Packet Captures

stun2.cap (102 bytes)

Stun (2) Protocol. UDP Holepunching technique.

• Categories: None
• Protocols: IP, STUN, UDP

IPv6_RTSP.cap (15.5 KB)

This capture contains IPv6_RTSP packets. Accessed IPv6 enabled RTSP server using 6in4 tunnel.

• Categories: None
• Protocols: IP, UDP

traceroute_MPLS.cap (3.3 KB)

• Categories: MPLS
• Protocols: ICMP, IP, UDP

iphttps.cap (12.4 KB)

IP-HTTPS capture. This is Microsoft's IPv6 inside HTTPS tunneling for DirectAccess.

• Categories: None
• Protocols: ARP, DNS, Ethernet, ICMPv6, IGMP, IP, IPv6, LLC, NBNS, NBSS, SSL, TCP, UDP

rpvstp-access.pcap.cap (3.7 KB)

Rapid per-VLAN spanning tree capture of an access port (without portfast), configured in VLAN 5.

• Categories: Switching
• Protocols: DNS, Ethernet, IP, LLC, LOOP, STP, UDP

EoMPLS.cap (7.0 KB)

Routers at 1.1.2.1 and 1.1.2.2 are PEs in a MPLS cloud. LDP starts at packet 8 and they build up a pseudo-wire VC (last FEC in packets 11 and 13). At packet 15 we already have STP running between CE1 and CE2 (two routers with ESW), encapsulated in 2 MPLS headers. All the ethernet stuff follows: CDP, ARP, ICMP between two hosts on the same subnet.

• Categories: MPLS
• Protocols: Ethernet, IP, LOOP, MPLS, TCP, UDP

DHCP.cap (5.8 KB)

R0 is the client and R1 is the DHCP server. Lease time is 1 minute.

• Categories: None
• Protocols: BOOTP, Ethernet, IP, UDP

SNMPv2c_get_requests.cap (894 bytes)

SNMPv2c get requests are issued from a manager to an SNMP agent in order to monitor the bandwidth utilization of an interface.

• Categories: Management
• Protocols: Ethernet, IP, SNMP, UDP

RIPv2.cap (1.7 KB)

A RIPv2 router periodically flooding its database. Capture perspective from R1's 10.0.0.1 interface.

• Categories: Routing Protocols
• Protocols: Ethernet, IP, RIP, UDP

RIPv1.cap (876 bytes)

A RIPv1 router periodically flooding its database. Capture perspective from R1's 10.0.1.1 interface.

• Categories: Routing Protocols
• Protocols: Ethernet, IP, RIP, UDP

PIM-DM_pruning.cap (10.2 KB)

The multicast source at 172.16.40.10 begins sending traffic to the group 239.123.123.123, and PIM-DM floods the traffic down the tree. R4 has no group members, and prunes itself from the tree. R2 and R3 then realize they have no members, and each prunes itself from the tree. The capture shows R2 receiving the multicast traffic flooded from R1 and subsequently pruning itself every three minutes.

• Categories: Multicast, Routing Protocols
• Protocols: Ethernet, IP, PIM, UDP

LDP_adjacency.cap (5.7 KB)

PE1 and P1 multicast LDP hellos to 224.0.0.2 on UDP port 646. They then establish an adjacency on TCP port 646 and exchange labels.

• Categories: MPLS, Routing Protocols
• Protocols: Ethernet, IP, LDP, TCP, UDP

HSRP_failover.cap (3.0 KB)

R1 is the active router, R3 is the standby, and R2 is passive. R1 goes offline and R3 takes over as active after ten seconds. R2 is then promoted to the standby state.

• Categories: Cisco-proprietary, Redundancy
• Protocols: Ethernet, HSRP, IP, UDP

HSRP_coup.cap (3.9 KB)

Initially only routers 3 (active) and 2 (standby) are online. R1 comes online with a priority higher than R3's. R1 takes over as the active router (the coup occurs in packet #22) almost immediately. R2 is bumped down to passive and R3 becomes the standby router.

• Categories: Cisco-proprietary, Redundancy
• Protocols: Ethernet, HSRP, IP, UDP