Tag Info

Hot answers tagged

16

Consider a NEW packet a telephone call before the receiver has picked up. An ESTABLISHED packet is their, "Hello." And a RELATED packet would be if you were calling to tell them about an e-mail you were about to send them. (The e-mail being RELATED.) In case my analogy isn't so great, I personlly think the man pages handles it well: NEW -- meaning ...


11

I am a network engineer, so I'll describe this from my perspective. For me, diagnosing packet loss usually starts with "it's not working very well". From there, I usually try to find kit as close to both ends of the communication (typically, a workstation in an office and a server somewhere) and ping as close to the other end as possible (ideally the ...


10

The DF flag instructs routers who would normally fragment the packet due to it being too large for a link's MTU (and potentially deliver it out of order due to that fragmentation) to instead drop the packet and return an ICMP Fragmentation Needed packet, allowing the sending host to account for the lower MTU on the path to the destination host. This process ...


7

In almost all cases, it is ignored.


7

Sure - any network can be sniffed, as long as the sniffer can be connected in the right place. Communications between the phone and the cell antenna are encypted, though, so without some specialized equipment and processes, data is relatively safe on that path. After getting decrypted at the cell antenna site, though, it could be sniffed at one of hundreds ...


6

One way to know the packet size using iptables is to use -j LOG target. You can use this to log specific packets. In the system log file, you can see log records like: IN=<iface1> OUT=<iface2> SRC=1.2.3.4 DST=4.3.2.1 LEN=1400 This packet is 1400-byte long. The max packet size is determined by the underlying protocol. The number 1500 can be ...


6

It can't work that way. Part of the process of a web server sending you a web page is you requesting that web page. There's just no way for it to happen without your request. Your question is like "What happens if McDonald's gives me food at the drive through without me ordering any?" Well, if you didn't order any food, you're not going to be at the drive ...


6

This is not achievable natively within the TCP/IP protocol, because... well, that's just not how the protocol works - it doesn't have a concept of users, and is designed to just transfer data between devices. The way this is generally done (rate-limiting a specific remote user) is through the use of sessions (layer 5 in your OSI networking model, which is 1 ...


6

Yes, you can use the Ident protocol to identify the user at the source. Well, you used to be able to. Nowadays the only people who expose ident servers to the Internet at large are IRC users who want a funky nickname. Oh, and people who've misconfigured their systems.


5

It's not actually using RGTP. TCP connections have a randomised source port, and this just happens to have used port 1431, which IANA has assigned to that protocol. It's actually an HTTPS connection.


5

The client doesn't know that his ACK was received, but why does he care? The connection is established whether or not the ACK is received. You will never know for sure that the last packet sent was received, so you have to design a protocol that doesn't require that.


5

The problem that your hitting is that Fortigate's Marketing department got a hold of the webpage for the product and gave you a useless as crap number (data rate_. What you need to know is the products throughput in packets per second (PPS). Unfortunately Managers like units they've seen before, so they don't feel "out of the loop". The size of the packet ...


5

Full-duplex mode makes use of two physical pairs of twisted cable where one pair is used for receiving data packets and the other pair for sending packets. This way the cable itself represents a collision-free carrier. It also doubles the maximum data volume that can be supported by the connection. Other advantages are that no time is wasted because no ...


4

The hex string needs to be surrounded by | symbols. The spaces are optional iptables --append INPUT --match string --algo kmp --hex-string '|f4 6d 04 25 b2 02 00 0a|' --jump ACCEPT Note that string matching should be a last resort. It's intensive, and unreliable because it works on packets not connections. It also only starts working on the third packet in ...


4

its because its specifying a single ip, you need to write it with the subnet: pass in from 111.111.0.0/16 man pf.conf should list a few methods of defining ranges and blocks. A side note, take care to ensure there are no drop quick kind of rules above your pass, and no rules below that could accidently match and block your packets.


3

Yes, sequence number and acknowledgement number in packet 3 and 4 will indeed be identical. No, the packets are not guaranteed to be exactly identical. Differences you might see include: Packet 4 may also have the PSH flag set. If timestamps are in use they could differ between 3 and 4. The checksum will most likely be different. The reason sequence ...


3

A car can get across the country faster than a truck. But if you need to get two tons of pumpkins from New York to Los Angeles, a truck is going to get the job done a lot faster than a car. Why? Because the truck, though slower, carries more and thus needs fewer trips.


3

The second paragraph is incorrect. Maybe the intention was to say packet rather than header. This wording would make more sense: be sure to keep in mind that the 'TCP packet' is the same thing as a 'TCP Segment', meaning it's the TCP header information plus the Data


3

As luck would have it, there are indeed tools to do such a thing: Microsoft Network Monitor for Windows WireShark for Windows and *NIX (It also has a command line interface) TCPDump for anything that plugs into a wall.


3

No. (at least, not without some vulnerability or bizarre naughtiness involving sequence prediction or boring naughtiness such as man in the middle.) ssh would protect against those types of attack. even if your attacker managed to convince netfilter to not drop the packets, the ssh server and client would both puke at the random unencrypted traffic and ...


3

The size changes because some machines have custom settings which alter the MTU: http://en.wikipedia.org/wiki/Maximum_transmission_unit The max size of the data frame is usually 1500, bytes, but Jumbo Frames extend that allocation: http://en.wikipedia.org/wiki/Jumbo_frame Here are the full specs: http://en.wikipedia.org/wiki/Ethernet_frame


3

Because it is full duplex mode? Did yo uever check the wiring on normal ethernet cables? Like it uses 4 wires, in 2 separated circuits - so the Switch and the network card SEND and RECEIVE over DIFFERENT WIRES. There simply is no chance for collission.


3

I will start by using packet capturing tool such as: wireshark (on Windows) and tcpdump (on Linux terminal). I will also check the firewall configuration (host firewall as well as network firewall).


3

As in most things, define your threat model. Most people out wardriving are not going to have the equipment to decode 3G data into packets. But, if you're sending information worth $1 billion dollars over 3G, someone would easily spend $5 million dollars to be able to do it. Nothing is secure, and as long as you define your threat and have "sufficient" ...


3

From TCP Connection Establishment Sequence Number Synchronization and Parameter Exchange : Once each device has chosen its ISN, it sends this value to the other device in the Sequence Number field in its initial SYN message. The device receiving the SYN responds with an ACK message acknowledging the SYN (which may also contain its own SYN, ...


2

I think this depends on what kind of packet generation you are doing. If you're looking for IPv6 throughput testing, iperf is probably what you want. If you want to generate IPv6 packets with interesting combinations of flags and protocols, scapy is good at this. The author did a presentation on IPv6 and scapy


2

Found the answer! Linux ethernet bridge consults ebtables to decide which packets to forward and which to drop. Flushing ebtables solved my problem.


2

Wake-on-LAN is an Ethernet computer networking standard that allows a computer to be turned on or woken up by a network message. You can intercept sleep and wakeup events. See the following: A useful utility - run a program before standby WMI : Win32_PowerManagementEvent Class


2

No, wireshark doesn't have this data. Remember, it's sniffing the wire. If you were on a shared network segment, it would show packets from other machines. Hell, even in an unshared segment it shows packets bound to you from other machines, or broadcasts - wireshark certainly has no way of knowing what processes on the remote machines generated those. What ...



Only top voted, non community-wiki answers of a minimum length are eligible