Skip to main content
deleted 92 characters in body
Source Link
x89
  • 167
  • 1
  • 10

How can we manually read and interpret packets properly without using wireshark?

Let's say I have this data (IEEE 802.3 link): enter image description here

Now from the Ethernet header I know that the Destination MAC Address should be at the 5th byte (after converting bits/bytes). So from this data, I thought it would be 4a onwards. However, in reality it's 00:17:f2:d0:4c:82.

Same goes for the IP source destination. For instance, the source should be at 13-16 bytes. According to the readings, I guess it should be 0800 onwards. But in reality, it is on 0a 32 e7 85 but I don't get why? I am just confused on how to interpret this data correctly or maybe I am understanding the general header structure incorrectly.

https://ntquan87.wordpress.com/2015/08/17/reading-packet-hex-dumps-manually-no-wireshark/

How can we manually read and interpret packets properly without using wireshark?

Let's say I have this data (IEEE 802.3 link): enter image description here

Now from the Ethernet header I know that the Destination MAC Address should be at the 5th byte (after converting bits/bytes). So from this data, I thought it would be 4a onwards. However, in reality it's 00:17:f2:d0:4c:82.

Same goes for the IP source destination. For instance, the source should be at 13-16 bytes. According to the readings, I guess it should be 0800 onwards. But in reality, it is on 0a 32 e7 85 but I don't get why? I am just confused on how to interpret this data correctly or maybe I am understanding the general header structure incorrectly.

https://ntquan87.wordpress.com/2015/08/17/reading-packet-hex-dumps-manually-no-wireshark/

How can we manually read and interpret packets properly without using wireshark?

Now from the Ethernet header I know that the Destination MAC Address should be at the 5th byte (after converting bits/bytes). So from this data, I thought it would be 4a onwards. However, in reality it's 00:17:f2:d0:4c:82.

Same goes for the IP source destination. For instance, the source should be at 13-16 bytes. According to the readings, I guess it should be 0800 onwards. But in reality, it is on 0a 32 e7 85 but I don't get why? I am just confused on how to interpret this data correctly or maybe I am understanding the general header structure incorrectly.

https://ntquan87.wordpress.com/2015/08/17/reading-packet-hex-dumps-manually-no-wireshark/

deleted 364 characters in body
Source Link
x89
  • 167
  • 1
  • 10

ip/tcp packet decoding without wireshark

How can we manually read and interpret packets properly without using wireshark?

Let's say I have this data (IEEE 802.3 link): enter image description here

Now from the Ethernet header I know that the Destination MAC Address should be at the 5th byte (after converting bits/bytes). So from this data, I thought it would be 4a onwards. However, in reality it's 00:17:f2:d0:4c:82.

Same goes for the IP source destination. For instance, the source should be at 13-16 bytes. According to the readings, I guess it should be 0800 onwards. But in reality, it is on 0a 32 e7 85 but I don't get why? I am just confused on how to interpret this data correctly or maybe I am understanding the general header structure incorrectly.

https://ntquan87.wordpress.com/2015/08/17/reading-packet-hex-dumps-manually-no-wireshark/

enter image description here

Edit: permeable is missing. Ethernet frame type for IPv4 is 0x0800 and 0x86dd for IPv6. The transport IPv4 protocol field / IPv6 next header field is 0x11 for UDP and 0x06 for TCP. I have this additional info but I'm not sure if this is relevant and that how I could use it here.

ip/tcp packet decoding

How can we manually read and interpret packets properly without using wireshark?

Let's say I have this data (IEEE 802.3 link): enter image description here

Now from the Ethernet header I know that the Destination MAC Address should be at the 5th byte (after converting bits/bytes). So from this data, I thought it would be 4a onwards. However, in reality it's 00:17:f2:d0:4c:82.

