Network Protocol Analyzers and Packet Analysis

Comprehensive vocabulary flashcards covering packet capture tools (tcpdump, Wireshark), IPv4 and IPv6 header structures, display filter operators, and packet capture file formats.

Network protocol analyzer (packet sniffer)

A software or hardware tool designed to intercept, capture, and analyze data traffic circulating within a network for troubleshooting, monitoring, and intrusion detection.

Packet sniffing

The practice of capturing and inspecting data packets as they travel across a network.

tcpdump

A command-line network protocol analyzer for Unix-based operating systems (like Linux and macOS) that captures, filters, and inspects network traffic.

Packet capture (p-cap)

A file containing intercepted network data packets that can be saved, shared, and inspected at a later time for analysis.

tcpdump -i

The parameter that specifies the network interface to sniff packets from (e.g., using -i any captures traffic from all active interfaces).

tcpdump -D

The option used to list all available network interfaces on a system.

tcpdump -w

The option used to write and save captured network packets directly to a .pcap file rather than printing them to the terminal.

tcpdump -r

The option used to read and process packets from an existing packet capture (.pcap) file.

tcpdump -v

The verbose flag that increases packet detail in the terminal output across three incremental levels: -v, -vv, and -vvv.

tcpdump -c

The count flag that restricts packet collection to a specified number of packets before terminating execution.

Name resolution (tcpdump)

The default behavior in tcpdump of converting IP addresses to hostnames and port numbers to standard protocol names using reverse DNS queries.

Reverse DNS lookup

A DNS query that resolves an IP address to its associated domain name, which risks alerting an attacker whose traffic is being analyzed.

tcpdump -n and -nn

Flags used to disable automatic name resolution: -n disables resolving hostnames, while -nn disables resolving both hostnames and port numbers.

tcpdump filter expressions

Filter rules that isolate specific packets by protocol, IP address, or port, combinable using Boolean operators like and, or, and not.

tcpdump output structure

A single-line record per packet formatted sequentially with: Timestamp, Source IP, Source port, Destination IP, Destination port, followed by TCP flags and sequence numbers.

Internet Protocol (IP)

A core set of networking standards responsible for addressing and routing data packets across interconnected devices on the internet.

IPv4 header

A packet routing header consisting of 13 fields: Version, IHL, ToS, Total Length, Identification, Flags, Fragment Offset, TTL, Protocol, Header Checksum, Source Address, Destination Address, and Options.

Internet Header Length (IHL)

An IPv4 header field specifying the total length of the IPv4 header, including any optional fields.

Type of Service (ToS)

An IPv4 header field containing delivery priority and quality-of-service parameters for the packet.

Identification field (IPv4)

A unique identifier assigned to an original packet used to accurately correlate and reassemble fragmented pieces at the receiving end.

Flags field (IPv4)

An IPv4 header field indicating whether a packet has been fragmented and if additional fragments are currently in transit.

Fragment Offset

An IPv4 header field that establishes the exact ordering and position of fragments relative to the original unfragmented packet.

Time to Live (TTL)

An IPv4 header field defining an upper limit on how long a packet can circulate in a network before being discarded by a router.

Header Checksum

An IPv4 header field containing a calculated checksum used strictly to detect data errors within the header itself.

IPv6 header

A streamlined packet header consisting of 8 fields: Version, Traffic Class, Flow Label, Payload Length, Next Header, Hop Limit, Source Address, and Destination Address.

Traffic Class

An IPv6 header field analogous to IPv4's Type of Service (ToS) that designates delivery priority or packet class.

Flow Label

An IPv6 header field used to track and maintain the sequence of packets originating from a specific source as a unified flow.

Next Header

An IPv6 header field that specifies the protocol or extension header immediately succeeding the IPv6 base header.

Hop Limit

An IPv6 header field equivalent to IPv4's TTL that decrements at each hop to prevent indefinite forwarding.

Wireshark

A graphical network protocol analyzer that decodes, color-codes, and visualizes network communications for packet analysis.

Display filters (Wireshark)

Expressions entered into the Wireshark filter toolbar to isolate and show only the packets matching specific criteria, such as protocol, IP, or port.

Wireshark comparison operators

Operators for comparing values in display filters, accepted either as symbols (==, !=, >,

contains operator (Wireshark)

A Wireshark display filter operator used to search for an exact match of an ASCII or byte text string inside a packet stream.

matches operator (Wireshark)

A display filter operator used to filter packets using pattern-matching regular expressions (regex).

Media Access Control (MAC) address

A unique physical hardware identifier assigned to network interfaces, filtered in Wireshark using the eth.addr expression.

Follow stream (Wireshark)

A Wireshark feature that extracts, reassembles, and displays the complete bidirectional conversation payload exchanged between two endpoints.

Data packet

The foundational unit of data transmitted over a computer network, organized into three components: header, payload, and footer.

Packet header

The initial segment of a data packet containing metadata required for routing and delivery, including addresses, protocol identifiers, and packet lengths.

Packet payload

The section of a data packet that carries the actual user or application data being transferred across the network.

Packet footer (trailer)

The concluding segment of a data packet, used primarily by protocols like Ethernet to supply error-checking data (such as a frame check sequence).

Network Interface Card (NIC)

The internal hardware component connecting a computer to a physical or wireless network medium.

Promiscuous mode

An operational mode of a Network Interface Card (NIC) that allows it to capture all visible network packets on a segment, not just packets addressed to itself.

Libpcap

An open-source packet capture library designed for Unix-based operating systems (Linux, macOS) that serves as tcpdump's native capture format.

WinPcap

An older, open-source packet capture library developed for the Windows operating system that has largely been superseded.

Npcap

A modern packet capture library designed by the developers of Nmap for Windows operating systems.

PCAPng

A next-generation packet capture file format designed to simultaneously capture data packets and store granular network metadata.