Questions tagged [packet-analysis]

(Packet-analysis) aka Network Traffic analysis is the process of capturing network traffic and inspecting it closely to determine what is happening on the network Providesthe details of network activities and their communication pattern in a network

Filter by
Sorted by
Tagged with
0
votes
0answers
10 views

Capturing 802.11 Probe Requests [on hold]

First time poster, hoping I dont commit any faux pas. I am working on a project involving the capture of client probe requests, however I am very new to the kali/packet sniffing scene, how realistic ...
0
votes
0answers
11 views

how to change ttl value on VM [closed]

I have two virtual machine, ubuntu16(10.10.10.1) and centos7(10.10.10.2). I want to create 3way handshakeing packets with different TTL value between them. I am using scapy and setting ttl and in the ...
0
votes
0answers
27 views

Regular failure to capture HTTP2

Wireshark will, at times, capture the HTTP/2 traffic (over TLS) without any trouble. However, more often it fails to capture it at all or will only cature . I suspect that it's unable to unwrap the ...
0
votes
1answer
80 views

Weird Wireshark protocol list (eth:ethertype:ip:data where is the “udp”?)

I am capturing incoming and outgoing WAN to LAN data at a particular host on my LAN (i.e., the one actually receiving/sending the data). Sometimes I get anomalous captured frames that are missing the ...
1
vote
0answers
50 views

What is UDP traffic on port 80 and 1024? [closed]

I am currently investigating a set of anonymized passive Internet traces from a monitor in New York. There I am seeing a lot of traffic on UDP ports 80 and 1024, and I was wondering what that could be....
0
votes
1answer
51 views

Wireshark captures TCP packet with no flag [closed]

In our network, I captured a TCP packet by Wireshark that has no flag set. What's that mean? Is it normal?
1
vote
2answers
74 views

Do we send the same packets when we send the same data?

When we send the same data over a network twice, does this means that we are sending the same packets twice? I am trying to understand how my decoder works, so I command using an application on phone,...
4
votes
3answers
1k views

RIP Packet Format

I am trying to investigate a RIP packet. It clearly states that the packet is RIP v1. But its format does not match with the either RIP v1 or v2. Any ideas what this packet actually is?
0
votes
0answers
27 views

What do the multiple occurencies mean in a packet trace file?

I have a trace file and I used tshark to find out the number of duplicate ACKs, with the following command: tshark -r file.pcap -T fields -e frame.number -e tcp.analysis.duplicate_ack After some ...
1
vote
1answer
59 views

When is the HT Capability section in a probe request packet undefined?

I'm analyzing probe request packets and I'm seeing that some of them has an undefined values in HT Capabilities section. Why? Is it not required in all probe request packets?
0
votes
0answers
36 views

DUP/ACK Reconciliation

When I see a DUP ACK I understand that it is saying that the packet I received doesn't have the expected sequence number and that I send back what I expected the sequence number to be. My question is ...
0
votes
1answer
46 views

How to extract transfer rates from a beacon frame (or WLAN_BSS_ENTRY)?

How can I extract the transfer rates (actually I only need the maximum value) from a WLAN_BSS_ENTRY structure (obtained by WlanGetNetworkBssList)? The value wlanRateSet (WLAN_RATE_SET) seems pretty ...
0
votes
1answer
135 views

How to plot and benchmark UDP response time?

Our application uses UDP protocol in the transport layer. I'm currently filtering the packet trace with the port and then manually checking the RTT by selecting the packet stream and by using " Set ...
1
vote
0answers
272 views

Modifying linux ping icmp payload [closed]

On analyzing ping request and reply from a windows system to Linux. It was observed that the windows ping request payload was "abcdefghijklmnopqrstuvwabcdefghi" with size 32 bytes Could this ...
4
votes
3answers
586 views

What is responsible for dropping Layer 2 frames that's not addressed to it?

It's my understanding that if a network interface card (NIC) receives a Layer 1 packet, it will extract the Layer 2 frame from it, checks its destination MAC address, and if it is not addressed to it (...
3
votes
1answer
375 views

How can a UDP Client and a packet sniffer run on the same machine?

