Unit 1: Layers and packets · Lesson 3 of 5 · 20 min
Every field of a packet
Expand one packet layer by layer, then match the decoded fields to the raw bytes.
mission
- You are
- The analyst checking a vendor's claim.
- Situation
- A vendor says their monitoring box flags packets by reading the IP and TCP headers directly. You want to know exactly which bytes those are.
- Goal
- Decode one packet completely and find the fields in the raw hex.
- Hand in
- The window size the server offered and the length of a bare TCP packet.
Expand one layer in full
-O tcp prints full detail for the TCP layer only and one summary line for the others, which keeps the output readable.
tshark -r layers.pcap -Y frame.number==2 -O tcp | sed -n '/Transmission Control/,$p' | grep -E 'Port|Sequence Number:|Acknowledgment Number:|Header Length|Flags:|Window:'
Transmission Control Protocol, Src Port: 80, Dst Port: 51514, Seq: 0, Ack: 1, Len: 0
Source Port: 80
Destination Port: 51514
[Completeness Flags: ·····S]
Sequence Number: 0 (relative sequence number)
[Next Sequence Number: 1 (relative sequence number)]
Acknowledgment Number: 1 (relative ack number)
0101 .... = Header Length: 20 bytes (5)
Flags: 0x012 (SYN, ACK)
[TCP Flags: ·······A··S·]
Window: 65160
you should see A 20 byte TCP header with the SYN and ACK flags set.
Expand the IP layer
The IP header carries more than addresses: an identification number, flags for fragmentation and the protocol number of what comes next.
tshark -r layers.pcap -Y frame.number==4 -O ip | sed -n '/Internet Protocol/,/Destination Address/p' | grep -vE 'Differentiated|Codepoint|Congestion|bit:|fragments:|checksum status'
Internet Protocol Version 4, Src: 10.10.0.23, Dst: 10.20.0.11
0100 .... = Version: 4
.... 0101 = Header Length: 20 bytes (5)
Total Length: 119
Identification: 0x1028 (4136)
000. .... = Flags: 0x0
.0.. .... = Don't fragment: Not set
...0 0000 0000 0000 = Fragment Offset: 0
Time to Live: 64
Protocol: TCP (6)
Header Checksum: 0x561a [validation disabled]
Source Address: 10.10.0.23
Destination Address: 10.20.0.11
you should see Protocol 6 means TCP follows. 17 would mean UDP.
Read the raw bytes
-x prints the packet as hex with text on the right. The first 14 bytes are Ethernet, the next 20 are IP, the next 20 are TCP, and the rest is the request.
tshark -r layers.pcap -Y frame.number==4 -x
0000 02 42 0a 14 00 0b 02 42 0a 0a 00 17 08 00 45 00 .B.....B......E.
0010 00 77 10 28 00 00 40 06 56 1a 0a 0a 00 17 0a 14 .w.(..@.V.......
0020 00 0b c9 3a 00 50 22 fe 48 76 92 4f ee cb 50 18 ...:.P".Hv.O..P.
0030 fa f0 b2 1a 00 00 47 45 54 20 2f 20 48 54 54 50 ......GET / HTTP
0040 2f 31 2e 31 0d 0a 48 6f 73 74 3a 20 77 77 77 2e /1.1..Host: www.
0050 63 6f 72 70 2e 65 78 61 6d 70 6c 65 0d 0a 55 73 corp.example..Us
0060 65 72 2d 41 67 65 6e 74 3a 20 63 75 72 6c 2f 38 er-Agent: curl/8
0070 2e 35 2e 30 0d 0a 41 63 63 65 70 74 3a 20 2a 2f .5.0..Accept: */
0080 2a 0d 0a 0d 0a *....
you should see 08 00 at bytes 12 and 13 says IPv4 follows, 45 starts the IP header, 40 is TTL 64 and 06 is TCP. 00 50 is port 80.
defender tip When a tool and a capture disagree, the raw bytes settle it. Practise finding TTL and ports in hex until it is quick.
The first two rows of packet 4
- 1
02 42 0a 14 00 0bdestination MAC - 2
02 42 0a 0a 00 17source MAC - 3
08 00EtherType: IPv4 - 4
45IPv4, 20 byte header - 5
40TTL 64 - 6
06protocol: TCP
Check how each layer names the next
Every header has a field that says what comes after it. Ethernet type 0x0800 means IPv4, and IP protocol 6 means TCP.
tshark -r layers.pcap -Y frame.number==4 -T fields -e frame.len -e eth.type -e ip.proto
133 0x0800 6
you should see 133 bytes on the wire, an IPv4 payload, carrying TCP.
What a defender takes away
- 1
-O layergives full detail for one layer without drowning you in the others. - 2Every decoded field is a few bytes at a fixed place.
-xshows you where. - 3Ethernet 14, IP 20, TCP 20: a bare TCP packet is 54 bytes on the wire.
Questions
0 of 3 solved
Answer each one from what you find on your lab machine.