Skip to main content
Share Your Experience: Take the 2024 Developer Survey
32 votes
Accepted

Why does Ethernet use EtherType field to determine what type of packet is in a frame instead of just looking at the packet header?

The receiver has to look at the Ethernet frame to decide its contents, which might be DECnet, Appletalk or many other things -- Internet Protocol is only one of many protocols running on top of ...
jonathanjo's user avatar
  • 16.3k
10 votes

How does Deep Packet Inspection work with encrypted packets?

As you point out, traditional DPI methods have limited ability to deal with encrypted traffic completely. They can still address encrypted traffic at a surface level at the very least, but it does ...
YLearn's user avatar
  • 27.4k
9 votes

RIP Packet Format

It's a RIPv1 packet. You're looking at the full IP packet. RIP starts at 0x001c.
Ron Trunk's user avatar
  • 67.7k
8 votes
Accepted

Packet Collison Avoidance

A wireless network is only a single, shared medium with a limited total bandwidth. The more clients compete for bandwidth the smaller each slice gets. Additionally, the simple presence of clients ...
Zac67's user avatar
  • 84.9k
7 votes
Accepted

What happens in SACK when there are multiple gaps in the received packets?

The Selective ACK Option can specify more than one "block" of received traffic. Here is what the option looks like on the wire (taken from RFC 2018, Section 3): +-------...
Eddie's user avatar
  • 15k
7 votes

Packet Collison Avoidance

Because everyone is competing for airtime. It's the same reason traffic slows down on a highway as more cars travel on it. BTW 802.11 uses CDMA/CA That's collision avoidance, not collision detection ...
Ron Trunk's user avatar
  • 67.7k
7 votes
Accepted

What is responsible for dropping Layer 2 frames that's not addressed to it?

The details of this are highly dependent on the hardware, but your description is correct: for many years now it is normally the network interface card which discards the frames which don't match the ...
jonathanjo's user avatar
  • 16.3k
7 votes
Accepted

RIP Packet Format

Given how simple RIP v1 is, this is pretty easy to do by eye from Figure 1 in the RFC 1058: 5 longs from 45c0 is the IP header 4 shorts from 0208 (the italic portion) is the UDP header The rest from ...
jonathanjo's user avatar
  • 16.3k
7 votes
Accepted

Unknown EtherType

Does anyone know what this is? As Ron Maupin already wrote, "EtherType" fields with values up to 1500 are interpreted as "length of the data", which is the number of valid data bytes following the ...
Martin Rosenau's user avatar
6 votes
Accepted

tcpdump not capturing all TCP packets when capturing whole packets

Found the solution to my own question with the help and hint from @Guy Harris. The kernel was dropping packets due to that the buffer tcpdump uses got overfull when capturing whole TCP packets. From ...
Muff's user avatar
  • 183
6 votes

Packet Collison Avoidance

If a wireless network has collision detection and avoidance, how comes the network slows down if more clients connect to it? To begin with I wanted to note that 802.11 makes use of collision ...
YLearn's user avatar
  • 27.4k
6 votes
Accepted

What does a "Frame" relate to in the WIreshark packet details pane?

In this context, Frame refers to the metadata that Wireshark gathers about the data it sees. It's derived from, but not a part of, any common protocol like Ethernet. In other contexts, "Frame" is ...
Ron Trunk's user avatar
  • 67.7k
6 votes
Accepted

How can a UDP Client and a packet sniffer run on the same machine?

Packet sniffing applications tap into the lower layers of the network stack, not at the top like your UDP-using applications that connect to UDP at the top of the network stack.
Ron Maupin's user avatar
  • 99.8k
6 votes
Accepted

Weird Wireshark protocol list (eth:ethertype:ip:data where is the "udp"?)

You have fragmentation and when you don't see UDP header, it means this is not the first fragment of the IP Datagram. In your given frame, look at the 'ip.frag_offset' which is 175. So there is at ...
omuffat's user avatar
  • 321
6 votes
Accepted

How does Deep Packet Inspection work with encrypted packets?

For the actual payload inspection you need to break the encryption. That is the only way to detect drive-by malware downloads and similar threats. The usual way that works is the same way as a man-in-...
Zac67's user avatar
  • 84.9k
6 votes

Why does Ethernet use EtherType field to determine what type of packet is in a frame instead of just looking at the packet header?

