Packet Captures

connection termination.cap (316 bytes)

This is a connection termination packet in which both the server and client sends fin & ack to each other.
For details of how connection is been teared down by both client and server see the link below.
http://www.firewall.cx/networking-topics/protocols/tcp/136-tcp-flag-options.html

• Categories: None
• Protocols: IP, TCP

OCSP-Not_Implemted.cap (1.1 KB)

OCSP-Not_Implemted

• Categories: Encryption
• Protocols: HTTP, IP, OCSP, TCP

OCSP-Good.cap (3.5 KB)

OCSP_Good (CRL HTTPS CA Verisign)

• Categories: Encryption
• Protocols: DNS, HTTP, IP, OCSP, TCP, UDP

HTTP.cap (24.9 KB)

Simple HTTP transfer of a PNG image using wget

• Categories: Web
• Protocols: Ethernet, HTTP, IP, TCP

TACACS+_encrypted.cap (2.8 KB)

TACACS+ authentication and authorization requests as made by a Cisco IOS router upon a user logging in via Telnet.

• Categories: Management
• Protocols: Ethernet, IP, TACACS+, TCP

TCP_SACK.cap (27.5 KB)

A TCP SACK option is included in packets #31, #33, #35, and #37. The missing segment is retransmitted in packet #38.

• Categories: None
• Protocols: Ethernet, HTTP, IP, TCP

4-byte_AS_numbers_Full_Support.cap (1.2 KB)

• Categories: Routing Protocols
• Protocols: BGP, HDLC, IP, TCP

BGP_MD5.cap (1.7 KB)

An EBGP with TCP MD5 authentication enabled

• Categories: Authentication, Routing Protocols
• Protocols: BGP, Ethernet, IP, TCP

EoMPLS.cap (7.0 KB)

Routers at 1.1.2.1 and 1.1.2.2 are PEs in a MPLS cloud. LDP starts at packet 8 and they build up a pseudo-wire VC (last FEC in packets 11 and 13). At packet 15 we already have STP running between CE1 and CE2 (two routers with ESW), encapsulated in 2 MPLS headers. All the ethernet stuff follows: CDP, ARP, ICMP between two hosts on the same subnet.

• Categories: MPLS
• Protocols: Ethernet, IP, LOOP, MPLS, TCP, UDP

TDP.cap (2.8 KB)

P2 and PE2 exchange Tag Distribution Protocol hellos and form an adjacency over TCP port 711.

• Categories: Cisco-proprietary, Multicast
• Protocols: Ethernet, IP, TCP, TDP, UDP

PPP_TCP_compression.cap (1.5 KB)

A telnet session is established to 191.1.13.3 across a PPP link performing TCP header compression. The user at 191.1.13.1 logs in with the password "cisco" and terminates the connection.

• Categories: None
• Protocols: IP, LCP, PPP, TCP

LDP_adjacency.cap (5.7 KB)

PE1 and P1 multicast LDP hellos to 224.0.0.2 on UDP port 646. They then establish an adjacency on TCP port 646 and exchange labels.

• Categories: MPLS, Routing Protocols
• Protocols: Ethernet, IP, LDP, TCP, UDP

EBGP_adjacency.cap (2.7 KB)

The external BGP adjacency between routers 1 and 2 is brought online and routes are exchanged. Keepalives are then exchanged every 60 seconds. Note that the IP TTL (normally 1) has been increased to 2 with ebgp-multihop to facilitate communication between the routers' loopback interfaces.

• Categories: Routing Protocols
• Protocols: BGP, Ethernet, IP, TCP

BGP_notification.cap (764 bytes)

R1 has been misconfigured to expect R2 to reside in AS 65100. R2 attempts to peer with R1 advertising itself correctly in AS 65200. R1 issues a NOTIFICATION in packet #5 citing a "bad peer AS" error and terminates the TCP connection.

• Categories: Routing Protocols
• Protocols: BGP, Ethernet, IP, TCP