Stack Exchange Network

Stack Exchange network consists of 174 Q&A communities including Stack Overflow, the largest, most trusted online community for developers to learn, share their knowledge, and build their careers.

Visit Stack Exchange

(Packet-analysis) aka Network Traffic analysis is the process of capturing network traffic and inspecting it closely to determine what is happening on the network Providesthe details of network activities and their communication pattern in a network

0
votes
0answers
18 views

TCP Retransmission requests from IPTV Server and TCP Dup Ack Requests from Client [on hold]

Server address ( 208.240.190.100) and client ( 210.220.160.48). We are having some problem in the IPTV traffic. It stucks sometimes and sometimes there is a delay in video . Below mentioned is the tcp ...
-1
votes
0answers
33 views

Odd CraigsList Issue

Okay, so having an odd issue with a network at work. This is a fairly small LAN with about 30-50 workstations / devices / printers / etc. So the issue in essence is that only one of the workstation on ...
0
votes
1answer
38 views

How to filter a wireshark capture (pcapng) by source and destination IPv4 address

I have a bunch of wireshark captures I need to mine data from. Tshark seems to fit the bill but this doesn't support filtering (-f) by the look of it, I simply get: Using: tshark -x -r Run18....
0
votes
1answer
27 views

What does a “Frame” relate to in the WIreshark packet details pane?

Currently learning to use Wireshark. When I take a capture and click on one of it's rows, I see the following breakdown in the "Packet Details" pane: Frame Linux Cooked Capture Internet Protocol ...
0
votes
2answers
15 views

IP TTL value zero upon receipt [duplicate]

Is it possible that my user-space application using the UNIX sockets API would receive an UDP packet that would have the IP TTL value equal to zero, or is it the case that it always has to be one or ...
-1
votes
0answers
47 views

RTT and ACK RTT

In Wireshark I have TCP conversation with iRTT of 55ms, but I noticed in Wireshark that ACK RTT time is increasing constantly, starting from 60ms (without SYN ACK packet in which I see iRTT of 55ms) ...
0
votes
2answers
35 views

Network Packet that allows maximum throughput

I created a basic wireless system between two microcontrollers. Each uses the on-chip UART and an HM-TRP radio module to communicate with each other. Eventually I'll have a master-slave setup where ...
1
vote
1answer
49 views

how to get RSSI information of WiFi users in wireshark?

If I'm able to get 802.11n traffic with my network adapter, would I be able to see the RSSI information? what should be the filter to see it?
5
votes
4answers
174 views

Packet Collison Avoidance

If a wireless network has collision avoidance, how comes the network slows down if more clients connect to it?
0
votes
1answer
109 views

Wireshark capture only TCP packets with the RST flag set

I'm quite new to networking and I got stuck while reading "Practical Packet Analysis: Using Wireshark to Solve...". On page 61 it is written: A common scenario is to capture only TCP packets ...
1
vote
0answers
23 views

Where can i find literature on how Firewall logs are generated? [closed]

How are firewall logs generated, I want to know how frequently (or how infrequently ) are logs generated from reading packet data if that is what it is. I want to detect anomaly on an enterprise ...
4
votes
1answer
100 views

VOIP timeout behind Cisco ASA after Duplicate ACK and Retransmissions

We have a RingCentral Polycom VVX series VOIP phone behind a Cisco ASA 5506 that will provision, work for about five minutes, go off-line for 20 minutes then reconnect and continue to work unless ...
1
vote
1answer
72 views

Extracting a bit rate

I'm trying to figure out what is the lowest layer of the OSI model that can be used to extract a bit rate (through a packet sniffer). I'm not sure if it's possible through only the physical layer, or ...
3
votes
1answer
1k views

How can I filter out particular MAC addresses when running tshark on a pcap trace?

I've tried a number of things, but none of them seem to do the trick. I want to run this command: tshark -r data.pcap -T fields -e frame.time_epoch -e frame.len but to have it ignore any packets ...
0
votes
1answer
32 views

Cable Internet Packet collecting

I've been reading Computer Networking: A top down approach and I don't understand something about cable internet. The book says that since cable internet is a shared medium, every packet sent by the ...
1
vote
3answers
75 views

how to filter only internet packets (not local) in TCP/IP?

