Questions tagged [packet-analysis]

(Packet-analysis) aka Network Traffic analysis is the process of capturing network traffic and inspecting it closely to determine what is happening on the network Providesthe details of network activities and their communication pattern in a network

Filter by
Sorted by
Tagged with
4
votes
2answers
10k views

TCP Retransmission and duplicate ACKs

I am having a problem with my core network. Currently I have a DELL PowerConnect 5524 which has a SFP+ (10Gbe) Module connected to another 5524 (Same transceiver on both) which is also stacked with a ...
1
vote
0answers
73 views

Is this a Proper WLAN Fragmentation Diagram I made?

I took information from several images and compiled it into one and am wondering if it's correct. Looking at the smallest components of the packet -> fragments -> frame would this diagrammatically/...
4
votes
1answer
959 views

What is Packet Slicing when it comes to Ethernet Switches

I don't think it is a standardized term in the industry and hence different people have different interpretation. When folks in Ethernet Switch world refer to packet slicing, what do they really mean? ...
10
votes
2answers
4k views

Port mirroring just the Rx (or Tx) direction of a port?

Something on my Ethernet LAN is occasionally sending out spurious duplicate packets and I need to track it down. The culprit is likely a switch or other bridge (such as a Wi-Fi AP) and not an endpoint,...
1
vote
1answer
2k views

How a packet processor detects if vlan tag is present in Ethernet header or not? [duplicate]

AFAIK 802.1Q tag is optional in the FRame header. So it may or not be present in the header right? SO how does the Packet processing ASIC or processor identifies or parses to interpret the frame ...
3
votes
1answer
9k views

Wireshark Etherent II Trailer field?

What does Trailer field stand for in Ethernet II frame? Can you explain this on following cases (length of ARP packet is 28 bits)? Case #1: Ethernet II Destination: Broadcast (ff:ff:ff:ff:ff:ff) ...
4
votes
1answer
2k views

Decoding packets in an OpenFlow ryu switch

I'm trying to examine a simple OpenFlow ryu switch, and get out of it the destination and source addresses. I'm using Mininet. For example for the next commands: h1 python -m SimpleHTTPServer 80 &...
3
votes
2answers
2k views

VPN cisco ASA tcp connection issue -pcap inside

I have set up a VPN between my company and a customer. Packet captures show that the customer receives a packet and then sends an ACK back as it hits our internet firewall, this is as far as the ...
5
votes
2answers
1k views

Building a 3 port network tap (100mbps half-duplex)

I've tried building a network tap with only three ports: the two communicating parties and a tap side. I knew this would force the communicating sides to use at most half-duplex 100mbps, but detection ...
7
votes
2answers
1k views

Monitoring without Port Mirroring

A quick overview of the problem We've been experiencing some issues with our bandwidth usage lately which I fear may be due to misuse (whether intentional or not) of our internet in the office. I ...
35
votes
3answers
47k views

Does a traceroute/tracert show every hop, or does it skip/hide some details of the path?

I am currently in college for a bachelor's degree in Network Engineering, and one of my Professors explained in class that a traceroute that shows, for example, 15 hops is actually abstracting the ...
8
votes
1answer
486 views

Will WireShark assume packets are DUP or Retransmitted?

I have a SPAN on two different switch ports which are going to the same sniffer. Host A's connecting port is SPANed, and host B's connecting port is SPANed as well. Because it's a router on a stick ...
13
votes
2answers
7k views

Broadcasting wifi packets without a network

I have a question about Wifi, I couldn't find the answer anywhere. Is it possible to send a packet over wifi without having joined any kind of network (ad-hoc or not)? I would like to be able to ...
10
votes
5answers
5k views

Packet sizes in a TCP stream

I'm network traffic and wish to divide each TCP session into a series of requests and responses (the protocols I'm working with all work that way, like HTTP or SSL). I had a simple assumption (...
3
votes
5answers
13k views

Packet sniffing promiscuously on MacBook Air [closed]

I'm on a MacBook air, and I got a book form the library about wireless network security. I've been following pretty diligently, but it seems like no matter what I do I cannot capture packets of other ...
8
votes
1answer
2k views

Wireshark Filter - OSPF Database Description Link State ID

Within Wireshark, how would one write a display filter for the IP address of the Link State ID within an OSPF Database Description packet? The Link State ID addresses are found within the LSA Header ...
8
votes
1answer
551 views

packet capturing

I am having a hard time understanding certain terminology and setup when it comes to packet capturing. Example. At my company we use NetScout and the various services such as PFS(Packet forwading ...
35
votes
3answers
2k views

Why do network taps have four ports?

I've been looking at a hardware network tap like this one to replace a pseudo-permanent SPAN that's been running on a Catalyst switch. All the taps I find have four interfaces: A, B, and two output ...