I have done a small c# client/server chat with simple auth that runs on the tcp port 8822, I would like to sniff it to learn more about how the packets work and everything, I can capture the packets just fine but I am wondering about what I am seeing at the wireshark. For example the first entry: How do I define where it starts and how do I read it ? Unrealistic example 00 30 b8 d3 is a 4 byte and translates to 123123 or I should discard the first byte or first 2 bytes as trash data... Is the first entry in the above code tag the raw packets or not ? PS: if you are going to post books, please instead post links that maybe be hand and readable online without fees, thanks for the understanding. EDIT: So I have started understanding some of it: asked 27 May '11, 21:20  Prixone edited 27 May '11, 22:01 |
2 Answers:
Have you looked at the decode pane of Wireshark, or just the hex view? The decode pane will decode most of the packet for you except the payload. For example: the byte example 00 30 b8 d3 is neither a 4 byte value nor trash data, it's the first 4 bytes of the receiving MAC address (which is 00 30 b8 d3 d6 30). The sender's MAC is the next 6 bytes (00 1f d0 d2 28 52), and after that comes the 2 byte value for the ethertype (08 00, which means this is an IP packet). The 45 is indeed a combination of the header length as well as the IP protocol type, which is TCP in this case. All of this you can see by looking at the decode pane. If you want to know which bytes are decoded to what you can mark them in the hex view and the decode pane will show you exactly what they mean (as far as there's a dissector that understands that part of the packet). answered 28 May '11, 02:25  Jasper ♦♦ edited 28 May '11, 02:29 |
As this is the Wireshark Q&A site, I'm sure you have Wireshark installed. You can put your hexadecimal data in a text file and use "File -> Import" in (a recent) release of WIreshark to import it and it will show you exactly what each byte in your stream means... Here is what you will see: answered 28 May '11, 05:39  SYN-bit ♦♦ @SYNbit thanks that helps a lot, I just started messing with wireshark and was aware of this panel but not entirely on how it worked until now. (28 May '11, 11:15) Prixone |
@Jasper thanks for the compreensive answer, I wasnt aware of the click navigation thing until I read it here then I noticed that not only on the hex but on the bytes I could click and it would iterate with the above window to guide me thru what I was clicking at. Would all the initial data be considered as the header then and the payload the sent information for example ?
Payload is what is transported by the packet, or, in short, everything after all protocol headers that are neccessary to transport it. So in your case, if you send application data via TCP, that will be the payload (or "sent information").
The bytes you quoted are only headers: Ethernet, IP, TCP, with TCP having a payload length of zero, meaning, there is no payload in the packet. Not surprising, since it's a SYN packet, which is used to establish the TCP session as part of the initial TCP three way handshake.