В университете задали задание: анализ осциллограммы с последующим анализом пакета. Осциллограмма это перехваченный аппаратно, с помощью осциллографа пакет ethernet II (DIX), также к ней шёл текстовый документ, в котором были написаны по порядку переходы. Я о его существовании не знал, поэтому сначала вручную расшифровывал осциллограмму. К слову я разобрал 2 пакета (остальные скину - работы однокурсников). [xcut] Статья так-же пригодится тем, кто анализирует пакеты различными перехватчиками, но про это написано очень и очень много) План:
-
Расшифровать осциллограмму
-
Выполнить преобразования
-
Расшифровать посылку Готовый вариант на примере которого идёт разбор — Для начала небольшое HowTO по разбору осциллограммы перехваченого пакета на нули и единицы(двоичный код): [image=http://stud.ashcherbakov.ru/uploads/_pages/34/oscillo.png oscillo.png]http://stud.ashcherbakov.ru/uploads/_pages/34/oscillo.png[/image]
-
Переход с высокого уровня("+") на низкий("-") через 0 это есть единичный бит (1)
Переход с "-" на "+" есть нулевой бит (0)
"0" - зелёная линия на картинке [img lowhightlevel.png]http://stud.ashcherbakov.ru/uploads/_pages/34/lowhightlevel.png[/img]
- Преамбула начинается с единичного бита и оканчивается двумя единицами. Если смотреть на преамбулу(большая картинка ранее), то видно, что там идет чередование 1 и 0
Расстояние по оси X между этими переходами примем за основное [img distance.png]http://stud.ashcherbakov.ru/uploads/_pages/34/distance.png[/img]
- Тогда как если расстояние выходит меньше основного, значит это служебный переход и он не считается за бит. Такой вариант как раз в следующем пункте
-
Если пошла единица, потом маленькое расстояние между след. переходом, то этот переход пропускаем и следующий значит опять будет единица. тоже самое и с нулем. [img repeatbeats.png]http://stud.ashcherbakov.ru/uploads/_pages/34/repeatbeats.png[/img] — Видео(4.4мб):
Тег video не поддерживается вашим браузером. Скачайте видео. — Пример правильно размеченной для записи 0и1 осциллограммы (точка снизу - 1, сверху 0)
Скачать 27true.png [color=red]Весит: 21MB![/color] [b]Выполнить преобразования[/b] — Когда будете переводить байты в шестнадцатиричную систему исчисления, то каждый байт надо будет перевернуть.Пример переворота: 01000110 > 01100010 Стоит пояснить, что под байтом тут подразумевается 8 бит, как мне кажется лучше использовать отдельный термин, что-бы избежать неоднозначности, а именно octet(октет) - Октет в информатике — 8 двоичных разрядов(битов)
![Скачать 27true.png [color=red]Весит: 21MB![/color]](http://stud.ashcherbakov.ru/uploads/_pages/34/27true.png){kind=link}
- Из википедииСлово «октет» часто употребляется при описании сетевых протоколов, так как они предназначены для взаимодействия компьютеров, имеющих не обязательно одинаковую платформу. В отличие от байта, который (в широком смысле) может быть равен 10, 12 и т. п. битам, октет всегда равен 8 битам. — Дабы исключить двусмысленность, а также из соображений благозвучия, во французском языке слово «октет» (octet) используется почти везде, где в русском или английском языках употребляется слово «байт».
