Packet Captures
cm4116_telnet.cap 9.4 KB
Submitted Mar 1, 2011
Short Telnet session with an Opengear CM4116 used to demonstrate the urgent flag and pointer
| Packets: 113 | Duration: 14s | Downloads: 17673 |
HTTP.cap 24.9 KB
Submitted Mar 1, 2011
Simple HTTP transfer of a PNG image using wget
| Packets: 40 | Duration: n/a | Downloads: 26830 |
DHCP_MessageType 10,11,12 and 13.cap 1.9 KB
Submitted Jan 31, 2011 by Jawahar
Access Concentrator/router queries lease for particular IP addresses using message type as "DHCP LEASE QUERY" and gets response as DHCP LEASE ACTIVE,LEASE UNASSIGNED and LEASE UNKNOWN.
Access Concenttrator/Router IP=10.10.39.14
DHCP server IP=10.10.35.33
| Packets: 6 | Duration: 13s | Downloads: 13490 |
QinQ.pcap.cap 184 bytes
Submitted Jan 9, 2011 by Ysaad
ARP requests having two vlan IDs attached (QinQ)
| Packets: 2 | Duration: 2s | Downloads: 15798 |
iphttps.cap 12.4 KB
Submitted Nov 12, 2010 by nacnud
IP-HTTPS capture. This is Microsoft's IPv6 inside HTTPS tunneling for DirectAccess.
ARP DNS Ethernet ICMPv6 IGMP IP IPv6 LLC NBNS NBSS SSL TCP UDP
| Packets: 83 | Duration: 38s | Downloads: 14514 |
WCCPv2.pcap.cap 2.8 KB
Submitted Oct 5, 2010 by Ysaad
WCCP communication captures between 7200 Router and a WCCP capable optimization device (In my case it is Riverbed's Stealhead 2050)
| Packets: 15 | Duration: 27s | Downloads: 8735 |
LLDP_and_CDP.cap 4.0 KB
Submitted Oct 3, 2010
LLDP and CDP advertisements sent between two switches, S1 and S2.
| Packets: 12 | Duration: 98s | Downloads: 15916 |
TACACS+_encrypted.cap 2.8 KB
Submitted Sep 28, 2010
TACACS+ authentication and authorization requests as made by a Cisco IOS router upon a user logging in via Telnet.
| Packets: 34 | Duration: 7s | Downloads: 13550 |
PPPoE_Dual-Stack_IPv4_IPv6-with_DHCPv6.cap 6.1 KB
Submitted Sep 13, 2010 by pierky
Dual-stack PPPoE: IP (IPv4) and IPv6 with DHCPv6
Ethernet IPCP IPV6CP IPv6 LCP PAP PPP PPPOED PPPOES
| Packets: 65 | Duration: 46s | Downloads: 16887 |
ICMP_over_L2TPv3_Pseudowire.pcap.cap 5.3 KB
Submitted Sep 4, 2010 by onefst250r
ICMP pings from a CE to a second CE via a L2TPv3 pseudowire.
| Packets: 38 | Duration: 30s | Downloads: 12485 |
802.1Q_tunneling.cap 5.0 KB
Submitted Jun 30, 2010
| Packets: 26 | Duration: 35s | Downloads: 21144 |
BGP_MP_NLRI.cap 2.9 KB
Submitted Jun 28, 2010
IPv6 routes are carried as a separate address family inside MP_REACH_NLRI attributes.
| Packets: 24 | Duration: 60s | Downloads: 16615 |
TCP_SACK.cap 27.5 KB
Submitted Jun 16, 2010
A TCP SACK option is included in packets #31, #33, #35, and #37. The missing segment is retransmitted in packet #38.
| Packets: 39 | Duration: n/a | Downloads: 26834 |
DECnet_Phone.pcap.cap 7.5 KB
Submitted Jan 13, 2010 by vmlemon
A DECnet Phone session, using the Linux DECnet stack and a clone/port of the OpenVMS eponymous tool.
| Packets: 139 | Duration: 100s | Downloads: 7143 |
rpvstp-trunk-native-vid5.pcap.cap 1.8 KB
Submitted Dec 16, 2009 by einval
Rapid per-VLAN spanning tree capture of a trunk port, configured with native VLAN 5, VLAN 1 is also active over the trunk.