I have a packet sniffer that mean i can read all packets sent or received to the computer(with all headers like src & dst IP:PORT). I want to filter packets that sent/received to/from internet (...
0
votes
3answers
493 views

Minimum possible size of Ethernet/IGMP frames

I am writing an application that needs to ignore frames whose size is smaller than the minimum possible size of Ethernet/IGMP frames. I have researched extensively and found the following information: ...
1
vote
2answers
84 views

Network fluctuation / delay monitoring between two nodes

Problem background: Our application communicates with multiple other nodes over SCTP. A few times in past issues were reported because of network fluctuation or too much delays that appeared for very ...
0
votes
1answer
43 views

Is the auto-correlation of a frame transient based on the physical characteristics of a device?

I am currently studying ways to fingerprint Wi-Fi devices based on their physical characteristics and I was struck by a question after reading Section B of this paper http://www.ccs-labs.org/bib/...
0
votes
2answers
73 views

Can I find port number with the TCP checksum?

So I got a frame where the port information is missing but I have everything else, how can I retrieve the port that where used in the frame ? I was thinking about the tcp checksum, but is it ...
1
vote
2answers
144 views

Wireshark capturing device ip

ok so here's the scenario: Computer A captures some packets and saves the session into file 'traffic'. Later on, Computer B opens the 'traffic' file and wants to know who captured the file...the ip ...
0
votes
1answer
3k views

Wireshark No response seen sending ping request

I'm building my own packets and sending them through a raw socket. The packet is apparently A-OK, but I'm not getting any replies. Sequence block is generated with a for loop. Identifier block is ...
1
vote
1answer
230 views

Is it possible to create an IPv4 packet header larger than 20 bytes on an IPv4 connection?

Is it possible to generate an IPv4 packet with an IPv4 packet header larger than 20 bytes on an IPv4 connections?
1
vote
2answers
207 views

Connect to local network using WAN IP address

I have a simple network in my company, where I use my ISP's ADSL Router. The LAN is 192.168.1.0/24. Router's IP is 192.168.1.1. It also has DHCP enabled, which ranges from 2 to 250. I have a Digital ...
1
vote
1answer
759 views

Extremely large sequence and acknowledge numbers when using Scapy

I am using Scapy to try and read the seq and ack numbers of tcp packets using the following sample code: packet = sniff(iface=argv[1], prn=scan, filter="", count=1)[0] print "Found SEQ " + str(packet....
1
vote
0answers
899 views

Size of packets in Wireshark [closed]

I only getting familiar with Wireshark, and there is one thing that I can't put together: estimating sizes of messages. I want to understand how much traffic my desktop application generates during it'...
1
vote
0answers
24 views

Does increasing the FEC decreases the payload in the maximum packet size?

we can find the maximum packet size by the formula packet err rate = 1 - (1 - bit err rate)^(max packet size) so does this max packet size include the FEC bits? I assume this formula gives the max ...
1
vote
1answer
126 views

capturing ipv4 packets on a http port

I tried to listen for ipv4 packets on the HTTP port 80, however I just got received HTTP string back - is this the right way to go about things? My understanding was that a TCP packet would be ...
2
votes
1answer
176 views

`tcpdump bootp.type == 2` tcpdump: syntax error

tcpdump -i eth0 'bootp.type == 2' Results in a: tcpdump: syntax error However, bootp.type == 2 works fine in Wireshark. Also tcpdump -i eth0 'tcp[13] & 16!=0' works fine, no syntax error....
0
votes
1answer
72 views

IPFIX - consider only first n seconds of a flow

Is possible to consider via IPFIX only the first n seconds of a flow (statistics)? How to set this in OpenVSwitch if possible?
4
votes
2answers
128 views

How troubleshoot poor ipsec connection?

