Data Link Layer (Example)

`tcpdump` Example

This CLI tool monitors network traffic at a very detailed level. Running the following:

sudo tcpdump -i wlp0s20f3 -e -vvv

yielded:

13:10:25.238890 30:23:03:95:ef:f2 (oui Unknown) > e4:c7:67:fe:21:0d (oui Unknown), ethertype IPv4 (0x0800), length 3753: (tos 0x0, ttl 57, id 2423, offset 0, flags [DF], proto TCP (6), length 3739)
172.64.155.209.https > junior-ThinkPad-P1-Gen-6.etisalat-gateway.42862: Flags [P.], cksum 0x61f2 (incorrect -> 0x5b5d), seq 137844:141531, ack 1, win 16, options [nop,nop,TS val 1049055748 ecr 2514290620], length 3687
13:10:25.238899 e4:c7:67:fe:21:0d (oui Unknown) > 30:23:03:95:ef:f2 (oui Unknown), ethertype IPv4 (0x0800), length 66: (tos 0x0, ttl 64, id 23866, offset 0, flags [DF], proto TCP (6), length 52)
junior-ThinkPad-P1-Gen-6.etisalat-gateway.42862 > 172.64.155.209.https: Flags [.], cksum 0x538b (incorrect -> 0x9f1a), seq 1, ack 141531, win 2442, options [nop,nop,TS val 2514290846 ecr 1049055748], length 0
13:10:25.238906 30:23:03:95:ef:f2 (oui Unknown) > e4:c7:67:fe:21:0d (oui Unknown), ethertype IPv4 (0x0800), length 3742: (tos 0x0, ttl 57, id 2426, offset 0, flags [DF], proto TCP (6), length 3728)
172.64.155.209.https > junior-ThinkPad-P1-Gen-6.etisalat-gateway.42862: Flags [P.], cksum 0x61e7 (incorrect -> 0xf89f), seq 141531:145207, ack 1, win 16, options [nop,nop,TS val 1049055761 ecr 2514290620], length 3676
13:10:25.238912 e4:c7:67:fe:21:0d (oui Unknown) > 30:23:03:95:ef:f2 (oui Unknown), ethertype IPv4 (0x0800), length 66: (tos 0x0, ttl 64, id 23867, offset 0, flags [DF], proto TCP (6), length 52)
junior-ThinkPad-P1-Gen-6.etisalat-gateway.42862 > 172.64.155.209.https: Flags [.], cksum 0x538b (incorrect -> 0x90ca), seq 1, ack 145207, win 2417, options [nop,nop,TS val 2514290846 ecr 1049055761], length 0
13:10:25.245194 30:23:03:95:ef:f2 (oui Unknown) > e4:c7:67:fe:21:0d (oui Unknown), ethertype IPv4 (0x0800), length 862: (tos 0x0, ttl 57, id 2429, offset 0, flags [DF], proto TCP (6), length 848)
172.64.155.209.https > junior-ThinkPad-P1-Gen-6.etisalat-gateway.42862: Flags [P.], cksum 0xf5da (correct), seq 144411:145207, ack 1, win 16, options [nop,nop,TS val 1049055801 ecr 2514290620], length 796
13:10:25.245215 e4:c7:67:fe:21:0d (oui Unknown) > 30:23:03:95:ef:f2 (oui Unknown), ethertype IPv4 (0x0800), length 78: (tos 0x0, ttl 64, id 23868, offset 0, flags [DF], proto TCP (6), length 64)
junior-ThinkPad-P1-Gen-6.etisalat-gateway.42862 > 172.64.155.209.https: Flags [.], cksum 0x5397 (incorrect -> 0x8975), seq 1, ack 145207, win 2483, options [nop,nop,TS val 2514290853 ecr 1049055801,nop,nop,sack 1 {144411:145207}], length 0
13:10:25.297523 30:23:03:95:ef:f2 (oui Unknown) > e4:c7:67:fe:21:0d (oui Unknown), ethertype IPv4 (0x0800), length 3785: (tos 0x0, ttl 57, id 2430, offset 0, flags [DF], proto TCP (6), length 3771)
172.64.155.209.https > junior-ThinkPad-P1-Gen-6.etisalat-gateway.42862: Flags [P.], cksum 0x6212 (incorrect -> 0xa98d), seq 145207:148926, ack 1, win 16, options [nop,nop,TS val 1049055854 ecr 2514290853], length 3719
