pcaps

• a look at some pcaps

ARP

arp.pcap

• sender MAC, sender IP, target MAC, target IP
• request:
  • opcode 1
  • MAC broadcast
  • target MAC 0000.0000.0000
• reply:
  • opcode 2
  • MAC unicast

ICMP

icmp.pcap

• ICMP echo request 8, ICMP echo reply 0
• data is the alphabet, interval is 1 second, repeat is 4
• the first ping was probably to the default gateway, the second to Google
• probably didn't type the second ping but pressed Up x2

DHCP

dhcp.pcap

1. D(iscover)
   • the client initiates the exchange
   • srcMAC = hardware, dstMAC = FFFF.FFFF.FFFF | srcIP = 0.0.0.0, dstIP = 255.255.255.255 | srcPort = UDP 68 (bootpc = Bootstrap protocol client), dstPort = UDP 67 (bootps = Bootstrap protocol server)
2. O(ffer)
3. R(equest)
4. A(CKnowledgement)

• common DHCP options:
  • 0 = padding
  • 1 = subnet mask
  • 3 = router(s)
  • 6 = DNS IP(s)
  • 15 = domain name
  • 42 = NTP IP(s)
  • 43 = vendor specific, but usually IP of the WLC for the APs
  • 50 = requested IP address
  • 51 = IP address lease time
  • 53 = DHCP message type:
    • 1 = DHCPDISCOVER
    • 2 = DHCPOFFER
    • 3 = DHCPREQUEST
    • 4 = DHCPDECLINE
    • 5 = DHCPACK
    • 6 = DHCPNAK
    • 7 = DHCPRELEASE
    • 8 = DHCPINFORM
  • 54 = DHCP server ID - IP
  • 55 = Parameter request list - used by a DHCP client to request values for specified configuration parameters
  • 58 = Renewal (T1) time value - the time interval from address assignment until the client transitions to the RENEWING state
  • 59 = Rebinding (T2) time value - the time interval from address assignment until the client transitions to the REBINDING state
  • 61 = Client ID - usually MAC address
  • 66 = TFTP server name
  • 82 = Relay agent information option
  • 150 = TFTP server IP
  • 255 = marks the end of the options

NTP

NTP_sync.pcap

• src and dst port UDP 123
• version 3
• uses multiple servers (16)

SNMP

b6300a.cap

• .73 client, .54 server
• version 1
• srcPort dynamic, dstPort UDP 161
• 29 GET requests and responses

Telnet

telnet.pcap

• .2 client Windows (\r\n), .1 server Linux (ls)
• cooked mode
• data starts in the packet 27
• user: fake, pass: user
• pings yahoo.com and ls the directory

TFTP

tftp_rrq.pcap

• .253 client, .10 server
• RRQ = Read ReQuest
• reads the rfc1350.txt

• .1 client, .13 server
• WRQ = Write ReQuest
• writes the rfc1350.txt

FTP

ftp.pcap

• pretty fast exchange, probably pasted the commands
• logged in, went to /, PASV and downloaded the Music.mp3

DNS

dns.pcap

• client initiates
• ephemeral port -> UDP 53, TCP if length > 512 bytes (zone transfers)
• DNS classes - basically only IN (Internet) used
• TTL = Time-To-Live - how long to cache the record (0 to prohibit caching)
• DNS records:
  • A - IPv4 address
  • AAAA - IPv6 address
  • CNAME = Canonical name - alias of the domain
  • MX = Mail eXchange - mail server
  • NS = NameServer - authoritative DNS server
  • TXT = Text - mainly used for email spam prevention and domain ownership prevention
  • SRV = Service - port
  • PTR = PoinTeR - domain
  • SOA = Start Of Authority - domain info (admin email, refresh interval, default TTL...)
• pretty short TTLs (tens of minutes) except for the netbsd domain (a day)
• all traffic is UDP

SSH with decryption keys

ssh_curve25519-aes128-gcm_opensshS.pcapng

• localhost to localhost
• server TCP 29418, client TCP 58530
• fish shell
• echoes 'Hello' and then exits

HTTP

http.cap

• 3-way handshake - SYN, SYNACK, ACK
• of course, nothing without ads
• the site is in packet 38
• GET request and a 200
• website of Ethereal - original name for Wireshark

SSL with decryption keys

snakeoil2_070531.tgz

• some Debian website

WPA decrypted with the password "Induction"

wpa-Induction.pcap

• Karen browsed the SNL website for the "Jaws 2" transcript on her iMac