Same goes for the IP source destination. For instance, the source should be at 13-16 bytes. According to the readings, I guess it should be 0800 onwards. But in reality, it is on 0a 32 e7 85 but I don't get why? I am just confused on how to interpret this data correctly or maybe I am understanding the general header structure incorrectly.

https://ntquan87.wordpress.com/2015/08/17/reading-packet-hex-dumps-manually-no-wireshark/

enter image description here

Edit: permeable is missing. Ethernet frame type for IPv4 is 0x0800 and 0x86dd for IPv6. The transport IPv4 protocol field / IPv6 next header field is 0x11 for UDP and 0x06 for TCP. I have this additional info but I'm not sure if this is relevant and that how I could use it here.

ip/tcp packet decoding without wireshark

How can we manually read and interpret packets properly without using wireshark?

Let's say I have this data (IEEE 802.3 link): enter image description here

Now from the Ethernet header I know that the Destination MAC Address should be at the 5th byte (after converting bits/bytes). So from this data, I thought it would be 4a onwards. However, in reality it's 00:17:f2:d0:4c:82.

Same goes for the IP source destination. For instance, the source should be at 13-16 bytes. According to the readings, I guess it should be 0800 onwards. But in reality, it is on 0a 32 e7 85 but I don't get why? I am just confused on how to interpret this data correctly or maybe I am understanding the general header structure incorrectly.

https://ntquan87.wordpress.com/2015/08/17/reading-packet-hex-dumps-manually-no-wireshark/

added 138 characters in body
Source Link
x89
  • 167
  • 1
  • 10

How can we manually read and interpret packets properly without using wireshark?

Let's say I have this data (IEEE 802.3 link): enter image description here

Now from the Ethernet header I know that the Destination MAC Address should be at the 5th byte (after converting bits/bytes). So from this data, I thought it would be 4a onwards. However, in reality it's 00:17:f2:d0:4c:82.

Same goes for the IP source destination. For instance, the source should be at 13-16 bytes. According to the readings, I guess it should be 0800 onwards. But in reality, it is on 0a 32 e7 85 but I don't get why? I am just confused on how to interpret this data correctly or maybe I am understanding the general header structure incorrectly.

https://ntquan87.wordpress.com/2015/08/17/reading-packet-hex-dumps-manually-no-wireshark/

enter image description here

Edit: permeable is missing. Ethernet frame type for IPv4 is 0x0800 and 0x86dd for IPv6. The transport IPv4 protocol field / IPv6 next header field is 0x11 for UDP and 0x06 for TCP. I have this additional info but I'm not sure if this is relevant and that how I could use it here.

How can we manually read and interpret packets properly without using wireshark?

Let's say I have this data: enter image description here

Now from the Ethernet header I know that the Destination MAC Address should be at the 5th byte (after converting bits/bytes). So from this data, I thought it would be 4a onwards. However, in reality it's 00:17:f2:d0:4c:82.

Same goes for the IP source destination. For instance, the source should be at 13-16 bytes. According to the readings, I guess it should be 0800 onwards. But in reality, it is on 0a 32 e7 85 but I don't get why? I am just confused on how to interpret this data correctly or maybe I am understanding the general header structure incorrectly.

https://ntquan87.wordpress.com/2015/08/17/reading-packet-hex-dumps-manually-no-wireshark/

How can we manually read and interpret packets properly without using wireshark?

Let's say I have this data (IEEE 802.3 link): enter image description here

Now from the Ethernet header I know that the Destination MAC Address should be at the 5th byte (after converting bits/bytes). So from this data, I thought it would be 4a onwards. However, in reality it's 00:17:f2:d0:4c:82.

Same goes for the IP source destination. For instance, the source should be at 13-16 bytes. According to the readings, I guess it should be 0800 onwards. But in reality, it is on 0a 32 e7 85 but I don't get why? I am just confused on how to interpret this data correctly or maybe I am understanding the general header structure incorrectly.

https://ntquan87.wordpress.com/2015/08/17/reading-packet-hex-dumps-manually-no-wireshark/

enter image description here

Edit: permeable is missing. Ethernet frame type for IPv4 is 0x0800 and 0x86dd for IPv6. The transport IPv4 protocol field / IPv6 next header field is 0x11 for UDP and 0x06 for TCP. I have this additional info but I'm not sure if this is relevant and that how I could use it here.

edited tags
Link
x89
  • 167
  • 1
  • 10
Loading
Source Link
x89
  • 167
  • 1
  • 10
Loading