A TCP SACK option is included in packets #31, #33, #35, and #37. The missing segment is retransmitted in packet #38.
Simple HTTP transfer of a PNG image using wget
IPv6 routes are carried as a separate address family inside MP_REACH_NLRI attributes.
Dual-stack PPPoE: IP (IPv4) and IPv6 with DHCPv6
ARP requests having two vlan IDs attached (QinQ)
IP-HTTPS capture. This is Microsoft's IPv6 inside HTTPS tunneling for DirectAccess.
- Categories: None
- Protocols: ARP, DNS, Ethernet, ICMPv6, IGMP, IP, IPv6, LLC, NBNS, NBSS, SSL, TCP, UDP
LLDP and CDP advertisements sent between two switches, S1 and S2.
R0 is the client and R1 is the DHCP server. Lease time is 1 minute.
PPP link negotiation employing EAP MD5 authentication
Rapid per-VLAN spanning tree capture of a trunk port, configured with native VLAN 5, VLAN 1 is also active over the trunk.
Capture shows that 3 BPDUs are sent out, one for classic STP (Frame 4, for example), one for the native VLAN 5 (not tagged - Frame 5) and one for each other active VLAN (tagged - Frame 3).
The PVST BPDUs contain the VLAN ID at the end of the frame (01 and 05, respectively).
Access Concentrator/router queries lease for particular IP addresses using message type as "DHCP LEASE QUERY" and gets response as DHCP LEASE ACTIVE,LEASE UNASSIGNED and LEASE UNKNOWN.
Access Concenttrator/Router IP=10.10.39.14
DHCP server IP=10.10.35.33
ICMP pings from a CE to a second CE via a L2TPv3 pseudowire.
ICMP is encapsulated into a Generic Routing Encapsulation (GRE) tunnel.
Short Telnet session with an Opengear CM4116 used to demonstrate the urgent flag and pointer
Configured ospf over GRE tunnel in which packets are double tagged with ip header, useful when there is no direct connection between the 2 routers but still we need to run ospf.
TACACS+ authentication and authorization requests as made by a Cisco IOS router upon a user logging in via Telnet.
A RADIUS authentication request is issued from a switch at 10.0.0.1 on behalf of an EAP client. The user authenticates via MD5 challenge with the username "John.McGuirk" and the password "S0cc3r".
Neighbor Discovery Protocol (NDP) uses ICMPv6 to perform duplicate address detection and address resolution. Also includes multicast listener reports.
ICMP on a Frame-relay over MPLS link. If Wireshark doesn't understand it's FR, right click on a packet, select "Decode as" from the menu and select "Frame Relay DLCI PW" on the "MPLS" tab.
An EBGP with TCP MD5 authentication enabled
ICMP over EoMPLS with 802.1q tagging
The OSPF metric is preserved and propagated within the MPLS cloud by the MP-BGP MED attribute.
IEEE 802.1D Spanning Tree Protocol (STP) advertisements sent every two seconds.
Routers at 126.96.36.199 and 188.8.131.52 are PEs in a MPLS cloud. LDP starts at packet 8 and they build up a pseudo-wire VC (last FEC in packets 11 and 13). At packet 15 we already have STP running between CE1 and CE2 (two routers with ESW), encapsulated in 2 MPLS headers. All the ethernet stuff follows: CDP, ARP, ICMP between two hosts on the same subnet.
The master router (R1) goes offline. After the down interval passes (roughly 3 seconds), R3 takes over as the master router in packet #12. R2 also offers to take over but R3 wins because it has the higher IP address.
Direct IP-in-IP tunnel encapsulation (configured in Cisco IOS with
tunnel mode ipip).