Unit 1: Layers and packets · Lesson 1 of 5 · 18 min
The layers of a packet
See how each layer wraps the one above it, then list a capture packet by packet.
mission
- You are
- The new network analyst at corp.example.
- Situation
- A colleague recorded one visit to the company website from laptop-jlee and left it in
~/captures/layers.pcap. Nobody on the team has read it yet. - Goal
- Describe every packet in the recording and which layers each one carries.
- Hand in
- The packet count and the port the laptop connected to.
One packet, four crates
Count what was recorded
Before reading anything, know how big the job is. capinfos reads the file header and counts packets without decoding them.
capinfos -c layers.pcap
File name: layers.pcap
Number of packets: 10
you should see Ten packets: small enough to read one by one.
defender tip On a real incident, run capinfos first on every file you are handed. A 40 GB capture needs a different plan from a 10 packet one.
List the packets
tshark -r prints one summary line per packet, the same columns Wireshark shows in its packet list.
tshark -r layers.pcap | head -n 4
1 0.000000 10.10.0.23 → 10.20.0.11 TCP 54 51514 → 80 [SYN] Seq=0 Win=64240 Len=0
2 0.000400 10.20.0.11 → 10.10.0.23 TCP 54 80 → 51514 [SYN, ACK] Seq=0 Ack=1 Win=65160 Len=0
3 0.000800 10.10.0.23 → 10.20.0.11 TCP 54 51514 → 80 [ACK] Seq=1 Ack=1 Win=64240 Len=0
4 0.002800 10.10.0.23 → 10.20.0.11 HTTP 133 GET / HTTP/1.1
you should see Three TCP packets that open a connection, then an HTTP request.
One line of tshark output
- 1
4packet number - 2
0.002800seconds since the first packet - 3
10.10.0.23 → 10.20.0.11source and destination IP - 4
HTTPhighest layer tshark understood - 5
133bytes on the wire - 6
GET / HTTP/1.1summary of that layer
Name the layers in one packet
frame.protocols lists every layer tshark found, outermost first. Read it as the order the receiver peels them.
tshark -r layers.pcap -Y frame.number==4 -T fields -e frame.protocols
eth:ethertype:ip:tcp:http
you should see Ethernet, then IP, then TCP, then HTTP.
Filter the whole capture
4 0.002800 10.10.0.23 → 10.20.0.11 HTTP 133 GET / HTTP/1.1 6 0.006200 10.20.0.11 → 10.10.0.23 HTTP 161 HTTP/1.1 200 OK (text/html)
2 of 10 lines. grep -c would print 2.
Find the packets that carry data
Most packets in a short exchange are pure control: handshake, acknowledgements and teardown. Only a few carry application data.
tshark -r layers.pcap -Y 'tcp.len>0' -T fields -e frame.number -e ip.src -e tcp.len
4 10.10.0.23 79
6 10.20.0.11 107
you should see Two of ten packets carry data: the request and the response.
What a defender takes away
- 1A capture is a recording. You can question it as many times as you like without touching the network.
- 2Every packet is a stack: link, internet, transport, application.
- 3Start with the size of the job (capinfos), then the summary (tshark -r), then single packets.
Questions
0 of 2 solved
Answer each one from what you find on your lab machine.