LinuxQuestions.org - Decoding frames with Ettereal

- Linux - Networking (https://www.linuxquestions.org/questions/linux-networking-3/)

- - Decoding frames with Ettereal (https://www.linuxquestions.org/questions/linux-networking-3/decoding-frames-with-ettereal-353366/)

Decoding frames with Ettereal

Hi,

I captured some data with Ethereal, what is the meaning of decoding a packet ?

thanks very much !

Juan

I think you mean analyzing a packet. What you're doing is just looking at the options and values for a specific packet. If you have a lot of knowledge about TCP/IP you can probably deduce quite a bit of info.

For example the Linux TCP/IP stack by default uses a TTL value of 64. So if you look at the TTL value of a packet and it is below 64 it is safe to assume it was sent from a Linux box. Windows systems use a TTL of 128. Going through more than 64 hops is highly unlikely so this is a reasonably safe assumption.