This is our old Q&A Site. Please post any new questions and answers at ask.wireshark.org.

Hello, i hope i can find some help here. I´m working at the moment on a school project. As you can see its a TCP/IP packets output from Wireshark but i need help from you to understand the meaning, structure & contents. Can anyone assist? I appreciate it!

Here is the output:

  1. 13:12:49.751403 arp who-has 192.168.246.13(Broadcast) tell 192.168.246.128
  2. 13:12:49.751602 arp reply 192.168.246.13is-at 00:00:01:0f:2e:7e
  3. 13:12:50.441259 IP 192.168.246.13.137 > 192.168.246.128.137: UDP, length 50
  4. 13:12:50.441632 IP 192.168.246.128 > 192.168.246.13: ICMP 192.168.246.128 udp port 137 unreachable, length 86
  5. 13:12:51.942563 IP 192.168.246.13.137 > 192.168.246.128.137: UDP, length 50
  6. 13:12:51.943277 IP 192.168.246.128 > 192.168.246.13: ICMP 192.168.246.128 udp port 137 unreachable, length 86
  7. 13:12:53.444627 IP 192.168.246.13.137 > 192.168.246.128.137: UDP, length 50
  8. 13:12:53.445343 IP 192.168.246.128 > 192.168.246.13: ICMP 192.168.246.128 udp port 137 unreachable, length 86
  9. 13:13:02.738990 IP 192.168.246.128.39886 > 192.168.246.13.80: . ack 1611053795 win 3072
  10. 13:13:02.739053 IP 192.168.246.13.80 > 192.168.246.128.39886: R 1611053795:1611053795(0) win 0
  11. 13:13:22.407445 IP 192.168.246.128.54955 > 192.168.246.13.80: S 2910497703:2910497703(0) win 5840 <mss 1460,sackok,timestamp="" 518611="" 0,nop,wscale="" 6="">
  12. 13:13:22.407560 IP 192.168.246.13.80 > 192.168.246.128.54955: S 3762608065:3762608065(0) ack 2910497704 win 64240 <mss 1460,nop,wscale="" 0,nop,nop,timestamp="" 0="" 0,nop,nop,sackok="">
  13. 13:13:22.407963 IP 192.168.246.128.54955 > 192.168.246.13.80: . ack 1 win 92 <nop,nop,timestamp 518611="" 0="">
  14. 13:13:22.408321 IP 192.168.246.128.54955 > 192.168.246.13.80: R 1:1(0) ack 1 win 92 <nop,nop,timestamp 518611="" 0="">

asked 17 Nov '14, 03:08

Kell90's gravatar image

Kell90
11223
accept rate: 0%

ok i found out to point 8 is there anyone who can help with point 9?

(17 Nov '14, 10:06) Kell90

#9 is linux sending a packet on a tcp connection that does not (no longer) exist at the server.
#10 is the server sending a RST in reaction of #9 as no socket is open for this connection.

permanent link

answered 17 Nov '14, 13:35

mrEEde's gravatar image

mrEEde
3.9k152270
accept rate: 20%

Your answer
toggle preview

Follow this question

By Email:

Once you sign in you will be able to subscribe for any updates here

By RSS:

Answers

Answers and Comments

Markdown Basics

  • *italic* or _italic_
  • **bold** or __bold__
  • link:[text](http://url.com/ "title")
  • image?![alt text](/path/img.jpg "title")
  • numbered list: 1. Foo 2. Bar
  • to add a line break simply add two spaces to where you would like the new line to be.
  • basic HTML tags are also supported

Question tags:

×752
×205
×178
×22

question asked: 17 Nov '14, 03:08

question was seen: 4,180 times

last updated: 17 Nov '14, 13:35

p​o​w​e​r​e​d by O​S​Q​A