Когда у нас будут октеты в стопочку(столбцом) можно перевести их в шестнадцетиричный вид, это удобно делать при помощи MS Excel(формула: =ДВ.В.ШЕСТН(ячейка;2) /OpenOffice(libreoffice) Calc (формула: =BIN2HEX(ячейка)). — [b]Расшифровать посылку[/b] — Имейте ввиду кадр Ethernet II: [img ethernetiidixframe.png]http://stud.ashcherbakov.ru/uploads/_pages/34/ethernetiidixframe.png[/img]
- Текстом
╔═══════╦═══════════╦═══════════════╦═══════════════╦═══════════════╦═════════════════════════╗
║ octet ║ 0-8 ║ 8-14(6) ║ 14-20(6) ║ (46..1500) ║ (4) ║
╠═══════╬═══════════╬═══════════════╬═══════════════╬═══════════════╬═════════════════════════╣
║ имя ║ преамбула ║ mac приёмника ║ mac источника ║ данные пакета ║ контрольная сумма CRC32 ║
╚═══════╩═══════════╩═══════════════╩═══════════════╩═══════════════╩═════════════════════════╝
— Если Вы уже перевели в Hex, тогда в начале у вас идут значения 55...55 и D5, 7 октетов 55 и 1 D5 - преамбула пример:
- таблица
╔══════════╦═════╗
║ BIN ║ HEX ║
╠══════════╬═════╣
║ 01010101 ║ 55 ║
╠══════════╬═════╣
║ 01010101 ║ 55 ║
╠══════════╬═════╣
║ 01010101 ║ 55 ║
╠══════════╬═════╣
║ 01010101 ║ 55 ║
╠══════════╬═════╣
║ 01010101 ║ 55 ║
╠══════════╬═════╣
║ 01010101 ║ 55 ║
╠══════════╬═════╣
║ 01010101 ║ 55 ║
╠══════════╬═════╣
║ 11010101 ║ D5 ║
╚══════════╩═════╝
— Следующие 6 октетов mac адрес приёмника. — Следующие 6 октетов mac адрес источника — И так мы на 21 октете(нумерация идёт с нуля). — С 21 по 22 в размере 2 октетов будет E-TYPE(ethernet type)
- Основные типы в HEX
+-----------+-----------------------------------------------------------------------------------------------+
| EtherType | Protocol |
+-----------+-----------------------------------------------------------------------------------------------+
| 0x0800 | Internet Protocol version 4 (IPv4) |
+-----------+-----------------------------------------------------------------------------------------------+
| 0x0806 | Address Resolution Protocol (ARP) |
+-----------+-----------------------------------------------------------------------------------------------+
| 0x0842 | Wake-on-LAN |
+-----------+-----------------------------------------------------------------------------------------------+
| 0x22F3 | IETF TRILL Protocol |
+-----------+-----------------------------------------------------------------------------------------------+
| 0x6003 | DECnet Phase IV |
+-----------+-----------------------------------------------------------------------------------------------+
| 0x8035 | Reverse Address Resolution Protocol |
+-----------+-----------------------------------------------------------------------------------------------+
| 0x809B | AppleTalk (Ethertalk) |
+-----------+-----------------------------------------------------------------------------------------------+
| 0x80F3 | AppleTalk Address Resolution Protocol (AARP) |
+-----------+-----------------------------------------------------------------------------------------------+
| 0x8100 | VLAN-tagged frame (IEEE 802.1Q) and Shortest Path Bridging IEEE 802.1aq |
+-----------+-----------------------------------------------------------------------------------------------+
| 0x8137 | IPX |
+-----------+-----------------------------------------------------------------------------------------------+
| 0x8204 | QNX Qnet |
+-----------+-----------------------------------------------------------------------------------------------+
| 0x86DD | Internet Protocol Version 6 (IPv6) |
+-----------+-----------------------------------------------------------------------------------------------+
| 0x8808 | Ethernet flow control |
+-----------+-----------------------------------------------------------------------------------------------+
| 0x8819 | CobraNet |
+-----------+-----------------------------------------------------------------------------------------------+
| 0x8847 | MPLS unicast |
+-----------+-----------------------------------------------------------------------------------------------+
| 0x8848 | MPLS multicast |
+-----------+-----------------------------------------------------------------------------------------------+
| 0x8863 | PPPoE Discovery Stage |
+-----------+-----------------------------------------------------------------------------------------------+
| 0x8864 | PPPoE Session Stage |
+-----------+-----------------------------------------------------------------------------------------------+
| 0x8870 | Jumbo Frames (proposed) |
+-----------+-----------------------------------------------------------------------------------------------+
| 0x887B | HomePlug 1.0 MME |
+-----------+-----------------------------------------------------------------------------------------------+
| 0x888E | EAP over LAN (IEEE 802.1X) |
+-----------+-----------------------------------------------------------------------------------------------+
| 0x8892 | PROFINET Protocol |
+-----------+-----------------------------------------------------------------------------------------------+
| 0x889A | HyperSCSI (SCSI over Ethernet) |
+-----------+-----------------------------------------------------------------------------------------------+
| 0x88A2 | ATA over Ethernet |
+-----------+-----------------------------------------------------------------------------------------------+
| 0x88A4 | EtherCAT Protocol |
+-----------+-----------------------------------------------------------------------------------------------+
| 0x88A8 | Provider Bridging (IEEE 802.1ad) & Shortest Path Bridging IEEE 802.1aq |
+-----------+-----------------------------------------------------------------------------------------------+
| 0x88AB | Ethernet Powerlink[citation needed] |
+-----------+-----------------------------------------------------------------------------------------------+
