topic Track a packet in source & destination end sniffer captures in Application Networking

Track a packet in source & destination end sniffer captures

samarjitdas — Thu, 01 Sep 2011 09:14:06 GMT

I have taken sniffer capture at both ends(source & destination) of communication but how can I track a single packet from both sides of capture. Is there any unique # tagged into the packet from which it can be identified that this is the packet reaching the destination side capture which was sent by source.

Regards,

Samarjit Das

Track a packet in source & destination end sniffer captures

Collin Clark — Thu, 01 Sep 2011 11:35:04 GMT

There is. Look at the TCP Sequence #.

Track a packet in source & destination end sniffer captures

samarjitdas — Thu, 01 Sep 2011 11:48:35 GMT

I believe wireshark converts all real Seq # and ACK Numbers of packet into relative numbers.Instead of displaying the real seq and Ack # in the display, Wireshark will display a seq and ack number relative to the first seen segment for that conversation. Hence always seq & ack # starts with 0.

If sniffer trace at both ends of conversation started and there would be a slight gap of start time in both ends, there won't have any option to find out how a packet will be represented in destination end.

Track a packet in source & destination end sniffer captures

Cesar Roque — Thu, 01 Sep 2011 15:34:43 GMT

Hi Samarjit,

Try with the IP Identification

Cesar R

Track a packet in source & destination end sniffer captures

Ahmad Basel Jaber — Fri, 02 Sep 2011 01:23:11 GMT

Agree with Cesar, IP ID should not be changed by any intermidiate network device, the wireshark filter is

ip.id == 0x6b04, where 0x6b04 is the packet ID, you can find it under Layer 3 header.

Track a packet in source & destination end sniffer captures

samarjitdas — Fri, 02 Sep 2011 05:25:54 GMT

Hi Cesar.

Thanks for your valuable response. I checked with ip.identification and really same packet can be identified at both sides..