Packet Captures
IPv6_RTSP.cap (15.5 KB)
| Packets: 17 | Duration: 3s | Downloads: 285 |
This capture contains IPv6_RTSP packets. Accessed IPv6 enabled RTSP server using 6in4 tunnel.
OCSP-Not_Implemted.cap (1.1 KB)
| Packets: 10 | Duration: n/a | Downloads: 2006 |
OCSP-Not_Implemted
- Categories: Encryption
- Protocols: HTTP, IP, OCSP, TCP
OCSP-Revoked.cap (1.8 KB)
| Packets: 10 | Duration: n/a | Downloads: 1124 |
OCSP (Comodo - FAKE crt Addons-mozilla-org)
- Categories: Encryption
- Protocols: HTTP, IP, OCSP, TCP
traceroute_MPLS.cap (3.3 KB)
| Packets: 29 | Duration: 3s | Downloads: 2901 |
cm4116_telnet.cap (9.4 KB)
| Packets: 113 | Duration: 14s | Downloads: 2706 |
Short Telnet session with an Opengear CM4116 used to demonstrate the urgent flag and pointer
- Categories: Management
- Protocols: Ethernet, IP, TCP, Telnet
HTTP.cap (24.9 KB)
| Packets: 40 | Duration: n/a | Downloads: 4154 |
Simple HTTP transfer of a PNG image using wget
DHCP_MessageType 10,11,12 and 13.cap (1.9 KB)
| Packets: 6 | Duration: 13s | Downloads: 2813 |
Access Concentrator/router queries lease for particular IP addresses using message type as "DHCP LEASE QUERY" and gets response as DHCP LEASE ACTIVE,LEASE UNASSIGNED and LEASE UNKNOWN.
Access Concenttrator/Router IP=10.10.39.14
DHCP server IP=10.10.35.33
QinQ.pcap.cap (184 bytes)
| Packets: 2 | Duration: 2s | Downloads: 3411 |
ARP requests having two vlan IDs attached (QinQ)
iphttps.cap (12.4 KB)
| Packets: 83 | Duration: 38s | Downloads: 3426 |
IP-HTTPS capture. This is Microsoft's IPv6 inside HTTPS tunneling for DirectAccess.
WCCPv2.pcap.cap (2.8 KB)
| Packets: 15 | Duration: 27s | Downloads: 2446 |
WCCP communication captures between 7200 Router and a WCCP capable optimization device (In my case it is Riverbed's Stealhead 2050)
LLDP_and_CDP.cap (4.0 KB)
| Packets: 12 | Duration: 98s | Downloads: 3201 |
LLDP and CDP advertisements sent between two switches, S1 and S2.
TACACS+_encrypted.cap (2.8 KB)
| Packets: 34 | Duration: 7s | Downloads: 2892 |
TACACS+ authentication and authorization requests as made by a Cisco IOS router upon a user logging in via Telnet.
- Categories: Management
- Protocols: Ethernet, IP, TACACS+, TCP
PPPoE_Dual-Stack_IPv4_IPv6-with_DHCPv6.cap (6.1 KB)
| Packets: 65 | Duration: 46s | Downloads: 3422 |
Dual-stack PPPoE: IP (IPv4) and IPv6 with DHCPv6
ICMP_over_L2TPv3_Pseudowire.pcap.cap (5.3 KB)
| Packets: 38 | Duration: 30s | Downloads: 3128 |
ICMP pings from a CE to a second CE via a L2TPv3 pseudowire.
802.1Q_tunneling.cap (5.0 KB)
| Packets: 26 | Duration: 35s | Downloads: 5839 |
BGP_MP_NLRI.cap (2.9 KB)
| Packets: 24 | Duration: 60s | Downloads: 4286 |
IPv6 routes are carried as a separate address family inside MP_REACH_NLRI attributes.
TCP_SACK.cap (27.5 KB)
| Packets: 39 | Duration: n/a | Downloads: 11405 |
A TCP SACK option is included in packets #31, #33, #35, and #37. The missing segment is retransmitted in packet #38.
PPP_EAP.cap (2.5 KB)
| Packets: 52 | Duration: 52s | Downloads: 3232 |
PPP link negotiation employing EAP MD5 authentication
4-byte_AS_numbers_Mixed_Scenario.cap (414 bytes)
| Packets: 4 | Duration: 60s | Downloads: 3452 |
Router "B" (AS 2) at 172.16.3.2 does not support 4-byte AS numbers, while router "A" (AS 10.1 / 655361) at 172.16.3.1 does.
