Analysing a frame capture
Decoding a frame layer by layer, reading Wireshark's three panes, telling a capture filter from a display filter, and drawing conclusions from a capture.
- 32 cards
- 5 topics
- Free
The outline, topic by topic
Each topic is weighted the way the exam weighs it.
- Concepts
- Questions
- Sort and link
- The steps
- Scenarios
A few cards from the deck
Packet capture: what is it?
Show the answer
A recording of the frames passing on an interface, kept with their arrival time so they can be read and decoded afterwards.
It shows what really travels, not what programs think they send. On a switched network you only see your own traffic, unless the switch mirrors a port.
Here is a 54-byte frame (hexadecimal). At which byte (counting from 0) does the TCP header start?
```text
52 54 00 12 35 02 08 00 27 ab cd ef 08 00 45 00
00 28 1c 46 40 00 40 06 d8 7a 0a 00 00 05 cb 00
71 0a c9 3a 01 bb 3a 7f 1c 20 00 00 00 00 50 02
fa f0 4d 4d 00 00`- 34
- 14
- 20
- 40
Show the answer
34
The EtherType 08 00 announces IPv4, which starts at byte 14 (
45). The IHL is 5, that is 20 bytes: 14 + 20 = 34, where the TCP header starts (c9 3ais the source port).To decode a frame, first read the … header (14 bytes), whose … announces the next protocol: 0x0800 for IPv4.
Show the answer
To decode a frame, first read the Ethernet header (14 bytes), whose EtherType announces the next protocol: 0x0800 for IPv4.
Each header announces the next one: EtherType for Ethernet, the protocol field (6 for TCP, 17 for UDP, 1 for ICMP) for IP, then the port to recognise the application.
Wireshark: what is it?
Show the answer
A graphical capture analyser that decodes each frame protocol by protocol and shows it in three panes: the packet list, the decoded detail, the bytes in hexadecimal.
Clicking a field in the detail pane highlights its bytes in the hex pane: the simplest way to check a decoding done by hand.
Decoding a frame by hand: which step comes after "Read the Ethernet header (14 bytes) and its EtherType"?
- Read the IP header's protocol field
- Read the ports of the transport header
- Recognise the application from the port and read its data
- Read the IP header's IHL to know its length
Show the answer
Read the IP header's IHL to know its length
Each step supplies what is needed to find the next: the EtherType says where IP starts, the IHL says where the IP header ends, the protocol says which transport header follows, and the port designates the application.