Given a capture how can i figure out where the trace is taken from(who is the originator of the flow) if the capture contains 3 packets (SYN,SYN/ACK and ACK)? asked 06 May '14, 19:57  krishnayeddula edited 06 May '14, 19:58 |
2 Answers:
To determine where the capture was taken you can use following clues
The larger delta time has the external RTT of the connection indicating the sender of the packet is remote host (if there is a notable difference). Most IP stacks have a hexadecimal 'even' TTL. Windows uses 128, most other stacks 64, some 255. So unless client and server are on the same LAN you should see an 'odd' TTL, this is a packet from the remote host. MAC addresses give a clue as to what manufacturer the sender of an IP packet is Statistics Summary contains general information about the capture answered 06 May '14, 21:16  mrEEde edited 06 May '14, 21:19 |
See the answer to this question. answered 07 May '14, 09:41  Jim Aragon |
"Where the trace is taken from?" and "Who is the originator of the flow?" are 2 entirely different questions. Which do you want to know? Or are you assuming that the trace is being taken from the originator? Which class is this question for, by the way?