Recall the HEx
Before analyse the packet in the wireshark, we must pick the skill set – hex number.
1 hex takes 4 bits length, so 2 hex takes 8 bits length, which is 1 byte length. This is also why in wireshark, they group them two by two, making it easier to count the number of bytes.
Recall that Ethernet Frame header contains 6 bytes Destination MAC address, 6 Bytes Source MAC address, 2 Bytes EtherType, 14 bytes total.
Let’s take a wireshark capture as a example:
There are 14 groups of hex number with group size of two, which representing 14 bytes Ethernet Frame length.
Recall the IP header is 20 Bytes.
Also take this picture as example,
TTL: different OS has different length, we can also use this to guess the OS type. The mapping shown below:
|Operating System||Decimal TTL||Hex TTL|
Protocol: See below for the mapping:
|Description||Decimal Value||Hex Value|