topic I know what the traffic is I in Network Security

ASA packet capture query

CiscoNutt — Tue, 12 Mar 2019 08:39:05 GMT

I have a packet capture output and am wondering about the number (46) that comes after udp. What does this indicate? I can find no reference to it in wireshark.

1: 08:35:39.635251 802.1Q vlan#9 P0 10.3.2.7.63325 > 146.112.61.107.53: udp 46

What are these two Ip

Vishnu Sharma — Mon, 12 Dec 2016 15:31:26 GMT

What are these two Ip addresses " 10.3.2.7 & 146.112.61.107"?

The traffic is going on UDP port 53. It can be DNS server or traffic from Xbox Live.

Thanks,

Vishnu

"46" is the length of the

Karsten Iwen — Mon, 12 Dec 2016 15:45:05 GMT

"46" is the length of the packet that got captured.

Ok. Thanks, odd thing is

CiscoNutt — Tue, 13 Dec 2016 11:22:04 GMT

Ok. Thanks, odd thing is that in Wireshark the length is shown as 54, so I can only assume that wireshark shows an 8 bit header aswell?

I know what the traffic is I

CiscoNutt — Tue, 13 Dec 2016 11:24:01 GMT

I know what the traffic is I was just curious as to the number after UDP which Karsten has answered for me.

Just FYI, the traffic is generated by a trojan (torrentlocker)