How can we manually read and interpret packets properly without using wireshark?
Let's say I have this data (IEEE 802.3 link):
Now from the Ethernet header I know that the Destination MAC Address should be at the 5th byte (after converting bits/bytes). So from this data, I thought it would be 4a onwards. However, in reality it's 00:17:f2:d0:4c:82
.
Same goes for the IP source destination. For instance, the source should be at 13-16 bytes. According to the readings, I guess it should be 0800
onwards. But in reality, it is on 0a 32 e7 85
but I don't get why? I am just confused on how to interpret this data correctly or maybe I am understanding the general header structure incorrectly.
https://ntquan87.wordpress.com/2015/08/17/reading-packet-hex-dumps-manually-no-wireshark/