The Stack Overflow podcast is back! Listen to an interview with our new CEO.

Questions tagged [packet-analysis]

(Packet-analysis) aka Network Traffic analysis is the process of capturing network traffic and inspecting it closely to determine what is happening on the network Providesthe details of network activities and their communication pattern in a network

Filter by
Sorted by
Tagged with
35
votes
3answers
49k views

Does a traceroute/tracert show every hop, or does it skip/hide some details of the path?

I am currently in college for a bachelor's degree in Network Engineering, and one of my Professors explained in class that a traceroute that shows, for example, 15 hops is actually abstracting the ...
35
votes
3answers
2k views

Why do network taps have four ports?

I've been looking at a hardware network tap like this one to replace a pseudo-permanent SPAN that's been running on a Catalyst switch. All the taps I find have four interfaces: A, B, and two output ...
14
votes
2answers
6k views

Troubleshooting low Metro Ethernet TCP throughput

The setup We have rented a few leased lines that present themselves as a layer 2 network, i.e. you have one big pipe at the datacenter and the remote sites have smaller pipes. Inside the layer 2 ...
13
votes
2answers
7k views

Broadcasting wifi packets without a network

I have a question about Wifi, I couldn't find the answer anywhere. Is it possible to send a packet over wifi without having joined any kind of network (ad-hoc or not)? I would like to be able to ...
10
votes
2answers
554 views

Why is adapter ARPing something it already knows?

I don't get why a machine on the network is asking the gateway for its MAC address when it already knows its MAC address: So here you can see the machine MAC ***80 (IP ..*.115) asks the gateway (...
10
votes
2answers
4k views

Port mirroring just the Rx (or Tx) direction of a port?

Something on my Ethernet LAN is occasionally sending out spurious duplicate packets and I need to track it down. The culprit is likely a switch or other bridge (such as a Wi-Fi AP) and not an endpoint,...
10
votes
5answers
5k views

Packet sizes in a TCP stream

I'm network traffic and wish to divide each TCP session into a series of requests and responses (the protocols I'm working with all work that way, like HTTP or SSL). I had a simple assumption (...
8
votes
1answer
490 views

Will WireShark assume packets are DUP or Retransmitted?

I have a SPAN on two different switch ports which are going to the same sniffer. Host A's connecting port is SPANed, and host B's connecting port is SPANed as well. Because it's a router on a stick ...
8
votes
1answer
564 views

packet capturing

I am having a hard time understanding certain terminology and setup when it comes to packet capturing. Example. At my company we use NetScout and the various services such as PFS(Packet forwading ...
8
votes
1answer
2k views

Wireshark Filter - OSPF Database Description Link State ID

Within Wireshark, how would one write a display filter for the IP address of the Link State ID within an OSPF Database Description packet? The Link State ID addresses are found within the LSA Header ...
7
votes
2answers
1k views

Monitoring without Port Mirroring

A quick overview of the problem We've been experiencing some issues with our bandwidth usage lately which I fear may be due to misuse (whether intentional or not) of our internet in the office. I ...
5
votes
4answers
189 views

Packet Collison Avoidance

If a wireless network has collision avoidance, how comes the network slows down if more clients connect to it?
5
votes
2answers
1k views

Building a 3 port network tap (100mbps half-duplex)

I've tried building a network tap with only three ports: the two communicating parties and a tap side. I knew this would force the communicating sides to use at most half-duplex 100mbps, but detection ...
5
votes
2answers
30k views

Troubleshooting “TCP Zero Window” Issues

I'm currently having a problem troubleshooting a trading application. Let me give a simple diagram of the current network setup (Gov't Stock Exchange Network Router)X-->(256kbs Leased Line)<--X(...
4
votes
3answers
1k views

RIP Packet Format

I am trying to investigate a RIP packet. It clearly states that the packet is RIP v1. But its format does not match with the either RIP v1 or v2. Any ideas what this packet actually is?
4
votes
3answers
597 views

What is responsible for dropping Layer 2 frames that's not addressed to it?

It's my understanding that if a network interface card (NIC) receives a Layer 1 packet, it will extract the Layer 2 frame from it, checks its destination MAC address, and if it is not addressed to it (...
4
votes
1answer
975 views

What is Packet Slicing when it comes to Ethernet Switches

I don't think it is a standardized term in the industry and hence different people have different interpretation. When folks in Ethernet Switch world refer to packet slicing, what do they really mean? ...
4
votes
2answers
374 views

sniff traffic on a private SSID?

