network-programmingipwiresharkpacket-snifferspacket-capture

Reading the packet information (based on the picture)

Here is an image of a packet captured (I do not have full image, only this snippet). From it, I know that 0x4500 means it indicated the IP version is IPv4. But how do i indicate what is the source and destination address? Is there an easy way to see and determine which?

enter image description here

Solution

  • Apologies for my "paint" with mouse skill. The general idea is this.

    You take a header format and match it byte by byte.

    enter image description here

    To find protocol numbers one needs to read an appropriate registry. For IP this registry is IANA registry for protocol numbers. Most protocols standardized by IETF has similar IANA registries. The registry should be listed in protocol specification.