| 0x88CC | Link Layer Discovery Protocol (LLDP) |
+-----------+-----------------------------------------------------------------------------------------------+
| 0x88CD | SERCOS III |
+-----------+-----------------------------------------------------------------------------------------------+
| 0x88E1 | HomePlug AV MME[citation needed] |
+-----------+-----------------------------------------------------------------------------------------------+
| 0x88E3 | Media Redundancy Protocol (IEC62439-2) |
+-----------+-----------------------------------------------------------------------------------------------+
| 0x88E5 | MAC security (IEEE 802.1AE) |
+-----------+-----------------------------------------------------------------------------------------------+
| 0x88E7 | Provider Backbone Bridges (PBB) (IEEE 802.1ah) |
+-----------+-----------------------------------------------------------------------------------------------+
| 0x88F7 | Precision Time Protocol (PTP) over Ethernet (IEEE 1588) |
+-----------+-----------------------------------------------------------------------------------------------+
| 0x8902 | IEEE 802.1ag Connectivity Fault Management (CFM) Protocol / ITU-T Recommendation Y.1731 (OAM) |
+-----------+-----------------------------------------------------------------------------------------------+
| 0x8906 | Fibre Channel over Ethernet (FCoE) |
+-----------+-----------------------------------------------------------------------------------------------+
| 0x8914 | FCoE Initialization Protocol |
+-----------+-----------------------------------------------------------------------------------------------+
| 0x8915 | RDMA over Converged Ethernet (RoCE) |
+-----------+-----------------------------------------------------------------------------------------------+
| 0x892F | High-availability Seamless Redundancy (HSR) |
+-----------+-----------------------------------------------------------------------------------------------+
| 0x9000 | Ethernet Configuration Testing Protocol |
+-----------+-----------------------------------------------------------------------------------------------+
— В моём hex коде E-TYPE равен 08 00, значит IPV4. Гуглим структуру пакета IPV4 [img ipv4-header-frame.jpg]http://stud.ashcherbakov.ru/uploads/_pages/34/ipv4-header-frame.jpg[/img]
- Текстом:
+---------+-------+-------------------------------+-------------------------------------+---------------------------------------+---------------------------------------+
| Offsets | Octet | 0 | 1 | 2 | 3 |
+---------+-------+-------------------------------+-------------------------------------+---------------------------------------+---------------------------------------+
| Octet | Bit | 0 | 1 | 2 | 3 | 4 | 5 | 6 | 7 | 8 | 9 | 10 | 11 | 12 | 13 | 14 | 15 | 16 | 17 | 18 | 19 | 20 | 21 | 22 | 23 | 24 | 25 | 26 | 27 | 28 | 29 | 30 | 31 |
+---------+-------+---+---+---+---+---+---+---+---+---+---+----+----+----+----+----+----+----+----+----+----+----+----+----+----+----+----+----+----+----+----+----+----+
| 0 | 0 | Version | IHL | DSCP | ECN | Total Length |
+---------+-------+---------------+---------------+---------------------------+---------+-------------------------------------------------------------------------------+
| 4 | 32 | Identification | Flags | Fragment Offset |
+---------+-------+---------------------------------------------------------------------+--------------+----------------------------------------------------------------+
| 8 | 64 | Time To Live | Protocol | Header Checksum |
+---------+-------+-------------------------------+-------------------------------------+-------------------------------------------------------------------------------+
| 12 | 96 | Source IP Address |
+---------+-------+-----------------------------------------------------------------------------------------------------------------------------------------------------+
| 16 | 128 | Destination IP Address |
+---------+-------+-----------------------------------------------------------------------------------------------------------------------------------------------------+
| 20 | 160 | Options (if IHL > 5) | Padding |
+---------+-------+-------------------------------------------------------------------------------------------------------------+---------------------------------------+
— Останавливаться на всех полях не вижу смысла и так пост выходит достаточно объёмным, по возможности в конце статьи структурирую и выложу ссылки на соответствующие материалы для ознакомления. — Поле протокол
- список протоколов
+---------+-----------+-------------------------------------+---------------------------------------------------------------------------------------------+----------------------------------------------+
| Decimal | Hex | Keyword | Protocol | References |
+---------+-----------+-------------------------------------+---------------------------------------------------------------------------------------------+----------------------------------------------+
| 0 | 0x00 | HOPOPT | IPv6 Hop-by-Hop Option | RFC 2460 |
+---------+-----------+-------------------------------------+---------------------------------------------------------------------------------------------+----------------------------------------------+
| 1 | 0x01 | ICMP | Internet Control Message Protocol | RFC 792 |
+---------+-----------+-------------------------------------+---------------------------------------------------------------------------------------------+----------------------------------------------+
| 2 | 0x02 | IGMP | Internet Group Management Protocol | RFC 1112 |
+---------+-----------+-------------------------------------+---------------------------------------------------------------------------------------------+----------------------------------------------+
