Questions tagged [packet-analysis]

(Packet-analysis) aka Network Traffic analysis is the process of capturing network traffic and inspecting it closely to determine what is happening on the network Providesthe details of network activities and their communication pattern in a network

0
votes
1answer
160 views

Software defined system

Over (Software defined network) what will happen when unknown Ethernet hits the first switch, using 4 OF switch and 8 host.
1
vote
1answer
111 views

How can OSI model allow packet sniffing pass through layer 1?

In an envrionment where there is no packet switching, say a simple hub that repeats the signal from a port to all other ports, or a splitter, how come a packet can be sniffed? I mean, if the packet's ...
0
votes
2answers
558 views

The difference between simple ACK and ACK aggregation improvement in TCP

I came across a new term in TCP ACK aggregation which is a bit new to me. I tried finding a good resource online that precisely explains this concept in a clear but unfortunately all of them are very ...
2
votes
1answer
138 views

Deep Packet Inspection

Which component (the traffic processor, the CPU or some other component) of a switch/router is responsible for packet classification/DPI? Also, where along the data path is this operation performed (...
2
votes
1answer
289 views

Redundant acknowledgement numbers in TCP stream

I am currently working on making test scripts for regression testing of FreeBSD's TCP/IP stack using Google's packetdrill. However, there is a slight problem which I am having involving sequence ...
0
votes
2answers
46 views

Can servers find out which wifi AP was used to access the network?

If you connect to a website through a wifi network where there are a number of access points with the same ESSID and a different BSSID, would the servers of that website know which AP was used? So, ...
1
vote
2answers
1k views

Probe Request Frames

OBJECTIVE The end goal here s to build a python program with Scapy that detects all access points within range of my machine. UNDERSTANDING I understand this is normally done by using 802.11 Frame ...
1
vote
3answers
3k views

Maximum packet size Ethernet Frame and IP packet

I am a little bit confused about one fact. According to the specification, the ethernet frame maximum size is 1518 bytes, and the IPv4 packet size Length field in an IPv4 header can be up to 65535 ...
0
votes
2answers
73 views

How can I identify which device is which in my network just using my computer? [closed]

No engineer here, but I know some programming. I need to find out which device is which just using my computer. I tried using wireshark but since I only use windows 7 (don't ask but I can't use linux ...
1
vote
0answers
1k views

TCP retransmissions when we rapidly open multiple connections to the same host

We are experiencing a retransmission issue on some of our computers on our LAN, when connecting to external hosts. I first started trying to trace the issue when the npm typings install command was ...
3
votes
1answer
438 views

What happens in SACK when there are multiple gaps in the received packets?

Suppose a client has received 0 to 500, 900 to 1100 and 1300 to 2000 how will ACK and SACK look like? Does it look like this ACK: 500 SACK:900-1100 and then it asks for the packets 1100 to 1300 in new ...
2
votes
1answer
2k views

Extract packets with ECN notification set.

I am trying to understand DCTCP behavior. For that I am using RED queue discipline on switch port. I am generating traffic using iperf3 for 30 seconds. To capture the packets i am using tcpdump. ...
1
vote
1answer
5k views

tcpdump not capturing all TCP packets when capturing whole packets

I have a server and a client on different machines and on different locations. I'm trying to capture TCP packets with tcpdump on an interface of the server machine. I've injected an identifier in the ...
1
vote
1answer
87 views

sniffing through my company's lan [closed]

I'm in charge of the network in my company and i have to check the visited websites.We have a edgeMAX router (firmware version 1.8) with DPI and enabling netflow exporting.DPI (as is it implemented in ...
1
vote
1answer
33 views

Is External Source IP info routinely stripped/replaced as it traverses through internal network?

So this question has more to do with what useful packet information can be picked up by an IDS sensor (for example) based on its placement on an internal network. Suppose we have a sensor placed at a ...
0
votes
1answer
64 views

History of the probe request? [closed]

I'm interested in the individual history of the probe request specifically - when and where the agreements were made for the protocol to function as it does today. Anyone have any good history ...
1
vote
1answer
292 views

Packets seem to bypass netfilter prerouting hook

In order to debug a networking problem, I introduced logging with iptables: for chain in INPUT FORWARD OUTPUT; do iptables -A $chain -j LOG --log-level info --log-prefix filter_$chain done for ...
3
votes
1answer
66 views

Determine the size of message given the first packet

I've been studying Software-defined networking and I have this question: Assume we have a topology of 2 hosts and 2 routers: [H1]---->(R1)----->(R2)----->[H2] A message M from H1 is ready to be ...
4
votes
2answers
219 views

What is the notion of “word boundary” mentioned in RFC793 related to the packet processing?