Is it possible to sniff for all packets on an encrypted wifi SSID if you know the password? Does the SSID password provide only general isolation for all devices as a group within the SSID, or does ...
4
votes
1answer
2k views

Decoding packets in an OpenFlow ryu switch

I'm trying to examine a simple OpenFlow ryu switch, and get out of it the destination and source addresses. I'm using Mininet. For example for the next commands: h1 python -m SimpleHTTPServer 80 &...
4
votes
2answers
247 views

What is the notion of “word boundary” mentioned in RFC793 related to the packet processing?

In rfc793 : page 17 in explaining the No-Operation TCP header option, it is cited: This option code may be used between options, for example, to align the beginning of a subsequent option on a ...
4
votes
1answer
4k views

Finding the lost packet

I have two captures: a sender side capture file and a receiver side capture file. When I applied the tcp.analysis.lost_segment filter at sender side, I didn't see any frame popping up. When I applied ...
4
votes
2answers
10k views

TCP Retransmission and duplicate ACKs

I am having a problem with my core network. Currently I have a DELL PowerConnect 5524 which has a SFP+ (10Gbe) Module connected to another 5524 (Same transceiver on both) which is also stacked with a ...
3
votes
5answers
13k views

Packet sniffing promiscuously on MacBook Air [closed]

I'm on a MacBook air, and I got a book form the library about wireless network security. I've been following pretty diligently, but it seems like no matter what I do I cannot capture packets of other ...
3
votes
1answer
384 views

How can a UDP Client and a packet sniffer run on the same machine?

In my understanding, if you have a UDP socket client that is bound to a particular port, then a second UDP client on the same machine can't bind to the same port. If this is the case, then how can a ...
3
votes
1answer
471 views

What happens in SACK when there are multiple gaps in the received packets?

Suppose a client has received 0 to 500, 900 to 1100 and 1300 to 2000 how will ACK and SACK look like? Does it look like this ACK: 500 SACK:900-1100 and then it asks for the packets 1100 to 1300 in new ...
3
votes
1answer
3k views

How can I filter out particular MAC addresses when running tshark on a pcap trace?

I've tried a number of things, but none of them seem to do the trick. I want to run this command: tshark -r data.pcap -T fields -e frame.time_epoch -e frame.len but to have it ignore any packets ...
3
votes
2answers
230 views

How packet analyzer softwares REALLY work

My question is simple: How do packet analyzer softwares, like Wireshark, sniff and analyze the network traffic? Is it just by copying each frame on the link and decode the payload and other fields to ...
3
votes
1answer
896 views

What Does ICMP Code 9 Mean For a Type 8 Packet?

I am currently doing an assignment that requires us to generate ICMP packet with various types and codes. I have consulted the RFCs as well as various other place. Many of the types and codes I get ...
3
votes
2answers
405 views

Why vlan is mandatory for rspan network monitoring?

Context :- For network monitoring/packet mirrioring techniques like SPAN and RSPAN. Why is it mandatory to have a dedicated vlan for RSPAN ? why can't we mirror the packets received in a port and ...
3
votes
1answer
9k views

Wireshark Etherent II Trailer field?

What does Trailer field stand for in Ethernet II frame? Can you explain this on following cases (length of ARP packet is 28 bits)? Case #1: Ethernet II Destination: Broadcast (ff:ff:ff:ff:ff:ff) ...
3
votes
1answer
261 views

How troubleshoot poor ipsec connection?

