Stack Exchange Network

Stack Exchange network consists of 175 Q&A communities including Stack Overflow, the largest, most trusted online community for developers to learn, share their knowledge, and build their careers.

Visit Stack Exchange

Questions tagged [packet-analysis]

(Packet-analysis) aka Network Traffic analysis is the process of capturing network traffic and inspecting it closely to determine what is happening on the network Providesthe details of network activities and their communication pattern in a network

0
votes
1answer
50 views

Weird Wireshark protocol list (eth:ethertype:ip:data where is the “udp”?)

I am capturing incoming and outgoing WAN to LAN data at a particular host on my LAN (i.e., the one actually receiving/sending the data). Sometimes I get anomalous captured frames that are missing the ...
1
vote
0answers
45 views

What is UDP traffic on port 80 and 1024? [closed]

I am currently investigating a set of anonymized passive Internet traces from a monitor in New York. There I am seeing a lot of traffic on UDP ports 80 and 1024, and I was wondering what that could be....
0
votes
1answer
33 views

Wireshark captures TCP packet with no flag [closed]

In our network, I captured a TCP packet by Wireshark that has no flag set. What's that mean? Is it normal?
1
vote
2answers
68 views

Do we send the same packets when we send the same data?

When we send the same data over a network twice, does this means that we are sending the same packets twice? I am trying to understand how my decoder works, so I command using an application on phone,...
4
votes
3answers
974 views

RIP Packet Format

I am trying to investigate a RIP packet. It clearly states that the packet is RIP v1. But its format does not match with the either RIP v1 or v2. Any ideas what this packet actually is?
0
votes
0answers
24 views

What do the multiple occurencies mean in a packet trace file?

I have a trace file and I used tshark to find out the number of duplicate ACKs, with the following command: tshark -r file.pcap -T fields -e frame.number -e tcp.analysis.duplicate_ack After some ...
1
vote
1answer
44 views

When is the HT Capability section in a probe request packet undefined?

I'm analyzing probe request packets and I'm seeing that some of them has an undefined values in HT Capabilities section. Why? Is it not required in all probe request packets?
0
votes
0answers
25 views

DUP/ACK Reconciliation

When I see a DUP ACK I understand that it is saying that the packet I received doesn't have the expected sequence number and that I send back what I expected the sequence number to be. My question is ...
0
votes
1answer
72 views

How to plot and benchmark UDP response time?

Our application uses UDP protocol in the transport layer. I'm currently filtering the packet trace with the port and then manually checking the RTT by selecting the packet stream and by using " Set ...
0
votes
1answer
40 views

How to extract transfer rates from a beacon frame (or WLAN_BSS_ENTRY)?

How can I extract the transfer rates (actually I only need the maximum value) from a WLAN_BSS_ENTRY structure (obtained by WlanGetNetworkBssList)? The value wlanRateSet (WLAN_RATE_SET) seems pretty ...
1
vote
0answers
155 views

Modifying linux ping icmp payload [closed]

On analyzing ping request and reply from a windows system to Linux. It was observed that the windows ping request payload was "abcdefghijklmnopqrstuvwabcdefghi" with size 32 bytes Could this ...
4
votes
3answers
573 views

What is responsible for dropping Layer 2 frames that's not addressed to it?

It's my understanding that if a network interface card (NIC) receives a Layer 1 packet, it will extract the Layer 2 frame from it, checks its destination MAC address, and if it is not addressed to it (...
2
votes
1answer
137 views

Deep Packet Inspection

Which component (the traffic processor, the CPU or some other component) of a switch/router is responsible for packet classification/DPI? Also, where along the data path is this operation performed (...
3
votes
1answer
321 views

How can a UDP Client and a packet sniffer run on the same machine?

In my understanding, if you have a UDP socket client that is bound to a particular port, then a second UDP client on the same machine can't bind to the same port. If this is the case, then how can a ...
13
votes
2answers
6k views

Broadcasting wifi packets without a network

I have a question about Wifi, I couldn't find the answer anywhere. Is it possible to send a packet over wifi without having joined any kind of network (ad-hoc or not)? I would like to be able to ...
1
vote
1answer
217 views

How to filter a wireshark capture (pcapng) by source and destination IPv4 address

I have a bunch of wireshark captures I need to mine data from. Tshark seems to fit the bill but this doesn't support filtering (-f) by the look of it, I simply get: Using: tshark -x -r Run18....
2
votes
1answer
540 views

What does a “Frame” relate to in the WIreshark packet details pane?