| 3 | 0x03 | GGP | Gateway-to-Gateway Protocol | RFC 823 |
+---------+-----------+-------------------------------------+---------------------------------------------------------------------------------------------+----------------------------------------------+
| 4 | 0x04 | IP-in-IP | IP in IP (encapsulation) | RFC 2003 |
+---------+-----------+-------------------------------------+---------------------------------------------------------------------------------------------+----------------------------------------------+
| 5 | 0x05 | ST | Internet Stream Protocol | RFC 1190, RFC 1819 |
+---------+-----------+-------------------------------------+---------------------------------------------------------------------------------------------+----------------------------------------------+
| 6 | 0x06 | TCP | Transmission Control Protocol | RFC 793 |
+---------+-----------+-------------------------------------+---------------------------------------------------------------------------------------------+----------------------------------------------+
| 7 | 0x07 | CBT | Core-based trees | RFC 2189 |
+---------+-----------+-------------------------------------+---------------------------------------------------------------------------------------------+----------------------------------------------+
| 8 | 0x08 | EGP | Exterior Gateway Protocol | RFC 888 |
+---------+-----------+-------------------------------------+---------------------------------------------------------------------------------------------+----------------------------------------------+
| 9 | 0x09 | IGP | Interior Gateway Protocol (any private interior gateway (used by Cisco for their IGRP)) | |
+---------+-----------+-------------------------------------+---------------------------------------------------------------------------------------------+----------------------------------------------+
| 10 | 0x0A | BBN-RCC-MON | BBN RCC Monitoring | |
+---------+-----------+-------------------------------------+---------------------------------------------------------------------------------------------+----------------------------------------------+
| 11 | 0x0B | NVP-II | Network Voice Protocol | RFC 741 |
+---------+-----------+-------------------------------------+---------------------------------------------------------------------------------------------+----------------------------------------------+
| 12 | 0x0C | PUP | Xerox PUP | |
+---------+-----------+-------------------------------------+---------------------------------------------------------------------------------------------+----------------------------------------------+
| 13 | 0x0D | ARGUS | ARGUS | |
+---------+-----------+-------------------------------------+---------------------------------------------------------------------------------------------+----------------------------------------------+
| 14 | 0x0E | EMCON | EMCON | |
+---------+-----------+-------------------------------------+---------------------------------------------------------------------------------------------+----------------------------------------------+
| 15 | 0x0F | XNET | Cross Net Debugger | IEN 158 |
+---------+-----------+-------------------------------------+---------------------------------------------------------------------------------------------+----------------------------------------------+
| 16 | 0x10 | CHAOS | Chaos | |
+---------+-----------+-------------------------------------+---------------------------------------------------------------------------------------------+----------------------------------------------+
| 17 | 0x11 | UDP | User Datagram Protocol | RFC 768 |
+---------+-----------+-------------------------------------+---------------------------------------------------------------------------------------------+----------------------------------------------+
| 18 | 0x12 | MUX | Multiplexing | IEN 90 |
+---------+-----------+-------------------------------------+---------------------------------------------------------------------------------------------+----------------------------------------------+
| 19 | 0x13 | DCN-MEAS | DCN Measurement Subsystems | |
+---------+-----------+-------------------------------------+---------------------------------------------------------------------------------------------+----------------------------------------------+
| 20 | 0x14 | HMP | Host Monitoring Protocol | RFC 869 |
+---------+-----------+-------------------------------------+---------------------------------------------------------------------------------------------+----------------------------------------------+
| 21 | 0x15 | PRM | Packet Radio Measurement | |
+---------+-----------+-------------------------------------+---------------------------------------------------------------------------------------------+----------------------------------------------+
| 22 | 0x16 | XNS-IDP | XEROX NS IDP | |
+---------+-----------+-------------------------------------+---------------------------------------------------------------------------------------------+----------------------------------------------+
| 23 | 0x17 | TRUNK-1 | Trunk-1 | |
+---------+-----------+-------------------------------------+---------------------------------------------------------------------------------------------+----------------------------------------------+
| 24 | 0x18 | TRUNK-2 | Trunk-2 | |
+---------+-----------+-------------------------------------+---------------------------------------------------------------------------------------------+----------------------------------------------+
| 25 | 0x19 | LEAF-1 | Leaf-1 | |
+---------+-----------+-------------------------------------+---------------------------------------------------------------------------------------------+----------------------------------------------+