I have a site-to-site ipsec connection which has low throughput, but the ethernet connection itself between the same endpoints is good (ie without ipsec there is high throughput). The ipsec routers ...
3
votes
3answers
3k views

DNS Resolution:<Backwards IP Address>.in-addr.arpa [closed]

Can somebody please explain whats going on here? localuser@localhost:~$ host 127.0.0.1 1.0.0.127.in-addr.arpa domain name pointer localhost. What's up with the IP address being resolved ...
3
votes
1answer
67 views

Determine the size of message given the first packet

I've been studying Software-defined networking and I have this question: Assume we have a topology of 2 hosts and 2 routers: [H1]---->(R1)----->(R2)----->[H2] A message M from H1 is ready to be ...
3
votes
2answers
2k views

VPN cisco ASA tcp connection issue -pcap inside

I have set up a VPN between my company and a customer. Packet captures show that the customer receives a packet and then sends an ACK back as it hits our internet firewall, this is as far as the ...
3
votes
1answer
197 views

VOIP timeout behind Cisco ASA after Duplicate ACK and Retransmissions

We have a RingCentral Polycom VVX series VOIP phone behind a Cisco ASA 5506 that will provision, work for about five minutes, go off-line for 20 minutes then reconnect and continue to work unless ...
2
votes
3answers
2k views

What happens to a packet sent in bus topology?

I read in Bus topology that "the network is occupied until the destination computer accepts the data". Is this statement correct? If yes, then what happens if the destination computer is not present? ...
2
votes
1answer
1k views

What does a “Frame” relate to in the WIreshark packet details pane?

Currently learning to use Wireshark. When I take a capture and click on one of it's rows, I see the following breakdown in the "Packet Details" pane: Frame Linux Cooked Capture Internet Protocol ...
2
votes
1answer
302 views

Redundant acknowledgement numbers in TCP stream

I am currently working on making test scripts for regression testing of FreeBSD's TCP/IP stack using Google's packetdrill. However, there is a slight problem which I am having involving sequence ...
2
votes
1answer
78 views

Extracting a bit rate

I'm trying to figure out what is the lowest layer of the OSI model that can be used to extract a bit rate (through a packet sniffer). I'm not sure if it's possible through only the physical layer, or ...
2
votes
4answers
204 views

ipfix - variance of size packets in a flow

I have the need to calculate the variance of the size of the packets in a flow. So it is impossible using IPFIX? There are new alternatives to IPFIX that would allow me to calculate that value? Thanks
2
votes
3answers
3k views

Maximum packet size Ethernet Frame and IP packet

I am a little bit confused about one fact. According to the specification, the ethernet frame maximum size is 1518 bytes, and the IPv4 packet size Length field in an IPv4 header can be up to 65535 ...
2
votes
2answers
3k views

TCPDUMP Output analysis

I'm running the following command on my backbone to monitor multicast traffic. I'm new to tcpdump usage and looking for some help: sudo tcpdump -i eth1 -n -p multicast I see a output like this - ...
2
votes
1answer
223 views

how to get RSSI information of WiFi users in wireshark?

If I'm able to get 802.11n traffic with my network adapter, would I be able to see the RSSI information? what should be the filter to see it?
2
votes
1answer
237 views

`tcpdump bootp.type == 2` tcpdump: syntax error

tcpdump -i eth0 'bootp.type == 2' Results in a: tcpdump: syntax error However, bootp.type == 2 works fine in Wireshark. Also tcpdump -i eth0 'tcp[13] & 16!=0' works fine, no syntax error....
2
votes
1answer
280 views

Packet sizes with ipfix

It is possible, through IPFIX, take each size packet in a flow? It seems to exist only the sum of the sizes and the number of packets.
2
votes
2answers
673 views

Switch SPAN Port Overload

I would like to monitor all traffic that passes between devices connected to a switch (no particular switch make or model - I would need to do this for many types of switches encountered on many ...
2
votes
1answer
146 views

Deep Packet Inspection

Which component (the traffic processor, the CPU or some other component) of a switch/router is responsible for packet classification/DPI? Also, where along the data path is this operation performed (...
2
votes
1answer
346 views

hashing part of a packet/frame to identify duplicate packets

Consider an application (mostly TCP/UDP, but not strictly so) where the packet sizes vary, and may be very long. The use case / problem statement is to identify duplicate frames that are collected at ...
2
votes
2answers
729 views

Is there a type of WiFi probe frame that sends a time stamp to an access point?

I want to receive (repeatedly if possible) a time stamp (preferably in nanoseconds) at my access point from clients that are not necessarily connected to my access point Does the 802.11 protocol have ...
2
votes
1answer
2k views

Extract packets with ECN notification set.

I am trying to understand DCTCP behavior. For that I am using RED queue discipline on switch port. I am generating traffic using iperf3 for 30 seconds. To capture the packets i am using tcpdump. ...