Currently learning to use Wireshark. When I take a capture and click on one of it's rows, I see the following breakdown in the "Packet Details" pane: Frame Linux Cooked Capture Internet Protocol ...
0
votes
2answers
87 views

IP TTL value zero upon receipt [duplicate]

Is it possible that my user-space application using the UNIX sockets API would receive an UDP packet that would have the IP TTL value equal to zero, or is it the case that it always has to be one or ...
1
vote
2answers
42 views

Network Packet that allows maximum throughput

I created a basic wireless system between two microcontrollers. Each uses the on-chip UART and an HM-TRP radio module to communicate with each other. Eventually I'll have a master-slave setup where ...
5
votes
4answers
185 views

Packet Collison Avoidance

If a wireless network has collision avoidance, how comes the network slows down if more clients connect to it?
2
votes
1answer
176 views

how to get RSSI information of WiFi users in wireshark?

If I'm able to get 802.11n traffic with my network adapter, would I be able to see the RSSI information? what should be the filter to see it?
0
votes
1answer
160 views

Software defined system

Over (Software defined network) what will happen when unknown Ethernet hits the first switch, using 4 OF switch and 8 host.
1
vote
1answer
290 views

Wireshark capture only TCP packets with the RST flag set

I'm quite new to networking and I got stuck while reading "Practical Packet Analysis: Using Wireshark to Solve...". On page 61 it is written: A common scenario is to capture only TCP packets ...
1
vote
0answers
24 views

Where can i find literature on how Firewall logs are generated? [closed]

How are firewall logs generated, I want to know how frequently (or how infrequently ) are logs generated from reading packet data if that is what it is. I want to detect anomaly on an enterprise ...
3
votes
1answer
165 views

VOIP timeout behind Cisco ASA after Duplicate ACK and Retransmissions

We have a RingCentral Polycom VVX series VOIP phone behind a Cisco ASA 5506 that will provision, work for about five minutes, go off-line for 20 minutes then reconnect and continue to work unless ...
2
votes
3answers
186 views

ipfix - variance of size packets in a flow

I have the need to calculate the variance of the size of the packets in a flow. So it is impossible using IPFIX? There are new alternatives to IPFIX that would allow me to calculate that value? Thanks
2
votes
1answer
78 views

Extracting a bit rate

I'm trying to figure out what is the lowest layer of the OSI model that can be used to extract a bit rate (through a packet sniffer). I'm not sure if it's possible through only the physical layer, or ...
2
votes
2answers
3k views

TCPDUMP Output analysis

I'm running the following command on my backbone to monitor multicast traffic. I'm new to tcpdump usage and looking for some help: sudo tcpdump -i eth1 -n -p multicast I see a output like this - ...
1
vote
2answers
123 views

Firewalling of individual ethernet ports in an organization

Is there any easy-to-manage way to firewall off individual Ethernet ports from each other on a wired network switch in a large organization, so that devices cannot see each other or anything else on ...
3
votes
1answer
3k views

How can I filter out particular MAC addresses when running tshark on a pcap trace?

I've tried a number of things, but none of them seem to do the trick. I want to run this command: tshark -r data.pcap -T fields -e frame.time_epoch -e frame.len but to have it ignore any packets ...
1
vote
1answer
256 views

capturing ipv4 packets on a http port

I tried to listen for ipv4 packets on the HTTP port 80, however I just got received HTTP string back - is this the right way to go about things? My understanding was that a TCP packet would be ...
14
votes
2answers
6k views

Troubleshooting low Metro Ethernet TCP throughput

The setup We have rented a few leased lines that present themselves as a layer 2 network, i.e. you have one big pipe at the datacenter and the remote sites have smaller pipes. Inside the layer 2 ...
1
vote
1answer
39 views

Cable Internet Packet collecting

I've been reading Computer Networking: A top down approach and I don't understand something about cable internet. The book says that since cable internet is a shared medium, every packet sent by the ...
1
vote
3answers
80 views

how to filter only internet packets (not local) in TCP/IP?

