Intermediate
Packet Analysis
Every bit on the wire tells a story. Understanding packet structure lets you see what tools abstract away—and spot what they miss.
Beyond the GUI
This module focuses on understanding the structure of packets. For Wireshark usage, see the Wireshark Cheatsheet.
Ethernet Frame Structure (Layer 2)
Every packet on a LAN starts with an Ethernet frame. Understanding this helps with ARP attacks and MAC analysis.
Ethernet II Frame Format:
Preamble
7 bytes
SFD
1 byte
Dest MAC
6 bytes
Src MAC
6 bytes
EtherType
2 bytes
Payload (IP Packet)
46-1500 bytes
FCS
4 bytes
EtherType Values
- 0x0800 - IPv4
- 0x0806 - ARP
- 0x86DD - IPv6
- 0x8100 - 802.1Q VLAN
Security Notes
- • MAC addresses can be spoofed
- • ARP has no authentication
- • VLAN tags can be injected (double tagging)
IPv4 Header Structure (Layer 3)
IPv4 Header (20-60 bytes):
0 1 2 3 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ |Version| IHL | DSCP |ECN| Total Length | +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ | Identification |Flags| Fragment Offset | +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ | Time to Live | Protocol | Header Checksum | +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ | Source IP Address | +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ | Destination IP Address | +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ | Options (if IHL > 5) | +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
Protocol Numbers
- 1 - ICMP
- 6 - TCP
- 17 - UDP
- 47 - GRE
- 50 - ESP (IPSec)
TTL Analysis
- • Linux default: 64
- • Windows default: 128
- • Cisco/network: 255
- • Use for OS fingerprinting
Attack Vectors
- • IP spoofing (source IP)
- • Fragmentation attacks
- • TTL manipulation
- • IP options abuse
TCP Header Structure (Layer 4)
TCP Header (20-60 bytes):
0 1 2 3 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ | Source Port | Destination Port | +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ | Sequence Number | +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ | Acknowledgment Number | +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ | Data | |C|E|U|A|P|R|S|F| | | Offset| Rsrvd |W|C|R|C|S|S|Y|I| Window | | | |R|E|G|K|H|T|N|N| | +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ | Checksum | Urgent Pointer | +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ | Options (if Data Offset > 5) | +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
TCP Flags (Critical for Scanning)
SYN
Initiate connection
ACK
Acknowledge data
RST
Reset connection
FIN
Close connection
PSH
Push data now
URG
Urgent pointer
ECE
ECN Echo
CWR
Congestion Window
Practical Packet Analysis
Examine Raw Packets with tcpdump
tcpdump-analysis.sh
# Capture packets in hex/ASCII
tcpdump -i eth0 -X -c 10
# Show TCP flags
tcpdump -i eth0 'tcp[tcpflags] & (tcp-syn|tcp-ack) != 0'
# Capture to file for Wireshark
tcpdump -i eth0 -w capture.pcapScapy - Craft Custom Packets (Python)
scapy-craft.py
from scapy.all import *
# Create and examine an IP packet
ip = IP(dst="192.168.1.1")
tcp = TCP(dport=80, flags="S") # SYN packet
packet = ip/tcp
# Show packet layers
packet.show()
# Send the packet
send(packet)Legal Reminder
Sending crafted packets to systems you don't own is illegal. Practice on your own lab networks.
Evidence Collection
A packet-level finding is reproducible or it is a story. Keep:
The capture and its hash:
The pcap or pcapng file with its sha256sum, the capture filter, the snapshot length, and the interface it was taken on.
Frame references: The frame numbers you cite for each claim, plus the display filter that isolates them, so a reviewer can land on the same bytes in one paste.
The header values you relied on: EtherType, TTL, TCP flags, sequence and acknowledgement numbers quoted from the frame - not summarised. These are the fields that decide what the packet proves.
Vantage and window: Whether the capture came from the sending host, a SPAN port or a tap, and the capture start and end timestamps.
False Positive Identification
- Offload artefacts: Captures taken on the sending host show invalid checksums and oversized segments because the NIC has not yet done the work. Both are an artefact of where you captured, never a finding.
- Truncated snap length: Fields past the snapshot length read as empty rather than absent. Re-capture with a full snapshot before reporting a missing option, payload or extension header.
- The wrong interface: Loopback traffic never appears on eth0, and switched unicast never arrives without a mirror. An empty capture is usually the capture point, not the absence of traffic.
- Retransmissions and dup ACKs: Loss, reordering and congestion control all produce retransmissions and duplicate acknowledgements on healthy paths. They are evidence of the path, not of an attack.
Remediation & Defense
What an analyst can reconstruct from the wire is a design decision about what you let onto it.
Reduce what can be seen
- • Encrypt in transit everywhere it matters - TLS 1.3, IPsec, SSH - and retire protocols that send credentials or payload in the clear.
- • Isolate segments with private VLANs and port isolation so one compromised host cannot see another's frames.
- • Authenticate the access port with 802.1X so an unauthorised device cannot join the broadcast domain to capture at all.
Detect what still crosses
- • Alert on gratuitous ARP replies that change an existing binding, and on 802.1Q tags arriving on an access port.
- • Baseline TTL values per host so spoofed-source and tunnelled traffic stands out from the first packet.
- • Keep captures on a defined retention window and hash them at acquisition - a capture without a chain of custody is not evidence.