In my understanding, if you have a UDP socket client that is bound to a particular port, then a second UDP client on the same machine can't bind to the same port. If this is the case, then how can a ...
1
vote
1answer
264 views

How to filter a wireshark capture (pcapng) by source and destination IPv4 address

I have a bunch of wireshark captures I need to mine data from. Tshark seems to fit the bill but this doesn't support filtering (-f) by the look of it, I simply get: Using: tshark -x -r Run18....
2
votes
1answer
914 views

What does a “Frame” relate to in the WIreshark packet details pane?

Currently learning to use Wireshark. When I take a capture and click on one of it's rows, I see the following breakdown in the "Packet Details" pane: Frame Linux Cooked Capture Internet Protocol ...
0
votes
2answers
134 views

IP TTL value zero upon receipt [duplicate]

Is it possible that my user-space application using the UNIX sockets API would receive an UDP packet that would have the IP TTL value equal to zero, or is it the case that it always has to be one or ...
1
vote
2answers
45 views

Network Packet that allows maximum throughput

I created a basic wireless system between two microcontrollers. Each uses the on-chip UART and an HM-TRP radio module to communicate with each other. Eventually I'll have a master-slave setup where ...
2
votes
1answer
212 views

how to get RSSI information of WiFi users in wireshark?

If I'm able to get 802.11n traffic with my network adapter, would I be able to see the RSSI information? what should be the filter to see it?
5
votes
4answers
186 views

Packet Collison Avoidance

If a wireless network has collision avoidance, how comes the network slows down if more clients connect to it?
1
vote
1answer
341 views

Wireshark capture only TCP packets with the RST flag set

I'm quite new to networking and I got stuck while reading "Practical Packet Analysis: Using Wireshark to Solve...". On page 61 it is written: A common scenario is to capture only TCP packets ...
1
vote
0answers
24 views

Where can i find literature on how Firewall logs are generated? [closed]

How are firewall logs generated, I want to know how frequently (or how infrequently ) are logs generated from reading packet data if that is what it is. I want to detect anomaly on an enterprise ...
3
votes
1answer
186 views

VOIP timeout behind Cisco ASA after Duplicate ACK and Retransmissions

We have a RingCentral Polycom VVX series VOIP phone behind a Cisco ASA 5506 that will provision, work for about five minutes, go off-line for 20 minutes then reconnect and continue to work unless ...
2
votes
1answer
78 views

Extracting a bit rate

I'm trying to figure out what is the lowest layer of the OSI model that can be used to extract a bit rate (through a packet sniffer). I'm not sure if it's possible through only the physical layer, or ...
3
votes
1answer
3k views

How can I filter out particular MAC addresses when running tshark on a pcap trace?

I've tried a number of things, but none of them seem to do the trick. I want to run this command: tshark -r data.pcap -T fields -e frame.time_epoch -e frame.len but to have it ignore any packets ...
1
vote
1answer
40 views

Cable Internet Packet collecting

I've been reading Computer Networking: A top down approach and I don't understand something about cable internet. The book says that since cable internet is a shared medium, every packet sent by the ...
1
vote
3answers
82 views

how to filter only internet packets (not local) in TCP/IP?

I have a packet sniffer that mean i can read all packets sent or received to the computer(with all headers like src & dst IP:PORT). I want to filter packets that sent/received to/from internet (...
0
votes
3answers
952 views

Minimum possible size of Ethernet/IGMP frames

I am writing an application that needs to ignore frames whose size is smaller than the minimum possible size of Ethernet/IGMP frames. I have researched extensively and found the following information: ...
1
vote
2answers
108 views

Network fluctuation / delay monitoring between two nodes

Problem background: Our application communicates with multiple other nodes over SCTP. A few times in past issues were reported because of network fluctuation or too much delays that appeared for very ...
0
votes
1answer
46 views

Is the auto-correlation of a frame transient based on the physical characteristics of a device?

I am currently studying ways to fingerprint Wi-Fi devices based on their physical characteristics and I was struck by a question after reading Section B of this paper http://www.ccs-labs.org/bib/...
0
votes
2answers
85 views

Can I find port number with the TCP checksum?

