This is our old Q&A Site. Please post any new questions and answers at

Hi guys,

I'm new to wireshark and I need to know how figure out the network topology from a wireshark capture, please can someone shed some light on the subject

many thanks


asked 24 Apr '13, 12:26

harry82's gravatar image

accept rate: 0%

what do you mean (exactly) by 'network topology'?

(24 Apr '13, 14:29) Kurt Knochner ♦

There is no general method to do this. I usually look at the ip.ttl of inbound packets. Most platforms send with a default initial TTL so you can guess how far away (in terms of L3 hops) they are if you know the initial TTL. 3-way handshake tcp options can be used to determine the sending OS (p0f). MAC addresses and ARP packets give an idea of the local topology ...

permanent link

answered 24 Apr '13, 12:44

mrEEde2's gravatar image

accept rate: 20%

Your answer
toggle preview

Follow this question

By Email:

Once you sign in you will be able to subscribe for any updates here



Answers and Comments

Markdown Basics

  • *italic* or _italic_
  • **bold** or __bold__
  • link:[text]( "title")
  • image?![alt text](/path/img.jpg "title")
  • numbered list: 1. Foo 2. Bar
  • to add a line break simply add two spaces to where you would like the new line to be.
  • basic HTML tags are also supported

Question tags:


question asked: 24 Apr '13, 12:26

question was seen: 6,646 times

last updated: 24 Apr '13, 14:29

p​o​w​e​r​e​d by O​S​Q​A