32
votes
Accepted
Why does Ethernet use EtherType field to determine what type of packet is in a frame instead of just looking at the packet header?
The receiver has to look at the Ethernet frame to decide its contents, which might be DECnet, Appletalk or many other things -- Internet Protocol is only one of many protocols running on top of ...
- 16.2k
10
votes
How does Deep Packet Inspection work with encrypted packets?
As you point out, traditional DPI methods have limited ability to deal with encrypted traffic completely. They can still address encrypted traffic at a surface level at the very least, but it does ...
- 27.2k
9
votes
RIP Packet Format
It's a RIPv1 packet. You're looking at the full IP packet. RIP starts at 0x001c.
- 67.1k
8
votes
Accepted
Packet Collison Avoidance
A wireless network is only a single, shared medium with a limited total bandwidth. The more clients compete for bandwidth the smaller each slice gets.
Additionally, the simple presence of clients ...
- 82.7k
7
votes
Accepted
What happens in SACK when there are multiple gaps in the received packets?
The Selective ACK Option can specify more than one "block" of received traffic. Here is what the option looks like on the wire (taken from RFC 2018, Section 3):
+-------...
- 15k
7
votes
Packet Collison Avoidance
Because everyone is competing for airtime. It's the same reason traffic slows down on a highway as more cars travel on it.
BTW 802.11 uses CDMA/CA That's collision avoidance, not collision detection ...
- 67.1k
7
votes
Accepted
What is responsible for dropping Layer 2 frames that's not addressed to it?
The details of this are highly dependent on the hardware, but your description is correct: for many years now it is normally the network interface card which discards the frames which don't match the ...
- 16.2k
7
votes
Accepted
RIP Packet Format
Given how simple RIP v1 is, this is pretty easy to do by eye from Figure 1 in the RFC 1058:
5 longs from 45c0 is the IP header
4 shorts from 0208 (the italic portion) is the UDP header
The rest from ...
- 16.2k
7
votes
Accepted
Unknown EtherType
Does anyone know what this is?
As Ron Maupin already wrote, "EtherType" fields with values up to 1500 are interpreted as "length of the data", which is the number of valid data bytes following the ...
- 2,346
6
votes
Accepted
tcpdump not capturing all TCP packets when capturing whole packets
Found the solution to my own question with the help and hint from @Guy Harris.
The kernel was dropping packets due to that the buffer tcpdump uses got overfull when capturing whole TCP packets.
From ...
- 183
6
votes
Packet Collison Avoidance
If a wireless network has collision detection and avoidance, how comes the network slows down if more clients connect to it?
To begin with I wanted to note that 802.11 makes use of collision ...
- 27.2k
6
votes
Accepted
What does a "Frame" relate to in the WIreshark packet details pane?
In this context, Frame refers to the metadata that Wireshark gathers about the data it sees. It's derived from, but not a part of, any common protocol like Ethernet.
In other contexts, "Frame" is ...
- 67.1k
6
votes
Accepted
How can a UDP Client and a packet sniffer run on the same machine?
Packet sniffing applications tap into the lower layers of the network stack, not at the top like your UDP-using applications that connect to UDP at the top of the network stack.
- 98.8k
6
votes
Accepted
Weird Wireshark protocol list (eth:ethertype:ip:data where is the "udp"?)
You have fragmentation and when you don't see UDP header, it means this is not the first fragment of the IP Datagram. In your given frame, look at the 'ip.frag_offset' which is 175.
So there is at ...
- 321
6
votes
Why does Ethernet use EtherType field to determine what type of packet is in a frame instead of just looking at the packet header?
This is a fun question with a lot of history. Originally, the EtherType field indicated the length of the frame; not the type of payload. The relevant Wikipedia article contains a good explanation ...
- 5,449
5
votes
Is it possible to create an IPv4 packet header larger than 20 bytes on an IPv4 connection?
Is it possible to generate an IPv4 packet with an IPv4 packet header larger than 20 bytes on an IPv4 connections?
Yes, there are IPv4 options that may increase the packet header size. That is one of ...
- 98.8k
5
votes
Accepted
How does Deep Packet Inspection work with encrypted packets?
For the actual payload inspection you need to break the encryption. That is the only way to detect drive-by malware downloads and similar threats.
The usual way that works is the same way as a man-in-...
- 82.7k
5
votes
Accepted
Which port determines the protocol?
You seem to have it backwards. Some transport protocols, e.g. TCP and UDP, use addresses that are better knows as ports. Other transport protocols use other or no addressing. Both TCP and UDP use the ...
- 98.8k
5
votes
Unknown EtherType
For 802.3 ethernet, you have the length, not EtherType field. The Ethernet II did not have that, but used the field as an EtherType. Because the ethernet MTU is defined as 1500 (0x05DC), the EtherType ...
- 98.8k
5
votes
Unknown EtherType
Destination MAC address 01:80:c2:00:00:00 is used by spanning tree protocol and is the old 802.3 Ethernet format as Ron answered. Wireshark does a good decode. Logical link control field 0x42 comes ...
- 2,183
5
votes
Accepted
Difference between Zero Trust Architecture and VPN + MitM Access Rights Management at Gateway
The comparison as given makes the two solutions seem very similar. Most Zero Trust Network Access implementations do implement the mentioned features but tend to add additional features and components ...
- 2,070
4
votes
Maximum packet size Ethernet Frame and IP packet
Your assumption the IPv4 is always encapsulated by ethernet is flawed. Don't confuse the network layers. Ethernet, a layer-2 protocol, can carry any numbers of layer-3 protocols, not only IPv4. On the ...
- 98.8k
4
votes
Accepted
sniff traffic on a private SSID?
First, I want to clarify a few things. Then, to better answer your questions, I will provide a brief explanation of how WPA2 works. Finally, I will directly answer your questions.
TKIP and AES are ...
- 27.2k
4
votes
Accepted
How packet analyzer softwares REALLY work
Sniffing is different from analyzing - in general software like Wireshark relies on a different piece of software (or hardware) to deliver the actual packets to it, commonly in a format called "PCAP".
...
- 508
4
votes
Calculated window size in Wireshark
This post has a good explanation for what you're seeing.
What you see is normal behavior. Both sides send a small window size
and neither announce that they are able to use window scaling. So in
...
- 2,337
4
votes
Accepted
Redundant acknowledgement numbers in TCP stream
Quick answer is that after the the ack number is sent the first time, it is always sent. It always reflects the next expected sequence number, so unless new data segments arrive, it will be repeated. ...
- 406
4
votes
Accepted
Does every packet contain headers from each layer of the OSI model?
Technically a packet is a layer 3 protocol data unit (PDU). But yes, PDUs are generally referred to as packets.
As previously mentioned the OSI model is a theoretical model. Though to answer your ...
- 259
4
votes
Accepted
Connect to local network using WAN IP address
Your thinking is correct. One term you may want to search is "hairpin". Basically the idea that a packet makes a U-turn and heads right back inside where it came from. Different routers and ...
- 76
4
votes
How can I filter out particular MAC addresses when running tshark on a pcap trace?
You can use not ether host 01:23:45:67:89:ab. To filter only source or destination address use not ether src or not ether dst.
Check http://www.tcpdump.org/manpages/pcap-filter.7.html
- 82.7k
4
votes
Accepted
Do we send the same packets when we send the same data?
If I understand your question correctly, you want to know if the UDP and IP headers are identical if you send the same data over UDP twice.
I think this will depend on the operating system; I just ...
- 2,346
Only top scored, non community-wiki answers of a minimum length are eligible