55

A RST/ACK is not an acknowledgement of a RST, same as a SYN/ACK is not exactly an acknowledgment of a SYN. TCP establishment actually is a four-way process: Initiating host sends a SYN to the receiving host, which sends an ACK for that SYN. Receiving host sends a SYN to the initiating host, which sends an ACK back. This establishes stateful communication. ...


34

The client switchport or the server switchport can be monitored. A third switchport can be configured as a mirror port. This means that this mirror port will receive copies of all packets on the corresponding original port, while the original traffic won't be affected. For example, on the Catalyst 3560: Enter configuration mode: conf t Define the source ...


31

wireshark - powerfull sniffer which can decode lots of protocols, lots of filters. tshark - command line version of wireshark dumpcap (part of wireshark) - can only capture traffic and can be used by wireshark / tshark tcpdump - limited protocol decoding but available on most *NIX platforms ettercap - used for injecting traffic not sniffing All tools use ...


17

If your traffic happened to be passing through a router running Cisco IOS 12.4(20)T or greater, another possibility is to use the Embedded Packet Capture feature. This feature is NOT available on switch platforms like the 3560 or 3750. What this feature does is capture and save a small PCAP file on the router that you can download and analyze with ...


14

Your client is only sending the first three packets with a TTL of 1. The next three are sent with a TTL of 2. The next three are sent with a TTL of 3. And so on and so forth. An easier way to view this is to set the IP TTL field as its own column in Wireshark. Simply right click on the TTL value in any packet, and select "Apply as Column": From there, ...


14

Let me try to answer this, because it's a little more complicated that it may look initially. It seems that you already know the basic operation of traceroute but before anything else here is a very small recap: traceroute tries to determine all the in-between steps from your host to a destination host, or just the distance, i.e. number of hops, from your ...


14

Sorry, for the confusion, I was missing the exact TLS 1.3 semantics: For instance, in the Client Hello, the field "version" must contain the fixed value 0x0303 (TLS 1.2), while the prefered version is contained in the extension "supported versions". From RFC 8446 (TLS 1.3 spec): struct { ProtocolVersion legacy_version = 0x0303; /* TLS v1.2 */ ...


10

To understand the answer to this question, you need to understand some wireless terminology. The service set identifier or SSID is the logical (i.e. human readable) name used by a wireless network. The basic service set or BSS consists of a single access point (or virtual access point) and any stations associated to the AP (VAP). Each WLAN that an AP ...


9

Two possible choices... a packet capture tap (which is quite viable) or packet capture on the ASA. If you're not interested in buying a tap and inserting it inline, you shouldn't be afraid of capturing on your Cisco PIX. To capture traffic on the PIX, first define an ACL... assume you're trying to capture traffic from a host inside the firewall at 10.10.10....


9

Simply put, tcp.len filters the length of TCP segment data in bytes, while tcp.data (or tcp.segment_data in newer versions of Wireshark) filters for the actual data (sequence of bytes) within the TCP segment data. Example: tcp.len == 1 Filters for TCP segment data that is exactly 1 byte in length tcp.segment_data contains 49:27:6d:20:64:61:74:61 ...


9

In an attempt to refresh an expired, or expiring, ARP entry, many Client OS's will issue a "targeted" ARP query to the MAC address they already expect. Most of the time, this prompts a response from the intended target and allows the entry to be refreshed without sending a broadcast to the entire network. This will be the first time I've seen it with a ...


8

Simple... because switches don't put packets on links where they don't belong / aren't needed. You are neither the server nor the PC, so you won't see either packets. This is where port mirroring comes in -- if your switch supports it.


8

Can please someone explain me on the below screenshot why host 192.168.1.200 on packet 9 sends an ACK for the packets 6 - 7 - 8? The total packet size does not correspond to the window size agreed. If I understood it correctly the window size is the amount o data that a device can send without acknowledging. The window size is the maximum amount of ...


