDP packet that would have the IP TTL value equal to zero, or is it the case that it always has to be one or ...
user avatar
1 vote
2 answers
56 views

Network Packet that allows maximum throughput

I created a basic wireless system between two microcontrollers. Each uses the on-chip UART and an HM-TRP radio module to communicate with each other. Eventually I'll have a master-slave setup where ...
user avatar
2 votes
1 answer
495 views

how to get RSSI information of WiFi users in wireshark?

If I'm able to get 802.11n traffic with my network adapter, would I be able to see the RSSI information? what should be the filter to see it?
user avatar
  • 121
6 votes
4 answers
216 views

Packet Collison Avoidance

If a wireless network has collision avoidance, how comes the network slows down if more clients connect to it?
user avatar
  • 163