13:10:25.297567 e4:c7:67:fe:21:0d (oui Unknown) > 30:23:03:95:ef:f2 (oui Unknown), ethertype IPv4 (0x0800), length 66: (tos 0x0, ttl 64, id 23869, offset 0, flags [DF], proto TCP (6), length 52)
junior-ThinkPad-P1-Gen-6.etisalat-gateway.42862 > 172.64.155.209.https: Flags [.], cksum 0x538b (incorrect -> 0x8179), seq 1, ack 148926, win 2467, options [nop,nop,TS val 2514290905 ecr 1049055854], length 0
13:10:25.365845 30:23:03:95:ef:f2 (oui Unknown) > e4:c7:67:fe:21:0d (oui Unknown), ethertype IPv4 (0x0800), length 3785: (tos 0x0, ttl 57, id 2433, offset 0, flags [DF], proto TCP (6), length 3771)
172.64.155.209.https > junior-ThinkPad-P1-Gen-6.etisalat-gateway.42862: Flags [P.], cksum 0x6212 (incorrect -> 0x4778), seq 148926:152645, ack 1, win 16, options [nop,nop,TS val 1049055919 ecr 2514290905], length 3719
13:10:25.365917 e4:c7:67:fe:21:0d (oui Unknown) > 30:23:03:95:ef:f2 (oui Unknown), ethertype IPv4 (0x0800), length 66: (tos 0x0, ttl 64, id 23870, offset 0, flags [DF], proto TCP (6), length 52)
junior-ThinkPad-P1-Gen-6.etisalat-gateway.42862 > 172.64.155.209.https: Flags [.], cksum 0x538b (incorrect -> 0x726d), seq 1, ack 152645, win 2467, options [nop,nop,TS val 2514290973 ecr 1049055919], length 0
13:10:25.545375 30:23:03:95:ef:f2 (oui Unknown) > e4:c7:67:fe:21:0d (oui Unknown), ethertype IPv4 (0x0800), length 3785: (tos 0x0, ttl 57, id 2436, offset 0, flags [DF], proto TCP (6), length 3771)
172.64.155.209.https > junior-ThinkPad-P1-Gen-6.etisalat-gateway.42862: Flags [P.], cksum 0x6212 (incorrect -> 0x6efe), seq 152645:156364, ack 1, win 16, options [nop,nop,TS val 1049056027 ecr 2514290973], length 3719
13:10:25.545412 e4:c7:67:fe:21:0d (oui Unknown) > 30:23:03:95:ef:f2 (oui Unknown), ethertype IPv4 (0x0800), length 66: (tos 0x0, ttl 64, id 23871, offset 0, flags [DF], proto TCP (6), length 52)
junior-ThinkPad-P1-Gen-6.etisalat-gateway.42862 > 172.64.155.209.https: Flags [.], cksum 0x538b (incorrect -> 0x62c6), seq 1, ack 156364, win 2467, options [nop,nop,TS val 2514291153 ecr 1049056027], length 0
13:10:25.545434 30:23:03:95:ef:f2 (oui Unknown) > e4:c7:67:fe:21:0d (oui Unknown), ethertype IPv4 (0x0800), length 3785: (tos 0x0, ttl 57, id 2439, offset 0, flags [DF], proto TCP (6), length 3771)
172.64.155.209.https > junior-ThinkPad-P1-Gen-6.etisalat-gateway.42862: Flags [P.], cksum 0x6212 (incorrect -> 0xb5e4), seq 156364:160083, ack 1, win 16, options [nop,nop,TS val 1049056071 ecr 2514290973], length 3719
13:10:25.545441 e4:c7:67:fe:21:0d (oui Unknown) > 30:23:03:95:ef:f2 (oui Unknown), ethertype IPv4 (0x0800), length 66: (tos 0x0, ttl 64, id 23872, offset 0, flags [DF], proto TCP (6), length 52)
junior-ThinkPad-P1-Gen-6.etisalat-gateway.42862 > 172.64.155.209.https: Flags [.], cksum 0x538b (incorrect -> 0x542c), seq 1, ack 160083, win 2442, options [nop,nop,TS val 2514291153 ecr 1049056071], length 0
13:10:25.645206 30:23:03:95:ef:f2 (oui Unknown) > e4:c7:67:fe:21:0d (oui Unknown), ethertype IPv4 (0x0800), length 3785: (tos 0x0, ttl 57, id 2442, offset 0, flags [DF], proto TCP (6), length 3771)
