Unit 1: Layers and packets · Lesson 2 of 5 · 18 min
Reading header fields
Measure each header and print exactly the fields you need, with tshark and tcpdump.
mission
- You are
- The network analyst, building a reusable toolkit.
- Situation
- Your team lead wants one-line commands that answer common questions about any packet: which machine sent it, how far it travelled, which program it was for.
- Goal
- Pull single fields out of packets instead of reading whole dumps.
- Hand in
- The source MAC and TTL of the first packet in layers.pcap.
Wrap a request the way the laptop did
Each step wraps the data in one more header, the way a sender builds a packet.
Measure each layer
The frame is the whole thing on the wire, the IP length covers IP and everything inside it, and the TCP length is the payload alone.
tshark -r layers.pcap -Y frame.number==4 -T fields -e frame.len -e ip.len -e tcp.len
133 119 79
you should see 133 minus 119 leaves 14 bytes of Ethernet. 119 minus 79 leaves 40 bytes of IP and TCP headers.
Print only the fields you need
-Y picks packets with a display filter, and each -e names one field. The output is tab-separated, ready for sort, cut and awk.
tshark -r layers.pcap -Y frame.number==2 -T fields -e eth.src -e eth.dst -e ip.src -e ip.dst -e ip.ttl -e tcp.srcport -e tcp.dstport
02:42:0a:14:00:0b 02:42:0a:0a:00:17 10.20.0.11 10.10.0.23 63 80 51514
you should see The server's reply arrives with TTL 63: one router between the server room and the office.
defender tip Each router lowers the TTL by one. A sudden change in TTL from a known host can mean traffic is taking a new path, or is not coming from the host it claims to be.
See the same packets in tcpdump
tcpdump is on almost every Linux server, so you will meet it during incidents. It shows real sequence numbers and writes flags as letters: S for SYN, . for ACK.
tcpdump -nn -r layers.pcap -c 2
reading from file layers.pcap, link-type EN10MB (Ethernet), snapshot length 65535
09:00:00.000000 IP 10.10.0.23.51514 > 10.20.0.11.80: Flags [S], seq 587090037, win 64240, length 0
09:00:00.000400 IP 10.20.0.11.80 > 10.10.0.23.51514: Flags [S.], seq 2454712010, ack 587090038, win 65160, length 0
you should see -nn keeps numbers as numbers, so nothing tries to look up names.
Fields worth remembering
| Command | What it does |
|---|---|
eth.src, eth.dst | MAC addresses on the local wire |
ip.src, ip.dst, ip.ttl | End-to-end addresses and the hop counter |
tcp.srcport, tcp.dstport | Which programs are talking |
frame.len, ip.len, tcp.len | Sizes of each layer |
frame.protocols | Every layer tshark recognised |
Read the TTL from each side
The TTL starts at a value set by the operating system and drops by one at every router. The difference tells you how far away a host is.
tshark -r layers.pcap -T fields -e ip.src -e ip.ttl | sort -u
10.10.0.23 64
10.20.0.11 63
you should see The laptop sends with TTL 64. The server's packets arrive with 63, one router away.
defender tip A sudden change in TTL from a host you know well can mean someone else is answering for it.
What a defender takes away
- 1
-T fields -e nameturns packets into a table you can pipe. - 2TTL tells you roughly how many routers a packet crossed.
- 3tshark and tcpdump read the same files. Learn both.
Questions
0 of 2 solved
Answer each one from what you find on your lab machine.