This is our old Q&A Site. Please post any new questions and answers at ask.wireshark.org.
1
1

I am looking for a way to do a "stare and compare" packet analysis. I have a situation with a SIP carrier who is sending an INVITE for a number that works and others that do not. They seem identical in format and such but I noticed that they were slightly different sizes (1109 for the one that worked and 1112 for the ones that don't work). Where they differ, however, is the problem. Is there a utility tool that is set up for this?

Thanks

Eric

asked 11 Feb '13, 15:11

EricKnaus's gravatar image

EricKnaus
46192026
accept rate: 0%


When I have to do something like this I try to avoid doing "spot the difference" compares by viewing the traces side by side. I'd rather save the two frames in question into a separate trace (so that they're right next to each other) - this is easy to do by marking the two frames in question and then using "File -> Export Specified Packets" and selecting "marked packets" in the selection box.

Then, you can just load this very short trace file and use cursor up/down to go back and forth between the two frames. By looking at the hex view you can see what bytes change right away, and after that check the decode for what they stand for.

If saving is too complicated you could also use the "Go back/forward in Packet History" buttons in the toolbar after having clicked on both packets in question, but if the distance is greater than a few frames it can be confusing.

As Hansang and I always say: the human eye is good in spotting changes more than staring at immobile text :-)

permanent link

answered 11 Feb '13, 15:55

Jasper's gravatar image

Jasper ♦♦
23.8k551284
accept rate: 18%

edited 11 Feb '13, 16:02

Jasper - thanks for your answer and that was where I was headed. The carrier insists they are sending the SIP invites the same way every time. The manufacturer insists that they are not. Neither seem all that willing to slug it out bit-by-bit with me (I'm willing!). So, I was looking for something that was more automated instead of me saying to one or the other "Here it is" versus a program/tool that would highlight an extra white space, character -- anything. They tend to be more receptive to that sort of thing. Tried WinDiff but that was not useful in this case. Thanks

Eric

(12 Feb '13, 04:33) EricKnaus

Sounds like you're trying to find a more automatic solution? If one compare sample is enough, you can do what @kurt suggests - use exporting to get ASCII representations and then diff them. If you need to compare tons of samples things get a lot more complicated...

(12 Feb '13, 05:41) Jasper ♦♦

Sounds like you're trying to find a more automatic solution?

The 'problem' is: It's not about comparing different pcap files (there are more/or less good ways to do that). It's about comparing packets (actually just the payload) within a single capture file. That's something you usually do not need, except for very special cases. I don't think there is any automatic solution 'out there' that does exactly that.

(12 Feb '13, 06:40) Kurt Knochner ♦

but I noticed that they were slightly different sizes (1109 for the one that worked and 1112 for the ones that don't work). Where they differ, however, is the problem.

Don't you see a difference if you look at the payload in HEX (possibly export the HEX output and let WinDiff find the difference).

Here is how I would do it.

  • Select packet #1 (Size: 1109)
  • right click it
  • print -> "Plain Text", "Output to file", only "packet bytes" (Packet format)

  • Select packet #2 (Size: 1102)

  • right click it
  • print -> "Plain Text", "Output to file", only "packet bytes" (Packet format)

Comapre the files with WinDiff or WinMerge. Ignore the first 40 bytes IP/TCP header (+/- 1 or 2 bytes depending on the header fields).

Now you should see a difference. If there is none, can you upload those two packets (or the HEX output) somewhere (google docs, one click file hoster, pastebin.com., etc. BEWARE the privacy issues in doing so!!).

Regards
Kurt

permanent link

answered 12 Feb '13, 04:54

Kurt%20Knochner's gravatar image

Kurt Knochner ♦
24.8k1039237
accept rate: 15%

Save packets into their parsed textual representation:

File->Export packet dissections->(select format),in the save dialog specify the packets and "packet details" to include.

Then do a diff over the textual results

permanent link

answered 19 Mar '15, 11:45

native_api's gravatar image

native_api
11
accept rate: 0%

edited 19 Mar '15, 11:46

Your answer
toggle preview

Follow this question

By Email:

Once you sign in you will be able to subscribe for any updates here

By RSS:

Answers

Answers and Comments

Markdown Basics

  • *italic* or _italic_
  • **bold** or __bold__
  • link:[text](http://url.com/ "title")
  • image?![alt text](/path/img.jpg "title")
  • numbered list: 1. Foo 2. Bar
  • to add a line break simply add two spaces to where you would like the new line to be.
  • basic HTML tags are also supported

Question tags:

×248
×5

question asked: 11 Feb '13, 15:11

question was seen: 31,392 times

last updated: 19 Mar '15, 11:46

p​o​w​e​r​e​d by O​S​Q​A