172.64.155.209.https > junior-ThinkPad-P1-Gen-6.etisalat-gateway.42862: Flags [P.], cksum 0x6212 (incorrect -> 0x2790), seq 160083:163802, ack 1, win 16, options [nop,nop,TS val 1049056201 ecr 2514291153], length 3719
13:10:25.645263 e4:c7:67:fe:21:0d (oui Unknown) > 30:23:03:95:ef:f2 (oui Unknown), ethertype IPv4 (0x0800), length 66: (tos 0x0, ttl 64, id 23873, offset 0, flags [DF], proto TCP (6), length 52)
junior-ThinkPad-P1-Gen-6.etisalat-gateway.42862 > 172.64.155.209.https: Flags [.], cksum 0x538b (incorrect -> 0x44a6), seq 1, ack 163802, win 2467, options [nop,nop,TS val 2514291253 ecr 1049056201], length 0
13:10:25.731840 30:23:03:95:ef:f2 (oui Unknown) > e4:c7:67:fe:21:0d (oui Unknown), ethertype IPv4 (0x0800), length 3785: (tos 0x0, ttl 57, id 2445, offset 0, flags [DF], proto TCP (6), length 3771)
172.64.155.209.https > junior-ThinkPad-P1-Gen-6.etisalat-gateway.42862: Flags [P.], cksum 0x6212 (incorrect -> 0x42ea), seq 163802:167521, ack 1, win 16, options [nop,nop,TS val 1049056285 ecr 2514291253], length 3719
13:10:25.731894 e4:c7:67:fe:21:0d (oui Unknown) > 30:23:03:95:ef:f2 (oui Unknown), ethertype IPv4 (0x0800), length 66: (tos 0x0, ttl 64, id 23874, offset 0, flags [DF], proto TCP (6), length 52)
junior-ThinkPad-P1-Gen-6.etisalat-gateway.42862 > 172.64.155.209.https: Flags [.], cksum 0x538b (incorrect -> 0x3575), seq 1, ack 167521, win 2467, options [nop,nop,TS val 2514291339 ecr 1049056285], length 0
13:10:25.814922 30:23:03:95:ef:f2 (oui Unknown) > e4:c7:67:fe:21:0d (oui Unknown), ethertype IPv4 (0x0800), length 3785: (tos 0x0, ttl 57, id 2448, offset 0, flags [DF], proto TCP (6), length 3771)
172.64.155.209.https > junior-ThinkPad-P1-Gen-6.etisalat-gateway.42862: Flags [P.], cksum 0x6212 (incorrect -> 0xc7ed), seq 167521:171240, ack 1, win 16, options [nop,nop,TS val 1049056365 ecr 2514291339], length 3719
13:10:25.814962 e4:c7:67:fe:21:0d (oui Unknown) > 30:23:03:95:ef:f2 (oui Unknown), ethertype IPv4 (0x0800), length 66: (tos 0x0, ttl 64, id 23875, offset 0, flags [DF], proto TCP (6), length 52)
junior-ThinkPad-P1-Gen-6.etisalat-gateway.42862 > 172.64.155.209.https: Flags [.], cksum 0x538b (incorrect -> 0x264b), seq 1, ack 171240, win 2467, options [nop,nop,TS val 2514291422 ecr 1049056365], length 0
13:10:25.904718 30:23:03:95:ef:f2 (oui Unknown) > e4:c7:67:fe:21:0d (oui Unknown), ethertype IPv4 (0x0800), length 3785: (tos 0x0, ttl 57, id 2451, offset 0, flags [DF], proto TCP (6), length 3771)
172.64.155.209.https > junior-ThinkPad-P1-Gen-6.etisalat-gateway.42862: Flags [P.], cksum 0x6212 (incorrect -> 0x805f), seq 171240:174959, ack 1, win 16, options [nop,nop,TS val 1049056461 ecr 2514291422], length 3719
13:10:25.904793 e4:c7:67:fe:21:0d (oui Unknown) > 30:23:03:95:ef:f2 (oui Unknown), ethertype IPv4 (0x0800), length 66: (tos 0x0, ttl 64, id 23876, offset 0, flags [DF], proto TCP (6), length 52)
junior-ThinkPad-P1-Gen-6.etisalat-gateway.42862 > 172.64.155.209.https: Flags [.], cksum 0x538b (incorrect -> 0x170a), seq 1, ack 174959, win 2467, options [nop,nop,TS val 2514291512 ecr 1049056461], length 0