So I got a frame where the port information is missing but I have everything else, how can I retrieve the port that where used in the frame ? I was thinking about the tcp checksum, but is it ...
1
vote
2answers
170 views

Wireshark capturing device ip

ok so here's the scenario: Computer A captures some packets and saves the session into file 'traffic'. Later on, Computer B opens the 'traffic' file and wants to know who captured the file...the ip ...
0
votes
1answer
6k views

Wireshark No response seen sending ping request

I'm building my own packets and sending them through a raw socket. The packet is apparently A-OK, but I'm not getting any replies. Sequence block is generated with a for loop. Identifier block is ...
1
vote
1answer
388 views

Is it possible to create an IPv4 packet header larger than 20 bytes on an IPv4 connection?

Is it possible to generate an IPv4 packet with an IPv4 packet header larger than 20 bytes on an IPv4 connections?
1
vote
2answers
322 views

Connect to local network using WAN IP address

I have a simple network in my company, where I use my ISP's ADSL Router. The LAN is 192.168.1.0/24. Router's IP is 192.168.1.1. It also has DHCP enabled, which ranges from 2 to 250. I have a Digital ...
1
vote
1answer
1k views

Extremely large sequence and acknowledge numbers when using Scapy

I am using Scapy to try and read the seq and ack numbers of tcp packets using the following sample code: packet = sniff(iface=argv[1], prn=scan, filter="", count=1)[0] print "Found SEQ " + str(packet....
1
vote
0answers
2k views

Size of packets in Wireshark [closed]

I only getting familiar with Wireshark, and there is one thing that I can't put together: estimating sizes of messages. I want to understand how much traffic my desktop application generates during it'...
1
vote
0answers
31 views

Does increasing the FEC decreases the payload in the maximum packet size?

we can find the maximum packet size by the formula packet err rate = 1 - (1 - bit err rate)^(max packet size) so does this max packet size include the FEC bits? I assume this formula gives the max ...
1
vote
1answer
303 views

capturing ipv4 packets on a http port

I tried to listen for ipv4 packets on the HTTP port 80, however I just got received HTTP string back - is this the right way to go about things? My understanding was that a TCP packet would be ...
2
votes
1answer
232 views

`tcpdump bootp.type == 2` tcpdump: syntax error

tcpdump -i eth0 'bootp.type == 2' Results in a: tcpdump: syntax error However, bootp.type == 2 works fine in Wireshark. Also tcpdump -i eth0 'tcp[13] & 16!=0' works fine, no syntax error....
1
vote
1answer
91 views

IPFIX - consider only first n seconds of a flow

Is possible to consider via IPFIX only the first n seconds of a flow (statistics)? How to set this in OpenVSwitch if possible?
3
votes
1answer
248 views

How troubleshoot poor ipsec connection?

I have a site-to-site ipsec connection which has low throughput, but the ethernet connection itself between the same endpoints is good (ie without ipsec there is high throughput). The ipsec routers ...
1
vote
1answer
97 views

Ipfix in openvSwitch

The sampling parameter in openvswitch to enable IPFIX what it refers to? For example, a value of 1 means what? Furthermore, as the difference there is per-bridge sampling and per-flow sampling?
2
votes
3answers
192 views

ipfix - variance of size packets in a flow

I have the need to calculate the variance of the size of the packets in a flow. So it is impossible using IPFIX? There are new alternatives to IPFIX that would allow me to calculate that value? Thanks
2
votes
1answer
275 views

Packet sizes with ipfix

It is possible, through IPFIX, take each size packet in a flow? It seems to exist only the sum of the sizes and the number of packets.
1
vote
2answers
2k views

Does every packet contain headers from each layer of the OSI model?

Pretty straight-forward question. Read through Section One of the 802.3 standard, and I found a nice model of a MAC frame that gives me extra insight, but I see that this question is not asked ...
1
vote
1answer
65 views

What type of packet is 0x5577

I've been trying to find out what type of packet is 0x5577, based on this page. The following is a snapshot of the source code that indicates this values: f = myproto() f.timestamp = int(time....
2
votes
2answers
657 views

Switch SPAN Port Overload

I would like to monitor all traffic that passes between devices connected to a switch (no particular switch make or model - I would need to do this for many types of switches encountered on many ...