Packet Captures
3560_CDP.cap 1.2 KB
Submitted Sep 14, 2009
Cisco Discovery Protocol (CDP) advertisements from a Catalyst 3560. Note how much information is offered to a potential attacker.
| Packets: 3 | Duration: 120s | Downloads: 7091 |
3725_CDP.cap 390 bytes
Submitted Sep 14, 2009
Cisco Discovery Protocol (CDP) from FastEthernet0/0 of a Cisco 3725 router.
| Packets: 1 | Duration: n/a | Downloads: 6443 |
802.1D_spanning_tree.cap 1.1 KB
Submitted Sep 14, 2009
IEEE 802.1D Spanning Tree Protocol (STP) advertisements sent every two seconds.
| Packets: 14 | Duration: 26s | Downloads: 13646 |
802.1Q_tunneling.cap 5.0 KB
Submitted Jun 30, 2010
| Packets: 26 | Duration: 35s | Downloads: 21144 |
802.1w_rapid_STP.cap 2.2 KB
Submitted Sep 14, 2009
Rapid Spanning Tree Protocol BPDUs are received from a Catalyst switch after connecting to a port not configured for PortFast. The port transitions through the blocking and learning states before issuing a topology change notification (packet #30) and transitioning to the forwarding state.
| Packets: 30 | Duration: 56s | Downloads: 11492 |
DTP.cap 934 bytes
Submitted Sep 14, 2009
Dynamic Trunking Protocol (DTP) emanated from a Catalyst 3560 every 60 seconds, both with and without ISL encapsulation.
| Packets: 10 | Duration: 120s | Downloads: 8692 |
ISIS_external_lsp.cap 17.0 KB
Submitted Sep 14, 2009
R2 floods the external routes redistributed from RIP into area 10. Packet #9 includes the IP external reachability TLV. Capture perspective from R3's 10.0.10.1 interface.
| Packets: 15 | Duration: 23s | Downloads: 6962 |
ISIS_level1_adjacency.cap 27.4 KB
Submitted Sep 14, 2009
Routers 2 and 3 form an IS-IS level 2 adjacency.
| Packets: 22 | Duration: 58s | Downloads: 7950 |
ISIS_level2_adjacency.cap 51.8 KB
Submitted Sep 14, 2009
Routers 3 and 4 form an IS-IS level 2 adjacency.
| Packets: 43 | Duration: 85s | Downloads: 9054 |
LLDP_and_CDP.cap 4.0 KB
Submitted Oct 3, 2010
LLDP and CDP advertisements sent between two switches, S1 and S2.
| Packets: 12 | Duration: 98s | Downloads: 15916 |
MSTP_Intra-Region_BPDUs.cap 1.7 KB
Submitted May 1, 2012 by lobo
MSTP BPDUs captured on an intra-region root port.
00:1f:27:b4:7d:80 - CIST Root (is in another MSTP Region)
00:16:46:b5:8c:80 - CIST Regional Root, Root for Instance 0, 2
00:1e:f7:05:a8:80 - Root for Instance 1
Notice in frame 1 that 00:1e:f7:05:a8:80 uses 32768.00:16:46:b5:8c:80 (Regional Root BID) as bridge ID in the main STP header to make the region appear as a single bridge.
| Packets: 10 | Duration: 10s | Downloads: 12865 |
PAGP.cap 2.5 KB
Submitted Nov 15, 2009
| Packets: 25 | Duration: 95s | Downloads: 8030 |
STP-TCN-TCAck.pcapng.cap 692 bytes
Submitted Mar 11, 2016 by sahil_pujani
Spanning Tree 8021.D Topology Change Notification and Topology Change Ack.
Packet 4: aa:bb:cc:00:02:00 generates TCN because of Link failure Packet 5: aa:bb:cc:00:01:00 is the Root Bridge and it generates TCAck.
| Packets: 5 | Duration: 5s | Downloads: 8432 |
Spanning Tree - MST.pcapng.cap 3.4 KB
Submitted Apr 22, 2015 by JozefHamar
Example of Multiple Spanning Tree with IEEE 802.3 + 802.2 LLC without SNAP encapsulation.
| Packets: 19 | Duration: 36s | Downloads: 9332 |
UDLD.cap 3.3 KB
Submitted Sep 14, 2009
Unidirectional Link Detection (UDLD) is used to monitor the status of a link between a Catalyst 2960 and a Catalyst 3560. Note that echos are initially sent at very small intervals, gradually throttling back to the configured interval of 15 seconds.
| Packets: 29 | Duration: 93s | Downloads: 10271 |
arp_pcap.pcapng.cap 2.2 KB
Submitted Mar 11, 2016 by Ashay
ARP Request reply packet captures
| Packets: 16 | Duration: 50s | Downloads: 13898 |
iphttps.cap 12.4 KB
Submitted Nov 12, 2010 by nacnud
IP-HTTPS capture. This is Microsoft's IPv6 inside HTTPS tunneling for DirectAccess.
ARP DNS Ethernet ICMPv6 IGMP IP IPv6 LLC NBNS NBSS SSL TCP UDP
| Packets: 83 | Duration: 38s | Downloads: 14514 |
packet-c.cap 675.0 KB
Submitted Jan 31, 2012 by Slaingod
This is a packet capture from a SonicWall. We were troubleshooting DHCP packet flows. The SonicWall saw the DHCP Discover and Sent an Offer. We never saw the DHCP acknowledgement. In the adjacent core stacked switching we were running "debug ip dhcp server packets" we only saw discover packets from IP phones up to the SonicWall. For some reason the SonicWall could not let any other DHCP packets through or out of it INSIDE (LAN) interface. Even if we put an ANY-ANY ALC for that interface. We ended up having to replace the SonicWall and upload the configuration from the old SonicWall to the new one.
-Slaingod
BOOTP DNS HTTP IP LLC SKINNY SSL STP TCP UDP
| Packets: 926 | Duration: 13s | Downloads: 15586 |
rpvstp-access.pcap.cap 3.7 KB
Submitted Dec 16, 2009 by einval
Rapid per-VLAN spanning tree capture of an access port (without portfast), configured in VLAN 5.
DNS Ethernet IP LLC LOOP STP UDP
| Packets: 49 | Duration: 77s | Downloads: 9165 |
rpvstp-trunk-native-vid1.pcap.cap 6.4 KB
Submitted Dec 16, 2009 by einval
Rapid per-VLAN spanning tree capture of a trunk port, configured with native VLAN 1 (default), VLAN 5 is also active over the trunk.
Capture shows that 3 BPDUs are sent out, one for classic STP (Frame 4, for example), one for the native VLAN (not tagged - Frame 3) and one for each other active VLAN (tagged - Frame 5).
The PVST BPDUs contain the VLAN ID at the end of the frame (01 and 05, respectively).
DTP Ethernet LLC LOOP STP VLAN VTP
| Packets: 81 | Duration: 45s | Downloads: 11897 |
rpvstp-trunk-native-vid5.pcap.cap 1.8 KB
Submitted Dec 16, 2009 by einval
Rapid per-VLAN spanning tree capture of a trunk port, configured with native VLAN 5, VLAN 1 is also active over the trunk.
Capture shows that 3 BPDUs are sent out, one for classic STP (Frame 4, for example), one for the native VLAN 5 (not tagged - Frame 5) and one for each other active VLAN (tagged - Frame 3).
The PVST BPDUs contain the VLAN ID at the end of the frame (01 and 05, respectively).
DTP Ethernet LLC LOOP STP VLAN VTP
| Packets: 22 | Duration: 11s | Downloads: 13633 |