Packet Captures

HTTP.cap (24.9 KB)

Simple HTTP transfer of a PNG image using wget

• Categories: Web
• Protocols: Ethernet, HTTP, IP, TCP

QinQ.pcap.cap (184 bytes)

ARP requests having two vlan IDs attached (QinQ)

• Categories: Switching
• Protocols: ARP, Ethernet, VLAN

WCCPv2.pcap.cap (2.8 KB)

WCCP communication captures between 7200 Router and a WCCP capable optimization device (In my case it is Riverbed's Stealhead 2050)

• Categories: None
• Protocols: Ethernet, IP, UDP, WCCP

TACACS+_encrypted.cap (2.8 KB)

TACACS+ authentication and authorization requests as made by a Cisco IOS router upon a user logging in via Telnet.

• Categories: Management
• Protocols: Ethernet, IP, TACACS+, TCP

ICMP_over_L2TPv3_Pseudowire.pcap.cap (5.3 KB)

ICMP pings from a CE to a second CE via a L2TPv3 pseudowire.

• Categories: Tunneling
• Protocols: Ethernet, IP, L2TP, LOOP, OSPF

BGP_MP_NLRI.cap (2.9 KB)

IPv6 routes are carried as a separate address family inside MP_REACH_NLRI attributes.

• Categories: Routing Protocols
• Protocols: BGP, Ethernet, IP, IPv6, TCP

DECnet_Phone.pcap.cap (7.5 KB)

A DECnet Phone session, using the Linux DECnet stack and a clone/port of the OpenVMS eponymous tool.

• Categories: None
• Protocols: DEC_DNA, Ethernet

rpvstp-trunk-native-vid1.pcap.cap (6.4 KB)

• Categories: Switching
• Protocols: DTP, Ethernet, LLC, LOOP, STP, VLAN, VTP

Frame-Relay over MPLS.pcap.cap (1.4 KB)

ICMP on a Frame-relay over MPLS link. If Wireshark doesn't understand it's FR, right click on a packet, select "Decode as" from the menu and select "Frame Relay DLCI PW" on the "MPLS" tab.

• Categories: MPLS
• Protocols: Ethernet, MPLS

LDP_Ethernet_FrameRelay.pcap.cap (2.1 KB)

LDP with pseudowire FEC elements (Ethernet and Frame-Relay DLCI-to-DLCI)

• Categories: MPLS
• Protocols: Ethernet, IP, LDP, MPLS, TCP, UDP

PAGP.cap (2.5 KB)

• Categories: Switching
• Protocols: Ethernet, LLC, PAGP

EoMPLS.cap (7.0 KB)

Routers at 1.1.2.1 and 1.1.2.2 are PEs in a MPLS cloud. LDP starts at packet 8 and they build up a pseudo-wire VC (last FEC in packets 11 and 13). At packet 15 we already have STP running between CE1 and CE2 (two routers with ESW), encapsulated in 2 MPLS headers. All the ethernet stuff follows: CDP, ARP, ICMP between two hosts on the same subnet.

• Categories: MPLS
• Protocols: Ethernet, IP, LOOP, MPLS, TCP, UDP

PIM_register_register-stop.cap (258 bytes)

Switch at 192.168.0.6 receives an IGMP request for the group 239.1.2.3, encapsulates the original IGMP packet in a PIM Register and sends it to the RP at 192.168.1.254. In packet #2 RP sends a Register-Stop to the switch.

• Categories: Multicast
• Protocols: Ethernet, IP, PIM

VRRP_preempt.cap (1.2 KB)

Initially R3 is the master, R2 is backup, and R1 is offline. R1 comes back online with a priority of 200, preempting R3 to become the master router.

• Categories: Redundancy
• Protocols: Ethernet, IP, VRRP