Sort by new | name | popular

Packet Captures

Showing 1 - 25 of 166

3560_CDP.cap 1.2 KB

Submitted Sep 14, 2009

Cisco Discovery Protocol (CDP) advertisements from a Catalyst 3560. Note how much information is offered to a potential attacker.

CDP Ethernet LLC

Packets: 3 Duration: 120s Downloads: 7392

3725_CDP.cap 390 bytes

Submitted Sep 14, 2009

Cisco Discovery Protocol (CDP) from FastEthernet0/0 of a Cisco 3725 router.

CDP Ethernet LLC

Packets: 1 Duration: n/a Downloads: 6764

4-byte_AS_numbers_Full_Support.cap 1.2 KB

Submitted Apr 30, 2010 by pierky

Router at (hostname "D", AS 40.1 / 2621441) clears a previous established peering with (hostname "A", AS 10.1 / 655361); They both support 32-bit ASN.

While opening the new session, they negotiate the "Four-octet AS Number Capability" (pkts n. 2 and 3).

Then, both "A" and "D" send some UPDATEs containing 4-octect encoded AS_PATH attributes (pkts n. 6 and 9). Please note: WireShark may show wrong paths unless you force 4-byte encoding in the Preferences / Protocols / BGP options.


Packets: 9 Duration: 56s Downloads: 9260

4-byte_AS_numbers_Mixed_Scenario.cap 414 bytes

Submitted Apr 30, 2010 by pierky

Router "B" (AS 2) at does not support 4-byte AS numbers, while router "A" (AS 10.1 / 655361) at does.

Router "A" receives an UPDATE for the subnet from an external router ("D") in the AS 40.1 / 2621441 (not shown), and it forwards it to "B" (pkt n. 2): AS_PATH contains "23456 23456" (the first stands for AS 10.1, the second for the originating AS 40.1), but NEW_AS_PATH contains the real 4-byte AS numbers.

At pkt n. 3 "B" receives the same subnet directly from "D" and sends it to "A", including the original NEW_AS_PATH attribute previously appended by "D".


Packets: 4 Duration: 60s Downloads: 9914

6in4-linklocal-hlimit-less255.pcapng.cap 444 bytes

Submitted Dec 30, 2014 by nacnud

Illegal packet: IPv4 (protocol 41) + IPv6 (hop limit = 100) + ICMPv6 Router Advertisement. The illegal part is that hop limit of IPv6 neighbor discovery protocol (NDP) packets cannot be less than 255.


Packets: 1 Duration: n/a Downloads: 6960

802.1D_spanning_tree.cap 1.1 KB

Submitted Sep 14, 2009

IEEE 802.1D Spanning Tree Protocol (STP) advertisements sent every two seconds.

Ethernet LLC STP

Packets: 14 Duration: 26s Downloads: 14145

802.1Q_tunneling.cap 5.0 KB

Submitted Jun 30, 2010


Packets: 26 Duration: 35s Downloads: 21809

802.1w_rapid_STP.cap 2.3 KB

Submitted Sep 14, 2009

Rapid Spanning Tree Protocol BPDUs are received from a Catalyst switch after connecting to a port not configured for PortFast. The port transitions through the blocking and learning states before issuing a topology change notification (packet #30) and transitioning to the forwarding state.

Ethernet LLC STP

Packets: 30 Duration: 56s Downloads: 11950

802.1X.cap 498 bytes

Submitted Sep 14, 2009

A wired client authenticates to its switch using 802.1x/EAP and MD5 challenge authentication.

EAPoL Ethernet

Packets: 7 Duration: 19s Downloads: 14656

802_1ad.pcapng.cap 3.3 KB

Submitted Apr 30, 2015 by puschentazen

It's an Packet Capture of a QinQ Packet with an Outer Vlan Ethertype 0x88A4. It is used in Service Provider Bridges


Packets: 2 Duration: n/a Downloads: 8531

address withdrawal ldp.pcapng.cap 716 bytes

Submitted Apr 25, 2014 by altafk

Label address withdrawal message. An LSR sends the label address withdrawal message to a peer when it wants to withdraw previously advertised labels to address mappings. See RFC 3036 for more details.