8

Wireshark stores the sequence number for a given TCP flow. If the new packet does not advance the sequence number, then it marks it as a retransmission. This is the actual Wireshark code in epan/dissectors/packet-tcp.c (included inline below). Please look at the tcp_analyze_sequence_number() function, more specifically the block starting at line 822. Line ...


7

Display Filter by advertising Router-ID: This display filter will get you close as I can come up with... ospf.msg.dbdesc == 1 and ospf contains <adv-router-id-as-hex> For instance, if your advertising router is 1.1.1.1... ospf.msg.dbdesc == 1 and ospf contains 01.01.01.01 However, the problem is that contains 01.01.01.01 matches any string ...


7

The best solution is to plug a computer running a packet analysis software like Wireshark to an unused port and duplicate the traffic to this port. This is called mirroring and monitoring. Here is how to do this on a Brocade MLX, XMR, CER or CES : First configure the mirroring port. This is the port you will plug you packet analyzer, ethe 3/1 here. Brocade(...


7

169.254.0.0/16 is reserved for link-local addresses as per RFC 3927. Link-local address space is used when there is no authority for IP address control (DHCP or static configuration). Some device with IP address 192.168.0.105 is trying to find out whether various link-local addresses are in use. IANA is the authority issuing IP address allocations, so the ...


7

There is nothing in the packet that will tell you what the MTU is. It's an attribute of an interface. The MTU can vary along the path from source to destination. So for example, the link from A to B might have an MTU of X, but the link from B to C, might be Y. There's no way to tell from the PCAP file. You might be able to infer the MTU value of some ...


6

Mystery solved. The Windows 7 computer was continuously receiving TCP SYN packets to the 9100 port from another computer in the same LAN, waking up as a result when "Wake on Pattern Match" was activated. This port is used by network printers. The IP of the Windows 7 computer belonged before to a long-time discarded HP printer. The computer sending the ...


6

If you have captured the packets from a single point in the network, then the answer is no. You can tell which hosts are on your network, but there is no topology information that would tell you the route from A to B. If you have some prior knowledge of the addressing scheme, you might be able to infer subnets, but even that is doubtful. Switches and ...


6

Open the capture on Wireshark, and: Rigth-click on a DTLS packet Then select "Protocol Preferences" --> "Datagram Transport Layer Preferences" There you can put your PSK in HEX format. Finally, when you select a DTLS packet, on the details section you have a second tab with the decrypted DTLS data.


6

I often do that by using either one of two following options: First option is similar to the one @Elias mentioned earlier, but this is more general, especially when the header field is not visible to select or when you just do not want to look for it in the selected packet. Go to Edit - Preferences - Appearance - Column, on the right hand side, click '+' ...


6

NOTE—The bit-reversed representation is of historical interest only and is no longer applicable to any active IEEE 802 standard. (IEEE 802-2014 8.1 Terms and notational conventions) The bit-reversed, 'non-canonical' notation is extremely rarely used, no matter if hyphens or colons are used. 112233445566, 11:22:33:44:55:66, 11-22-33-44-55-66, 112233-445566 ...


6

Packet sniffing applications tap into the lower layers of the network stack, not at the top like your UDP-using applications that connect to UDP at the top of the network stack.


6

You have fragmentation and when you don't see UDP header, it means this is not the first fragment of the IP Datagram. In your given frame, look at the 'ip.frag_offset' which is 175. So there is at least one previous fragment that you can find with the same ID field in the IP header ("ip.id").


5

I'd like to add ELAM in the mix. ELAM is supported on PFC3 (6500, 7600). You need to have 'service internal' enabled, but it's quite safe feature to run, I've ran it good deal in production networks and not yet once experienced negative impact. Essentially what ELAM does is it shows you what was send for lookup processing to PFC via DBUS (Data BUS) and ...


5

My question is, if a Probe Request is directed to a specific SSID, shouldn't the destination address be included? No, SSID probes are normally broadcast. Probe requests are either broadast or unicast check to see whether an SSID is in range. It's like the NIC is continuously asking "is anybody there?", or "is Bob there?". Since many companies deploy ...


Only top voted, non community-wiki answers of a minimum length are eligible