This is a fun question with a lot of history. Originally, the EtherType field indicated the length of the frame; not the type of payload. The relevant Wikipedia article contains a good explanation ...
Jeff Wheeler's user avatar
  • 5,478
5 votes
Accepted

Does every packet contain headers from each layer of the OSI model?

Technically a packet is a layer 3 protocol data unit (PDU). But yes, PDUs are generally referred to as packets. As previously mentioned the OSI model is a theoretical model. Though to answer your ...
AJ Acevedo's user avatar
5 votes

Is it possible to create an IPv4 packet header larger than 20 bytes on an IPv4 connection?

Is it possible to generate an IPv4 packet with an IPv4 packet header larger than 20 bytes on an IPv4 connections? Yes, there are IPv4 options that may increase the packet header size. That is one of ...
Ron Maupin's user avatar
  • 99.8k
5 votes
Accepted

Which port determines the protocol?

You seem to have it backwards. Some transport protocols, e.g. TCP and UDP, use addresses that are better knows as ports. Other transport protocols use other or no addressing. Both TCP and UDP use the ...
Ron Maupin's user avatar
  • 99.8k
5 votes

Unknown EtherType

For 802.3 ethernet, you have the length, not EtherType field. The Ethernet II did not have that, but used the field as an EtherType. Because the ethernet MTU is defined as 1500 (0x05DC), the EtherType ...
Ron Maupin's user avatar
  • 99.8k
5 votes

Unknown EtherType

Destination MAC address 01:80:c2:00:00:00 is used by spanning tree protocol and is the old 802.3 Ethernet format as Ron answered. Wireshark does a good decode. Logical link control field 0x42 comes ...
Darrell Root's user avatar
  • 2,203
5 votes
Accepted

Difference between Zero Trust Architecture and VPN + MitM Access Rights Management at Gateway

The comparison as given makes the two solutions seem very similar. Most Zero Trust Network Access implementations do implement the mentioned features but tend to add additional features and components ...
FrameHowitzer's user avatar
4 votes

Maximum packet size Ethernet Frame and IP packet

Your assumption the IPv4 is always encapsulated by ethernet is flawed. Don't confuse the network layers. Ethernet, a layer-2 protocol, can carry any numbers of layer-3 protocols, not only IPv4. On the ...
Ron Maupin's user avatar
  • 99.8k
4 votes
Accepted

Redundant acknowledgement numbers in TCP stream

Quick answer is that after the the ack number is sent the first time, it is always sent. It always reflects the next expected sequence number, so unless new data segments arrive, it will be repeated. ...
Law29's user avatar
  • 406
4 votes
Accepted

Connect to local network using WAN IP address

Your thinking is correct. One term you may want to search is "hairpin". Basically the idea that a packet makes a U-turn and heads right back inside where it came from. Different routers and ...
Willie's user avatar
  • 76
4 votes

How can I filter out particular MAC addresses when running tshark on a pcap trace?

You can use not ether host 01:23:45:67:89:ab. To filter only source or destination address use not ether src or not ether dst. Check http://www.tcpdump.org/manpages/pcap-filter.7.html
Zac67's user avatar
  • 84.9k
4 votes
Accepted

Do we send the same packets when we send the same data?

If I understand your question correctly, you want to know if the UDP and IP headers are identical if you send the same data over UDP twice. I think this will depend on the operating system; I just ...
Martin Rosenau's user avatar
4 votes
Accepted

Which command is used in Cisco ASA Firewall to display the whole packet flow?

The packet-tracer command. For example: packet-tracer input inside tcp 192.168.1.100 1234 8.8.8.8 443 would show you each phase/stage of the flow process including which NAT (if any), which ACL (if ...
Jesse P.'s user avatar
  • 4,690
3 votes

IPFIX - consider only first n seconds of a flow

So you need to understand how a given switching device defines a flow. There's the obvious identifying stuff - the tuple of source and destination port/address, IP protocol number, etc. There's also ...
rnxrx's user avatar
  • 6,114
3 votes
Accepted

How troubleshoot poor ipsec connection?

Normally you would first check whether all packets are being encapsulated and decapsulated OK by viewing ipsec counters on the tunnel endpoints. However if you want to look at packets, first you need ...
marctxk's user avatar
  • 1,181

Only top scored, non community-wiki answers of a minimum length are eligible