I have a packet sniffer that mean i can read all packets sent or received to the computer(with all headers like src & dst IP:PORT). I want to filter packets that sent/received to/from internet (...
0
votes
3answers
851 views

Minimum possible size of Ethernet/IGMP frames

I am writing an application that needs to ignore frames whose size is smaller than the minimum possible size of Ethernet/IGMP frames. I have researched extensively and found the following information: ...
3
votes
5answers
13k views

Packet sniffing promiscuously on MacBook Air [closed]

I'm on a MacBook air, and I got a book form the library about wireless network security. I've been following pretty diligently, but it seems like no matter what I do I cannot capture packets of other ...
0
votes
1answer
45 views

Is the auto-correlation of a frame transient based on the physical characteristics of a device?

I am currently studying ways to fingerprint Wi-Fi devices based on their physical characteristics and I was struck by a question after reading Section B of this paper http://www.ccs-labs.org/bib/...
1
vote
2answers
100 views

Network fluctuation / delay monitoring between two nodes

Problem background: Our application communicates with multiple other nodes over SCTP. A few times in past issues were reported because of network fluctuation or too much delays that appeared for very ...
0
votes
2answers
84 views

Can I find port number with the TCP checksum?

So I got a frame where the port information is missing but I have everything else, how can I retrieve the port that where used in the frame ? I was thinking about the tcp checksum, but is it ...
1
vote
2answers
2k views

Does every packet contain headers from each layer of the OSI model?

Pretty straight-forward question. Read through Section One of the 802.3 standard, and I found a nice model of a MAC frame that gives me extra insight, but I see that this question is not asked ...
1
vote
2answers
163 views

Wireshark capturing device ip

ok so here's the scenario: Computer A captures some packets and saves the session into file 'traffic'. Later on, Computer B opens the 'traffic' file and wants to know who captured the file...the ip ...
0
votes
1answer
6k views

Wireshark No response seen sending ping request

I'm building my own packets and sending them through a raw socket. The packet is apparently A-OK, but I'm not getting any replies. Sequence block is generated with a for loop. Identifier block is ...
1
vote
1answer
364 views

Is it possible to create an IPv4 packet header larger than 20 bytes on an IPv4 connection?

Is it possible to generate an IPv4 packet with an IPv4 packet header larger than 20 bytes on an IPv4 connections?
2
votes
2answers
606 views

Switch SPAN Port Overload

I would like to monitor all traffic that passes between devices connected to a switch (no particular switch make or model - I would need to do this for many types of switches encountered on many ...
1
vote
2answers
304 views

Connect to local network using WAN IP address

I have a simple network in my company, where I use my ISP's ADSL Router. The LAN is 192.168.1.0/24. Router's IP is 192.168.1.1. It also has DHCP enabled, which ranges from 2 to 250. I have a Digital ...
10
votes
2answers
4k views

Port mirroring just the Rx (or Tx) direction of a port?

Something on my Ethernet LAN is occasionally sending out spurious duplicate packets and I need to track it down. The culprit is likely a switch or other bridge (such as a Wi-Fi AP) and not an endpoint,...
1
vote
1answer
1k views

Extremely large sequence and acknowledge numbers when using Scapy

I am using Scapy to try and read the seq and ack numbers of tcp packets using the following sample code: packet = sniff(iface=argv[1], prn=scan, filter="", count=1)[0] print "Found SEQ " + str(packet....
1
vote
0answers
1k views

Size of packets in Wireshark [closed]

I only getting familiar with Wireshark, and there is one thing that I can't put together: estimating sizes of messages. I want to understand how much traffic my desktop application generates during it'...
1
vote
0answers
29 views

Does increasing the FEC decreases the payload in the maximum packet size?

we can find the maximum packet size by the formula packet err rate = 1 - (1 - bit err rate)^(max packet size) so does this max packet size include the FEC bits? I assume this formula gives the max ...
2
votes
1answer
217 views

`tcpdump bootp.type == 2` tcpdump: syntax error

tcpdump -i eth0 'bootp.type == 2' Results in a: tcpdump: syntax error However, bootp.type == 2 works fine in Wireshark. Also tcpdump -i eth0 'tcp[13] & 16!=0' works fine, no syntax error....