Packet Captures

3560_CDP.cap (1.2 KB)

Cisco Discovery Protocol (CDP) advertisements from a Catalyst 3560. Note how much information is offered to a potential attacker.

• Categories: Cisco-proprietary
• Protocols: CDP, Ethernet, LLC

4-byte_AS_numbers_Full_Support.cap (1.2 KB)

• Categories: Routing Protocols
• Protocols: BGP, HDLC, IP, TCP

802.1D_spanning_tree.cap (1.1 KB)

IEEE 802.1D Spanning Tree Protocol (STP) advertisements sent every two seconds.

• Categories: Switching
• Protocols: Ethernet, LLC, STP

802.1w_rapid_STP.cap (2.3 KB)

Rapid Spanning Tree Protocol BPDUs are received from a Catalyst switch after connecting to a port not configured for PortFast. The port transitions through the blocking and learning states before issuing a topology change notification (packet #30) and transitioning to the forwarding state.

• Categories: Switching
• Protocols: Ethernet, LLC, STP

Auto-RP.cap (726 bytes)

Routers 2 and 3 have been configured as candidate RPs, and multicast RP announcements to 239.0.1.39. Router 1 is the RP. R1 sees the candidate RP announcements from R2 and R3, and designates R3 the RP because it has a higher IP address (3.3.3.3). R1 multicasts the RP mapping to 224.0.1.40. The capture is from the R1-R2 link.

• Categories: Multicast
• Protocols: Auto-RP, Ethernet, IP, UDP

BGP_hard_reset.cap (3.2 KB)

A hard reset (clear ip bgp) is performed on R1 for its adjacency with R2. Packet #7 shows R1 sending a packet with the TCP FIN flag set, indicating the connection is to be torn down. The TCP connection is then reestablished and UPDATEs are retransmitted.

• Categories: Routing Protocols
• Protocols: BGP, Ethernet, IP, TCP

BGP_MP_NLRI.cap (2.9 KB)

IPv6 routes are carried as a separate address family inside MP_REACH_NLRI attributes.

• Categories: Routing Protocols
• Protocols: BGP, Ethernet, IP, IPv6, TCP

BGP_redist.cap (378 bytes)

The OSPF metric is preserved and propagated within the MPLS cloud by the MP-BGP MED attribute.

• Categories: Routing Protocols
• Protocols: BGP, HDLC, IP, MPLS, TCP

cm4116_telnet.cap (9.4 KB)

Short Telnet session with an Opengear CM4116 used to demonstrate the urgent flag and pointer

• Categories: Management
• Protocols: Ethernet, IP, TCP, Telnet

DECnet_Phone.pcap.cap (7.5 KB)

A DECnet Phone session, using the Linux DECnet stack and a clone/port of the OpenVMS eponymous tool.

• Categories: None
• Protocols: DEC_DNA, Ethernet

DHCP_Inter_VLAN.cap (2.0 KB)

R1 is a router-on-a-stick. It receives a DHCP Discover on the trunk interface, it sets the "Relay agent IP address" to the sub-interface's IP address it received the packet on and, finally, it forwards it to the DHCP server. Capture perspective is R1-DHCP server link.

• Categories: None
• Protocols: BOOTP, Ethernet, IP, UDP

dtls_null.cap (2.2 KB)

• Categories: None
• Protocols: IP, UDP

EBGP_adjacency.cap (2.7 KB)

The external BGP adjacency between routers 1 and 2 is brought online and routes are exchanged. Keepalives are then exchanged every 60 seconds. Note that the IP TTL (normally 1) has been increased to 2 with ebgp-multihop to facilitate communication between the routers' loopback interfaces.

• Categories: Routing Protocols
• Protocols: BGP, Ethernet, IP, TCP

EIGRPv2_subnet_transition.cap (5.3 KB)

R4's 2001:db8:0:400::/64 subnet goes down, then comes back up roughly thirty seconds later. Capture perspective from R1's 2001:db8:0:12::1 interface.

• Categories: Cisco-proprietary, Routing Protocols
• Protocols: EIGRP, Ethernet, IPv6

EIGRP_goodbye.cap (1.3 KB)

R2 designates its interface facing R1 as passive. The final hello message from R2 (packet #9) has all its K values set to 255, designating the message as a "goodbye." Capture perspective is from R1's 10.0.0.1 interface.

• Categories: Cisco-proprietary, Routing Protocols
• Protocols: EIGRP, Ethernet, IP