Interpretation

This is a tcpdump output showing network traffic between two devices over an Ethernet network. Let's break it down into key components to help you understand:

General Structure of Each Line

Timestamp - Each entry begins with a timestamp, e.g., 13:10:25.238890.
MAC Addresses - After the timestamp, the source and destination MAC addresses are displayed, e.g., 30:23:03:95:ef:f2 > e4:c7:67:fe:21:0d.
Ethertype - This field indicates the protocol encapsulated within the Ethernet frame, such as IPv4 (0x0800), indicating that the payload is an IPv4 packet.
Packet Length - Indicates the size of the packet, e.g., length 3753.

Breakdown of One Example

13:10:25.238890 30:23:03:95:ef:f2 (oui Unknown) > e4:c7:67:fe:21:0d (oui Unknown), ethertype IPv4 (0x0800), length 3753:

Timestamp - 13:10:25.238890
Source MAC Address - 30:23:03:95:ef:f2 (manufacturer not identified, hence "oui Unknown").
Destination MAC Address - e4:c7:67:fe:21:0d (again, "oui Unknown").
Ethertype - 0x0800 indicates it's an IPv4 packet.
Length - The total frame length is 3753 bytes.

Details of the IPv4 Packet

(tos 0x0, ttl 57, id 2423, offset 0, flags [DF], proto TCP (6), length 3739)

TOS (Type of Service) - 0x0 - Specifies the priority of the packet (default in this case).
TTL (Time to Live) - 57 - The number of hops the packet can travel before being discarded.
ID - 2423 - Identification for fragmentation.
Flags - [DF] - "Don't Fragment" flag.
Protocol - TCP (6) - Encapsulated protocol is TCP.
Length - 3739 bytes for the payload.

TCP Segment Info

172.64.155.209.https > junior-ThinkPad-P1-Gen-6.etisalat-gateway.42862:
Flags [P.], cksum 0x61f2 (incorrect -> 0x5b5d), seq 137844:141531, ack 1, win 16, options [nop,nop,TS val 1049055748 ecr 2514290620], length 3687

Source IP and Port - 172.64.155.209.https - The server at this IP using HTTPS (port 443).
Destination IP and Port - junior-ThinkPad-P1-Gen-6.etisalat-gateway.42862 - The destination (likely your machine) on port 42862.
Flags - [P.] - Push flag is set, meaning the sender is pushing data to the receiver immediately.
Checksum - cksum 0x61f2 (incorrect) - This is an incorrect checksum (due to offloading or the way the capture is handled).
Sequence and Acknowledgment Numbers - Sequence number 137844:141531 and acknowledgment number 1, indicating the sequence of transmitted and acknowledged data.
Window Size - 16 - Indicates the available buffer space on the sender.
TCP Options - Includes timestamps (e.g., TS val 1049055748 ecr 2514290620).
Length - 3687 bytes of payload in the TCP segment.

Repeated Communication

Subsequent lines repeat similar exchanges:

Source and destination addresses switch, indicating responses from the client.
ACKs - For example, the client acknowledges the server's data with sequence 1, ack 141531.

Observations

Checksums - Several packets show "incorrect" checksums (e.g., cksum 0x61f2 (incorrect -> 0x5b5d)). This is often due to TCP checksum offloading by the network interface, where the hardware calculates the checksum, and it appears incorrect in captures.
Flags - Most packets have either the push [P.] or acknowledgment [.] flags, showing normal communication during a TCP session.

In Conclusion

This is a capture of a TCP session between two devices, where the server is sending large amounts of HTTPS data, and the client (your ThinkPad) is acknowledging it.
Large payloads are being transferred (e.g., length 3687 bytes), indicating ongoing data transmission.
The incorrect checksums are likely due to offloading, and not an issue with the data itself.

tcpdump Example