I have a site-to-site ipsec connection which has low throughput, but the ethernet connection itself between the same endpoints is good (ie without ipsec there is high throughput). The ipsec routers ...
1
vote
1answer
74 views

Ipfix in openvSwitch

The sampling parameter in openvswitch to enable IPFIX what it refers to? For example, a value of 1 means what? Furthermore, as the difference there is per-bridge sampling and per-flow sampling?
2
votes
3answers
164 views

ipfix - variance of size packets in a flow

I have the need to calculate the variance of the size of the packets in a flow. So it is impossible using IPFIX? There are new alternatives to IPFIX that would allow me to calculate that value? Thanks
1
vote
1answer
205 views

Packet sizes with ipfix

It is possible, through IPFIX, take each size packet in a flow? It seems to exist only the sum of the sizes and the number of packets.
0
votes
2answers
1k views

Does every packet contain headers from each layer of the OSI model?

Pretty straight-forward question. Read through Section One of the 802.3 standard, and I found a nice model of a MAC frame that gives me extra insight, but I see that this question is not asked ...
1
vote
1answer
50 views

What type of packet is 0x5577

I've been trying to find out what type of packet is 0x5577, based on this page. The following is a snapshot of the source code that indicates this values: f = myproto() f.timestamp = int(time....
2
votes
2answers
484 views

Switch SPAN Port Overload

I would like to monitor all traffic that passes between devices connected to a switch (no particular switch make or model - I would need to do this for many types of switches encountered on many ...
1
vote
2answers
401 views

Can the source mac address in an Ethernet header be used to identify the sender?

I have programmed raw socket programs in C/C++ to initiate small tasks such as TCP/IP 3-way-handshakes, UDP, RTMP, etc. However I became curious about the next layer below IP and I was looking at an ...
1
vote
1answer
56 views

How do computers connected to a Wi-Fi network communicate within the same network?

Let us assume Host A wants to contact Host B. Does it send the packet addressing (IP address of the Host B) and MAC address of router, or does it use ARP to send to the MAC address of the Host B?
0
votes
1answer
157 views

Software defined system

Over (Software defined network) what will happen when unknown Ethernet hits the first switch, using 4 OF switch and 8 host.
1
vote
1answer
99 views

How can OSI model allow packet sniffing pass through layer 1?

In an envrionment where there is no packet switching, say a simple hub that repeats the signal from a port to all other ports, or a splitter, how come a packet can be sniffed? I mean, if the packet's ...
0
votes
2answers
388 views

The difference between simple ACK and ACK aggregation improvement in TCP

I came across a new term in TCP ACK aggregation which is a bit new to me. I tried finding a good resource online that precisely explains this concept in a clear but unfortunately all of them are very ...
1
vote
1answer
110 views

Deep Packet Inspection

Which component (the traffic processor, the CPU or some other component) of a switch/router is responsible for packet classification/DPI? Also, where along the data path is this operation performed (...
0
votes
0answers
67 views

wireshark packet analysis

can anyone suggest me to investigate headers only in wireshark ? I have list of packets and I want to make them work if and only if I would able to see different headers attached to them. How can I ...
1
vote
1answer
234 views

Redundant acknowledgement numbers in TCP stream

I am currently working on making test scripts for regression testing of FreeBSD's TCP/IP stack using Google's packetdrill. However, there is a slight problem which I am having involving sequence ...
0
votes
2answers
44 views

Can servers find out which wifi AP was used to access the network?

If you connect to a website through a wifi network where there are a number of access points with the same ESSID and a different BSSID, would the servers of that website know which AP was used? So, ...
1
vote
2answers
755 views

Probe Request Frames

OBJECTIVE The end goal here s to build a python program with Scapy that detects all access points within range of my machine. UNDERSTANDING I understand this is normally done by using 802.11 Frame ...
0
votes
3answers
2k views

Maximum packet size Ethernet Frame and IP packet

I am a little bit confused about one fact. According to the specification, the ethernet frame maximum size is 1518 bytes, and the IPv4 packet size Length field in an IPv4 header can be up to 65535 ...
0
votes
2answers
72 views

How can I identify which device is which in my network just using my computer?

No engineer here, but I know some programming. I need to find out which device is which just using my computer. I tried using wireshark but since I only use windows 7 (don't ask but I can't use linux ...
1
vote
0answers
583 views

TCP retransmissions when we rapidly open multiple connections to the same host

We are experiencing a retransmission issue on some of our computers on our LAN, when connecting to external hosts. I first started trying to trace the issue when the npm typings install command was ...