In rfc793 : page 17 in explaining the No-Operation TCP header option, it is cited: This option code may be used between options, for example, to align the beginning of a subsequent option on a ...
3
votes
2answers
226 views

How packet analyzer softwares REALLY work

My question is simple: How do packet analyzer softwares, like Wireshark, sniff and analyze the network traffic? Is it just by copying each frame on the link and decode the payload and other fields to ...
0
votes
2answers
71 views

Packets for Internet Connection [closed]

Consider the following scenario: AP is an access point with internet connectivity and in idle state (ie: no node is connected to it) N is a node that wants to establish an internet connection ...
1
vote
1answer
2k views

Calculated window size in Wireshark

I see that the calculated window size is set to 5888 with the three handshake, however it jumps to 7808 with the first ACK. Can someone explain me why and what algorithm Linux (Linux OS and Wireshark) ...
0
votes
1answer
425 views

Sequence Number in packet

I'm an university student majoring in computer science & engineering as a sophomore. I'm studying about TCP(transport layer) specifically, sequence number. What my materials of Network says ...
1
vote
2answers
2k views

Very slow TCP speed and throughtput in contast to UDP

I have been monitoring a 1 Gbps OM2 fiber connection to one switch we have with Smokeping... There seems to be an avg loss of 3-4% for a few days now.. Started troubleshooting using iperf, having set ...
1
vote
2answers
123 views

Firewalling of individual ethernet ports in an organization

Is there any easy-to-manage way to firewall off individual Ethernet ports from each other on a wired network switch in a large organization, so that devices cannot see each other or anything else on ...
4
votes
2answers
349 views

sniff traffic on a private SSID?

Is it possible to sniff for all packets on an encrypted wifi SSID if you know the password? Does the SSID password provide only general isolation for all devices as a group within the SSID, or does ...
1
vote
0answers
159 views

Why are TCP Packets going from my pc to server owned by EdgeCast Networks, Inc.? [closed]

I am seeing a lot of entries like this in my Netgear DGN 1000 log for the last few weeks: Wed, 2015-11-04 20:36:56 - TCP Packet - Source:192.168.0.2,63272 Destination:68.232.44.114,80 - [BLOCK] From ...
4
votes
1answer
3k views

Finding the lost packet

I have two captures: a sender side capture file and a receiver side capture file. When I applied the tcp.analysis.lost_segment filter at sender side, I didn't see any frame popping up. When I applied ...
1
vote
1answer
445 views

Different types of ICMP [closed]

I have a task on which I have spent a lot of time. I am not fluent in Linux, but I can manage basic things. The task is to gather different types of ICMP packets. I can harvest them by tcpdump (which ...
2
votes
1answer
471 views

How to test which process that drops packets?

I simulated a Denial-of-Service attack by connecting two virtual machines, i.e. attack and victim machine. The attack machine sends lots of traffic (http) against the victim machine running an ...
3
votes
3answers
2k views

DNS Resolution:<Backwards IP Address>.in-addr.arpa [closed]

Can somebody please explain whats going on here? localuser@localhost:~$ host 127.0.0.1 1.0.0.127.in-addr.arpa domain name pointer localhost. What's up with the IP address being resolved ...
2
votes
1answer
487 views

Structural unknown HCI Command in Bluetooth LE logs

I am inspecting the Bluetooth HCI snoop logs as part of debugging an application. For dissecting the logs/Bluetooth LE packets I'm using Wireshark. I found that there is a recurring unknown command ...
0
votes
1answer
77 views

Where is file data is kept in a packet?