Router "A" receives an UPDATE for the 40.0.0.0/8 subnet from an external router ("D") in the AS 40.1 / 2621441 (not shown), and it forwards it to "B" (pkt n. 2): AS_PATH contains "23456 23456" (the first stands for AS 10.1, the second for the originating AS 40.1), but NEW_AS_PATH contains the real 4-byte AS numbers.
At pkt n. 3 "B" receives the same subnet directly from "D" and sends it to "A", including the original NEW_AS_PATH attribute previously appended by "D".
- Categories: Routing Protocols
- Protocols: BGP, HDLC, IP, TCP
4-byte_AS_numbers_Full_Support.cap (1.2 KB)
| Packets: 9 | Duration: 56s | Downloads: 3214 |
Router at 172.16.1.2 (hostname "D", AS 40.1 / 2621441) clears a previous established peering with 172.16.1.1 (hostname "A", AS 10.1 / 655361); They both support 32-bit ASN.
While opening the new session, they negotiate the "Four-octet AS Number Capability" (pkts n. 2 and 3).
Then, both "A" and "D" send some UPDATEs containing 4-octect encoded AS_PATH attributes (pkts n. 6 and 9). Please note: WireShark may show wrong paths unless you force 4-byte encoding in the Preferences / Protocols / BGP options.
- Categories: Routing Protocols
- Protocols: BGP, HDLC, IP, TCP
DECnet_Phone.pcap.cap (7.5 KB)
| Packets: 139 | Duration: 100s | Downloads: 3197 |
A DECnet Phone session, using the Linux DECnet stack and a clone/port of the OpenVMS eponymous tool.
rpvstp-trunk-native-vid5.pcap.cap (1.8 KB)
| Packets: 22 | Duration: 11s | Downloads: 4157 |
Rapid per-VLAN spanning tree capture of a trunk port, configured with native VLAN 5, VLAN 1 is also active over the trunk.
Capture shows that 3 BPDUs are sent out, one for classic STP (Frame 4, for example), one for the native VLAN 5 (not tagged - Frame 5) and one for each other active VLAN (tagged - Frame 3).
The PVST BPDUs contain the VLAN ID at the end of the frame (01 and 05, respectively).
rpvstp-trunk-native-vid1.pcap.cap (6.4 KB)
| Packets: 81 | Duration: 45s | Downloads: 3364 |
Rapid per-VLAN spanning tree capture of a trunk port, configured with native VLAN 1 (default), VLAN 5 is also active over the trunk.
Capture shows that 3 BPDUs are sent out, one for classic STP (Frame 4, for example), one for the native VLAN (not tagged - Frame 3) and one for each other active VLAN (tagged - Frame 5).
The PVST BPDUs contain the VLAN ID at the end of the frame (01 and 05, respectively).
rpvstp-access.pcap.cap (3.7 KB)
| Packets: 49 | Duration: 77s | Downloads: 3130 |
Rapid per-VLAN spanning tree capture of an access port (without portfast), configured in VLAN 5.
Frame-Relay over MPLS.pcap.cap (1.4 KB)
| Packets: 10 | Duration: 1s | Downloads: 3973 |
ICMP on a Frame-relay over MPLS link. If Wireshark doesn't understand it's FR, right click on a packet, select "Decode as" from the menu and select "Frame Relay DLCI PW" on the "MPLS" tab.
EoMPLS_802.1q.pcap.cap (1.6 KB)
| Packets: 10 | Duration: 1s | Downloads: 3984 |
ICMP over EoMPLS with 802.1q tagging
LDP_Ethernet_FrameRelay.pcap.cap (2.1 KB)
| Packets: 14 | Duration: 7s | Downloads: 3492 |
LDP with pseudowire FEC elements (Ethernet and Frame-Relay DLCI-to-DLCI)
BGP_MD5.cap (1.7 KB)
| Packets: 16 | Duration: 61s | Downloads: 4148 |
An EBGP with TCP MD5 authentication enabled
- Categories: Authentication, Routing Protocols
- Protocols: BGP, Ethernet, IP, TCP