IPv6 in Wireshark

IPv6 address beginning with fe80::.. is used for local network.

http://en.wikipedia.org/wiki/IPv6_address

fe80::/10 — Addresses in the link-local prefix are only valid and unique on a single link. Within this prefix only one subnet is allocated (54 zero bits), yielding an effective format of fe80::/64. The least significant 64 bits are usually chosen as the interface hardware address constructed in modified EUI-64 format. A link-local address is required on every IPv6-enabled interface—in other words, applications may rely on the existence of a link-local address even when there is no IPv6 routing. These addresses are comparable to the auto-configuration addresses 169.254.0.0/16 of IPv4.

You will see strange packets when you open IPv6 pcap files.

Just decode it

1. Decode AS...

2. select 'Network' tap and then IPv6

3. Now we have IPv6's packet streams

 

 

codegate 2012 prequal network 100

자, 패킷 포맷을 제대로 이해했다면 이제 실전에 적용해 보자.

실전에 적용해 보기 위해 아주 좋은 예제가 있다.

코드게이트 2012년 prequal 네트워크 100 문제~

파일 이름은 10_Floor.pcap으로 명명했다.

See on the link below to refer to pcap file format.

http://n20kim.blogspot.kr/2013/02/pcap-file-format.html

Wireshark can't open the pcap file.

If you understand pcap file format, you could notice what is weird.
Yeah, right!
pcap has global header at the beginning of the pcap. :)

# recover the pcap's global header.

1.make global header to add global header to the pcap.
   To make this, I made this code. It's simple but entering line by line is a little bit annoying

import binascii
binary=binascii.unhexlify("d4c3b2a1020004000000000000000000ffff000001000000")
f=open('header.pcap','w')
f.write(binary)
f.close()

2. add global header to the pcap

But an error still occurs because of size. phew...

Fix it again!

3. Did you notice something? The problem is size... and 22nd packet is normal.
   So you can infer that 23rd packet is probably abnormal.
   22nd packet byte streams is following:

4. The last line from 0x0038 is "16 d0 e3 42 ... "
    Find that byte streams in the 10_Floor.pcap
    23rd packet starts with "3e ec 60 ..".
    Packet header has 16bytes as you know.
    You can see "GET .." instead of packet header bytes. weird...

 

 

5. The final task is removing 23rd packet. Then you can open the pcap.




 

pcap file format

http://wiki.wireshark.org/Development/LibpcapFileFormat#File_Format

패킷 헤더의 구조를 알면 패킷을 분석할 때 유용하다. 잘 알아둘 필요가 있다. wireshark에서 제공하는 문서를 잘 이해해 두기 바란다~

The Libpcap's format is following:

Global header | Packet Header | Packet Data | Packet Header | Packet Data | ...


# Global header has the following structure:

typedef struct pcap_hdr_s {
        guint32 magic_number;   /* magic number */
        guint16 version_major;  /* major version number */
        guint16 version_minor;  /* minor version number */
        gint32  thiszone;       /* GMT to local correction */
        guint32 sigfigs;        /* accuracy of timestamps */
        guint32 snaplen;        /* max length of captured packets, in octets */
        guint32 network;        /* data link type */
} pcap_hdr_t;


# Record (Packet) Header has the following structure:

typedef struct pcaprec_hdr_s {
        guint32 ts_sec;         /* timestamp seconds */
        guint32 ts_usec;        /* timestamp microseconds */
        guint32 incl_len;       /* number of octets of packet saved in file */
        guint32 orig_len;       /* actual length of packet */
} pcaprec_hdr_t;