Sort by new | name | popular

Packet Captures

MSTP_Intra-Region_BPDUs.cap 1.7 KB

Submitted May 1, 2012 by lobo

MSTP BPDUs captured on an intra-region root port.

00:1f:27:b4:7d:80 - CIST Root (is in another MSTP Region)
00:16:46:b5:8c:80 - CIST Regional Root, Root for Instance 0, 2
00:1e:f7:05:a8:80 - Root for Instance 1

Notice in frame 1 that 00:1e:f7:05:a8:80 uses 32768.00:16:46:b5:8c:80 (Regional Root BID) as bridge ID in the main STP header to make the region appear as a single bridge.

LLC STP VLAN

Packets: 10 Duration: 10s Downloads: 8464

packet-c.cap 675.0 KB

Submitted Jan 31, 2012 by Slaingod

This is a packet capture from a SonicWall. We were troubleshooting DHCP packet flows. The SonicWall saw the DHCP Discover and Sent an Offer. We never saw the DHCP acknowledgement. In the adjacent core stacked switching we were running "debug ip dhcp server packets" we only saw discover packets from IP phones up to the SonicWall. For some reason the SonicWall could not let any other DHCP packets through or out of it INSIDE (LAN) interface. Even if we put an ANY-ANY ALC for that interface. We ended up having to replace the SonicWall and upload the configuration from the old SonicWall to the new one.

-Slaingod

BOOTP DNS HTTP IP LLC SKINNY SSL STP TCP UDP

Packets: 926 Duration: 13s Downloads: 9816

iphttps.cap 12.4 KB

Submitted Nov 12, 2010 by nacnud

IP-HTTPS capture. This is Microsoft's IPv6 inside HTTPS tunneling for DirectAccess.

ARP DNS Ethernet ICMPv6 IGMP IP IPv6 LLC NBNS NBSS SSL TCP UDP

Packets: 83 Duration: 38s Downloads: 10090

LLDP_and_CDP.cap 4.0 KB

Submitted Oct 3, 2010

LLDP and CDP advertisements sent between two switches, S1 and S2.

CDP Ethernet LLC LLDP

Packets: 12 Duration: 98s Downloads: 9957

802.1Q_tunneling.cap 5.0 KB

Submitted Jun 30, 2010

CDP Ethernet IP LLC VLAN

Packets: 26 Duration: 35s Downloads: 14856

rpvstp-trunk-native-vid5.pcap.cap 1.8 KB

Submitted Dec 16, 2009 by einval

Rapid per-VLAN spanning tree capture of a trunk port, configured with native VLAN 5, VLAN 1 is also active over the trunk.

Capture shows that 3 BPDUs are sent out, one for classic STP (Frame 4, for example), one for the native VLAN 5 (not tagged - Frame 5) and one for each other active VLAN (tagged - Frame 3).

The PVST BPDUs contain the VLAN ID at the end of the frame (01 and 05, respectively).

DTP Ethernet LLC LOOP STP VLAN VTP

Packets: 22 Duration: 11s Downloads: 9223

rpvstp-trunk-native-vid1.pcap.cap 6.4 KB

Submitted Dec 16, 2009 by einval

Rapid per-VLAN spanning tree capture of a trunk port, configured with native VLAN 1 (default), VLAN 5 is also active over the trunk.

Capture shows that 3 BPDUs are sent out, one for classic STP (Frame 4, for example), one for the native VLAN (not tagged - Frame 3) and one for each other active VLAN (tagged - Frame 5).

The PVST BPDUs contain the VLAN ID at the end of the frame (01 and 05, respectively).

DTP Ethernet LLC LOOP STP VLAN VTP

Packets: 81 Duration: 45s Downloads: 8427

rpvstp-access.pcap.cap 3.7 KB

Submitted Dec 16, 2009 by einval

Rapid per-VLAN spanning tree capture of an access port (without portfast), configured in VLAN 5.

DNS Ethernet IP LLC LOOP STP UDP

Packets: 49 Duration: 77s Downloads: 6354

PAGP.cap 2.5 KB

Submitted Nov 15, 2009

Ethernet LLC PAGP

Packets: 25 Duration: 95s Downloads: 5744

UDLD.cap 3.3 KB

Submitted Sep 14, 2009

Unidirectional Link Detection (UDLD) is used to monitor the status of a link between a Catalyst 2960 and a Catalyst 3560. Note that echos are initially sent at very small intervals, gradually throttling back to the configured interval of 15 seconds.

Ethernet LLC UDLD

Packets: 29 Duration: 93s Downloads: 6500

ISIS_level2_adjacency.cap 51.8 KB

Submitted Sep 14, 2009

Routers 3 and 4 form an IS-IS level 2 adjacency.

Ethernet ISIS LLC

Packets: 43 Duration: 85s Downloads: 5387

ISIS_level1_adjacency.cap 27.4 KB

Submitted Sep 14, 2009

Routers 2 and 3 form an IS-IS level 2 adjacency.

Ethernet ISIS LLC

Packets: 22 Duration: 58s Downloads: 4905

ISIS_external_lsp.cap 17.0 KB

Submitted Sep 14, 2009

R2 floods the external routes redistributed from RIP into area 10. Packet #9 includes the IP external reachability TLV. Capture perspective from R3's 10.0.10.1 interface.

Ethernet ISIS LLC

Packets: 15 Duration: 23s Downloads: 4322

DTP.cap 934 bytes

Submitted Sep 14, 2009

Dynamic Trunking Protocol (DTP) emanated from a Catalyst 3560 every 60 seconds, both with and without ISL encapsulation.

DTP Ethernet ISL LLC

Packets: 10 Duration: 120s Downloads: 5459

802.1w_rapid_STP.cap 2.3 KB

Submitted Sep 14, 2009

Rapid Spanning Tree Protocol BPDUs are received from a Catalyst switch after connecting to a port not configured for PortFast. The port transitions through the blocking and learning states before issuing a topology change notification (packet #30) and transitioning to the forwarding state.

Ethernet LLC STP

Packets: 30 Duration: 56s Downloads: 7313

802.1D_spanning_tree.cap 1.1 KB

Submitted Sep 14, 2009

IEEE 802.1D Spanning Tree Protocol (STP) advertisements sent every two seconds.

Ethernet LLC STP

Packets: 14 Duration: 26s Downloads: 8906

3725_CDP.cap 390 bytes

Submitted Sep 14, 2009

Cisco Discovery Protocol (CDP) from FastEthernet0/0 of a Cisco 3725 router.

CDP Ethernet LLC

Packets: 1 Duration: n/a Downloads: 4295

3560_CDP.cap 1.2 KB

Submitted Sep 14, 2009

Cisco Discovery Protocol (CDP) advertisements from a Catalyst 3560. Note how much information is offered to a potential attacker.

CDP Ethernet LLC

Packets: 3 Duration: 120s Downloads: 4850