Packets: 1 Duration: n/a Downloads: 6327

arp_l2tpv3.cap 414 bytes

Submitted Aug 20, 2015 by aishes

ARP request packet encapsulated in L2TPv3 over Ethernet Pseudowire.


Packets: 3 Duration: 2s Downloads: 7457

arp_pcap.pcapng.cap 2.2 KB

Submitted Mar 11, 2016 by Ashay

ARP Request reply packet captures


Packets: 16 Duration: 50s Downloads: 16266

Auto-RP.cap 726 bytes

Submitted Sep 14, 2009

Routers 2 and 3 have been configured as candidate RPs, and multicast RP announcements to Router 1 is the RP. R1 sees the candidate RP announcements from R2 and R3, and designates R3 the RP because it has a higher IP address ( R1 multicasts the RP mapping to The capture is from the R1-R2 link.

Auto-RP Ethernet IP UDP

Packets: 9 Duration: 239s Downloads: 6657

bgp as confed sequence.pcapng.cap 432 bytes

Submitted Apr 4, 2014 by altafk

AS confederation sequence set in the BGP updates. Confederations are used to minimize IBGP mesh between BGP speakers but IBGP rules apply between EBGP sub confederation peers. AS confederation sequence are an ordered list of Autonomous systems passed within confederations.


Packets: 1 Duration: n/a Downloads: 5050

bgp med.pcapng.cap 364 bytes

Submitted Apr 2, 2014 by altafk

BGP metric value set to 242( just a random value), used as a suggestion for peer in neighboring AS to influence incoming traffic.


Packets: 1 Duration: n/a Downloads: 4395

bgp orf capabilty negotitation.pcapng.cap 328 bytes

Submitted Apr 3, 2014 by altafk

BGP outbound route filtering capabilities negotiation between BGP speakers, sent during route [ Cisco PrefixList ORF-Type (128)].


Packets: 1 Duration: n/a Downloads: 4457

bgp orf prefix advertisement.pcapng.cap 336 bytes

Submitted Apr 3, 2014 by altafk

BGP prefix list sent during route refresh when outbound route filtering is configured. here we clearly see whether the prefix list is add or delete and permit or deny. Also we can see the actual network/mask sent.


Packets: 1 Duration: n/a Downloads: 5241

bgp-add-path.cap 1.1 KB

Submitted Jun 15, 2015 by xiaoquwl

BGP additional path feature.


Packets: 9 Duration: 54s Downloads: 8223

bgplu.cap 2.1 KB

Submitted Jan 24, 2016 by mxiao

BGP Labeled Unicast


Packets: 22 Duration: 4s Downloads: 9614

BGP_AS_set.cap 1.6 KB

Submitted Sep 14, 2009

Packet #15 includes a BGP update containing both an AS sequence and an AS set in its AS path attribute.

BGP Ethernet IP TCP

Packets: 18 Duration: 1s Downloads: 8388

BGP_hard_reset.cap 3.2 KB

Submitted Sep 14, 2009

A hard reset (clear ip bgp) is performed on R1 for its adjacency with R2. Packet #7 shows R1 sending a packet with the TCP FIN flag set, indicating the connection is to be torn down. The TCP connection is then reestablished and UPDATEs are retransmitted.

BGP Ethernet IP TCP

Packets: 32 Duration: 208s Downloads: 6983

BGP_MD5.cap 1.7 KB

Submitted Nov 26, 2009

An EBGP with TCP MD5 authentication enabled

BGP Ethernet IP TCP

Packets: 16 Duration: 61s Downloads: 11286

BGP_MP_NLRI.cap 2.9 KB

Submitted Jun 28, 2010

IPv6 routes are carried as a separate address family inside MP_REACH_NLRI attributes.

BGP Ethernet IP IPv6 TCP

Packets: 24 Duration: 60s Downloads: 17213

BGP_notification.cap 764 bytes

Submitted Sep 14, 2009

R1 has been misconfigured to expect R2 to reside in AS 65100. R2 attempts to peer with R1 advertising itself correctly in AS 65200. R1 issues a NOTIFICATION in packet #5 citing a "bad peer AS" error and terminates the TCP connection.

BGP Ethernet IP TCP

Packets: 9 Duration: n/a Downloads: 7370

Showing 1 - 25 of 166