Packets & pcap

1 Where captures come from

A capture only contains what passed the capture point. Three common ones:

• SPAN / mirror port: the switch copies the traffic of chosen ports or VLANs to a monitoring port. Cheap and common, but a busy switch silently drops mirrored packets, and traffic between two hosts on another switch is never seen.
• Network TAP: a passive device in the cable that copies every frame. Complete, but needs a physical slot in the link.
• On a host: tcpdump, dumpcap or Wireshark on the endpoint or a server. Sees loopback and VPN traffic before encryption, but runs on the system you may be investigating.

Intrusion detection systems often keep a ring buffer of recent traffic and write it out when a rule fires. Such captures are short, and they may keep only the first part of each flow. Write down the capture point, the time range and any limits (snap length, per-flow caps, drops) together with the file's hash.

2 The pcap file

The classic pcap format is simple: a 24-byte global header, then for every packet a 16-byte record header followed by the packet bytes. The header fields are written in the byte order of the machine that captured, so the magic number tells you how to read the rest. The packet bytes themselves are in network byte order (big-endian).

Each record header holds the time (seconds since 1970 in UTC plus micro- or nanoseconds), the captured length and the original length. If the capture kept only the start of a packet, the captured length is smaller. The packet below was cut to 128 bytes; the decoder still reads the headers, but the payload is mostly missing and the TCP checksum cannot be checked.

3 One packet, four layers

Each layer's header says what comes next: the Ethernet EtherType 08 00 means IPv4, the IP protocol byte 6 means TCP, and the TCP ports hint at the application. This is the first packet of a TCP connection (SYN) from a client to a web server:

Details that matter in investigations:

• MAC addresses are only valid on the local link. A packet routed to the internet carries the router's MAC as destination, not the server's. The first half of a MAC (the OUI) names the network card's vendor.
• TTL starts at 64 (Linux, macOS, most network gear) or 128 (Windows) and drops by one per router. A value of 52 means "probably 64, twelve hops away".
• The IP identification counts up per packet on many systems; gaps or jumps can show which packets came from the same sender.
• The TCP handshake is SYN → SYN/ACK → ACK. The side that sent the SYN started the connection; that is the direction that matters for "who connected to whom".

Not everything is IP. ARP asks "who has 192.168.56.1?" so the client can learn its gateway's MAC. ARP replies are useful evidence that a device with a given MAC and IP was on the local network at that moment.

4 pcapng

Wireshark saves pcapng by default. It is a sequence of blocks, each with a type, a length at the start and the same length again at the end. A Section Header Block starts the file and fixes the byte order; Interface Description Blocks describe each capture interface; Enhanced Packet Blocks hold the packets. Blocks can carry options such as comments, the interface name or the capturing OS, which are worth noting in a report.

The time stamp in the EPB is one 64-bit number split into a high and a low 32-bit half. This packet is the same DNS query as the one at 09:30:00.200000 in the pcap file above. editcap -F pcap in.pcapng out.pcap converts between the formats (the options are lost).

5 Pitfalls

• "Bad checksum" on your own packets. Network cards compute checksums in hardware (offloading), so packets captured on the sending host often show wrong checksums. That is not tampering.
• Drops. SPAN ports and overloaded sensors lose packets without telling you. A TCP stream with gaps in its sequence numbers was not captured completely.
• Time base. pcap time stamps are UTC from the sensor's clock. Check that clock like any other source.
• Encryption. Most traffic is TLS. You still see addresses, ports, timing, sizes and the handshake, which the next page covers.

6 Try it yourself

Answer from the hex views above. Numbers can be typed in decimal or hex (0x…).