Capture shows that 3 BPDUs are sent out, one for classic STP (Frame 4, for example), one for the native VLAN 5 (not tagged - Frame 5) and one for each other active VLAN (tagged - Frame 3).
The PVST BPDUs contain the VLAN ID at the end of the frame (01 and 05, respectively).
DTP Ethernet LLC LOOP STP VLAN VTP
| Packets: 22 | Duration: 11s | Downloads: 13633 |
rpvstp-trunk-native-vid1.pcap.cap 6.4 KB
Submitted Dec 16, 2009 by einval
Rapid per-VLAN spanning tree capture of a trunk port, configured with native VLAN 1 (default), VLAN 5 is also active over the trunk.
Capture shows that 3 BPDUs are sent out, one for classic STP (Frame 4, for example), one for the native VLAN (not tagged - Frame 3) and one for each other active VLAN (tagged - Frame 5).
The PVST BPDUs contain the VLAN ID at the end of the frame (01 and 05, respectively).
DTP Ethernet LLC LOOP STP VLAN VTP
| Packets: 81 | Duration: 45s | Downloads: 11897 |
rpvstp-access.pcap.cap 3.7 KB
Submitted Dec 16, 2009 by einval
Rapid per-VLAN spanning tree capture of an access port (without portfast), configured in VLAN 5.
DNS Ethernet IP LLC LOOP STP UDP
| Packets: 49 | Duration: 77s | Downloads: 9165 |
Frame-Relay over MPLS.pcap.cap 1.4 KB
Submitted Dec 5, 2009 by pierky
ICMP on a Frame-relay over MPLS link. If Wireshark doesn't understand it's FR, right click on a packet, select "Decode as" from the menu and select "Frame Relay DLCI PW" on the "MPLS" tab.
| Packets: 10 | Duration: 1s | Downloads: 12232 |
EoMPLS_802.1q.pcap.cap 1.6 KB
Submitted Dec 5, 2009 by pierky
ICMP over EoMPLS with 802.1q tagging
| Packets: 10 | Duration: 1s | Downloads: 11609 |
LDP_Ethernet_FrameRelay.pcap.cap 2.1 KB
Submitted Dec 5, 2009 by pierky
LDP with pseudowire FEC elements (Ethernet and Frame-Relay DLCI-to-DLCI)
| Packets: 14 | Duration: 7s | Downloads: 9652 |
BGP_MD5.cap 1.7 KB
Submitted Nov 26, 2009
An EBGP with TCP MD5 authentication enabled
| Packets: 16 | Duration: 61s | Downloads: 10882 |
PAGP.cap 2.5 KB
Submitted Nov 15, 2009
| Packets: 25 | Duration: 95s | Downloads: 8030 |
LACP.cap 2.8 KB
Submitted Nov 15, 2009
| Packets: 20 | Duration: 112s | Downloads: 17654 |
EoMPLS.cap 7.0 KB
Submitted Oct 12, 2009 by pierky
Routers at 1.1.2.1 and 1.1.2.2 are PEs in a MPLS cloud. LDP starts at packet 8 and they build up a pseudo-wire VC (last FEC in packets 11 and 13). At packet 15 we already have STP running between CE1 and CE2 (two routers with ESW), encapsulated in 2 MPLS headers. All the ethernet stuff follows: CDP, ARP, ICMP between two hosts on the same subnet.
| Packets: 56 | Duration: 32s | Downloads: 11498 |
DHCP_Inter_VLAN.cap 2.0 KB
Submitted Sep 30, 2009 by pierky
R1 is a router-on-a-stick. It receives a DHCP Discover on the trunk interface, it sets the "Relay agent IP address" to the sub-interface's IP address it received the packet on and, finally, it forwards it to the DHCP server. Capture perspective is R1-DHCP server link.
| Packets: 4 | Duration: n/a | Downloads: 11392 |