Reading a Capture

Lesson 27 of 32 in Coddy's The OSI Model course.

Packet captures are usually summarized one packet per line, listing the nested layers and their key fields. Being able to skim such a dump and pull out one packet's facts is the everyday form of encapsulation knowledge.

A summary line like

2 eth aa:..:01>aa:..:02 ip 10.0.0.5>10.0.0.9 tcp 51000>443

reads: packet number 2, an Ethernet frame between those MACs, carrying an IP packet between those addresses, carrying a TCP segment from port 51000 to port 443. Destination port 443 tells you the payload is almost certainly HTTPS.

Challenge

Easy

The file capture.txt holds one summary line per packet. Find the packet whose TCP destination port is 53 and print its full line with grep.

Expected output:

3 eth aa:00:00:01>aa:00:00:02 ip 10.0.0.5>10.0.0.53 tcp 51002>53

Try it yourself

Terminal

All lessons in The OSI Model

1Why Layers

The Layering Idea Seven Layers Numbers and Names Recap - The Stack

4The Network Layer

IP and TTL Ping and ICMP Routing Tables Recap - Layer Three

7Encapsulation

Wrapping Data Headers EverywhereReading a CaptureRecap - Follow the Wrap

2The Physical Layer

Bits on a Wire How Long Will It Take Duplex and Collisions

5Transport: TCP and UDP

Ports The TCP Handshake TCP vs UDP Sockets in Action Recap - Layer Four

8The Journey of a Packet

A Click Happens Crossing the Networks Arriving and Climbing Recap - End to End

3Data Link and MACs

Frames and MACs Reading a MAC ARP Recap - Layer Two

6The Upper Layers

Session and Presentation The Application Layer Watching the Layers Recap - Top of the Stack

Practice on your own: Terminal playground