I am very new to this subject. If i have a data packet that is 75 bytes long, the frame layer tells me that the size of the packet is 75 bytes, the size of the ethernet frame layer is 14 bytes, the IP ...
2
votes
2answers
3k views

TCPDUMP Output analysis

I'm running the following command on my backbone to monitor multicast traffic. I'm new to tcpdump usage and looking for some help: sudo tcpdump -i eth1 -n -p multicast I see a output like this - ...
-1
votes
1answer
946 views

Different TTL in ICMP response (Traceroute)

I am learning about traceroute and have some question want to ask about it. When I run traceroute 8.8.8.8 and dump traffics by tcpdump -i wlan0 'udp or icmp' -n -v, I confuse something. 1) Why my ...
1
vote
2answers
450 views

What to do when there is high jitter in tier one connection(s) [on hold]

I have a couple of dedicated servers in Europe. Lately I started to notice high jitter for traffic coming from USA. After couple of MTRs and trace routes, I found that the source of the jitter (and ...
2
votes
1answer
335 views

hashing part of a packet/frame to identify duplicate packets

Consider an application (mostly TCP/UDP, but not strictly so) where the packet sizes vary, and may be very long. The use case / problem statement is to identify duplicate frames that are collected at ...
0
votes
2answers
870 views

Forcing an ARP request [closed]

I'm writing a program that detects ARP poisoning. What I want to do is somehow clear my routers ARP cache, so that it can force send an ARP request, so then I can check the source address of the ...
1
vote
1answer
670 views

router advertisement packet

Networking beginner here, trying to understand the output of the tcpdump tool using a captured router advertisement packet. tcpdump -i wlp4s0 -nn -t -c1 -vvv -X -s0 Based on what I've found online, ...
-1
votes
1answer
747 views

Wireshark time to live pattern question

what pattern does ttl usually follows? working with a task where the ttl increments by 1 for every 3 packets. In the other task the ttl does not have any clear pattern. Info: I am doing traceroute ...
-2
votes
1answer
1k views

Advertised Window Size

I have one sender and one receiver node, connected through one switch. I am collecting advertised window size from both tcpdump and kernel. I am running tcp dump on the receiver side, to watch for ...
3
votes
1answer
824 views

What Does ICMP Code 9 Mean For a Type 8 Packet?

I am currently doing an assignment that requires us to generate ICMP packet with various types and codes. I have consulted the RFCs as well as various other place. Many of the types and codes I get ...
3
votes
2answers
395 views

Why vlan is mandatory for rspan network monitoring?

Context :- For network monitoring/packet mirrioring techniques like SPAN and RSPAN. Why is it mandatory to have a dedicated vlan for RSPAN ? why can't we mirror the packets received in a port and ...
-1
votes
4answers
2k views

Pcap file parsing

I have a .pcap file that I would like to look at. But when I open it in notepad++ i get strings of discernible information, but a whole lot more of black boxes with 'NUL' written in them. I know I ...
4
votes
2answers
28k views

Troubleshooting “TCP Zero Window” Issues

I'm currently having a problem troubleshooting a trading application. Let me give a simple diagram of the current network setup (Gov't Stock Exchange Network Router)X-->(256kbs Leased Line)<--X(...
10
votes
2answers
552 views

Why is adapter ARPing something it already knows?

I don't get why a machine on the network is asking the gateway for its MAC address when it already knows its MAC address: So here you can see the machine MAC ***80 (IP ..*.115) asks the gateway (...
2
votes
1answer
186 views

Troubleshooting Slowness in Stocks Trading Applications [duplicate]

Hi Fellow Network Enthusiasts! I'm having a hard time troubleshooting a Real Time Stocks Trading Application. Here are the Steps I've done so far: Apparently, this is the only Real-Time Application ...
2
votes
3answers
2k views

What happens to a packet sent in bus topology?

I read in Bus topology that "the network is occupied until the destination computer accepts the data". Is this statement correct? If yes, then what happens if the destination computer is not present? ...
2
votes
2answers
710 views

Is there a type of WiFi probe frame that sends a time stamp to an access point?

I want to receive (repeatedly if possible) a time stamp (preferably in nanoseconds) at my access point from clients that are not necessarily connected to my access point Does the 802.11 protocol have ...
14
votes
2answers
6k views

Troubleshooting low Metro Ethernet TCP throughput

The setup We have rented a few leased lines that present themselves as a layer 2 network, i.e. you have one big pipe at the datacenter and the remote sites have smaller pipes. Inside the layer 2 ...