| 26 | 0x1A | LEAF-2 | Leaf-2 | |
+---------+-----------+-------------------------------------+---------------------------------------------------------------------------------------------+----------------------------------------------+
| 27 | 0x1B | RDP | Reliable Datagram Protocol | RFC 908 |
+---------+-----------+-------------------------------------+---------------------------------------------------------------------------------------------+----------------------------------------------+
| 28 | 0x1C | IRTP | Internet Reliable Transaction Protocol | RFC 938 |
+---------+-----------+-------------------------------------+---------------------------------------------------------------------------------------------+----------------------------------------------+
| 29 | 0x1D | ISO-TP4 | ISO Transport Protocol Class 4 | RFC 905 |
+---------+-----------+-------------------------------------+---------------------------------------------------------------------------------------------+----------------------------------------------+
| 30 | 0x1E | NETBLT | Bulk Data Transfer Protocol | RFC 998 |
+---------+-----------+-------------------------------------+---------------------------------------------------------------------------------------------+----------------------------------------------+
| 31 | 0x1F | MFE-NSP | MFE Network Services Protocol | |
+---------+-----------+-------------------------------------+---------------------------------------------------------------------------------------------+----------------------------------------------+
| 32 | 0x20 | MERIT-INP | MERIT Internodal Protocol | |
+---------+-----------+-------------------------------------+---------------------------------------------------------------------------------------------+----------------------------------------------+
| 33 | 0x21 | DCCP | Datagram Congestion Control Protocol | RFC 4340 |
+---------+-----------+-------------------------------------+---------------------------------------------------------------------------------------------+----------------------------------------------+
| 34 | 0x22 | 3PC | Third Party Connect Protocol | |
+---------+-----------+-------------------------------------+---------------------------------------------------------------------------------------------+----------------------------------------------+
| 35 | 0x23 | IDPR | Inter-Domain Policy Routing Protocol | RFC 1479 |
+---------+-----------+-------------------------------------+---------------------------------------------------------------------------------------------+----------------------------------------------+
| 36 | 0x24 | XTP | Xpress Transport Protocol | |
+---------+-----------+-------------------------------------+---------------------------------------------------------------------------------------------+----------------------------------------------+
| 37 | 0x25 | DDP | Datagram Delivery Protocol | |
+---------+-----------+-------------------------------------+---------------------------------------------------------------------------------------------+----------------------------------------------+
| 38 | 0x26 | IDPR-CMTP | IDPR Control Message Transport Protocol | |
+---------+-----------+-------------------------------------+---------------------------------------------------------------------------------------------+----------------------------------------------+
| 39 | 0x27 | TP++ | TP++ Transport Protocol | |
+---------+-----------+-------------------------------------+---------------------------------------------------------------------------------------------+----------------------------------------------+
| 40 | 0x28 | IL | IL Transport Protocol | |
+---------+-----------+-------------------------------------+---------------------------------------------------------------------------------------------+----------------------------------------------+
| 41 | 0x29 | IPv6 | IPv6 Encapsulation | RFC 2473 |
+---------+-----------+-------------------------------------+---------------------------------------------------------------------------------------------+----------------------------------------------+
| 42 | 0x2A | SDRP | Source Demand Routing Protocol | RFC 1940 |
+---------+-----------+-------------------------------------+---------------------------------------------------------------------------------------------+----------------------------------------------+
| 43 | 0x2B | IPv6-Route | Routing Header for IPv6 | RFC 2460 |
+---------+-----------+-------------------------------------+---------------------------------------------------------------------------------------------+----------------------------------------------+
| 44 | 0x2C | IPv6-Frag | Fragment Header for IPv6 | RFC 2460 |
+---------+-----------+-------------------------------------+---------------------------------------------------------------------------------------------+----------------------------------------------+
| 45 | 0x2D | IDRP | Inter-Domain Routing Protocol | |
+---------+-----------+-------------------------------------+---------------------------------------------------------------------------------------------+----------------------------------------------+
| 46 | 0x2E | RSVP | Resource Reservation Protocol | RFC 2205 |
+---------+-----------+-------------------------------------+---------------------------------------------------------------------------------------------+----------------------------------------------+
| 47 | 0x2F | GRE | Generic Routing Encapsulation | RFC 2784, RFC 2890 |
+---------+-----------+-------------------------------------+---------------------------------------------------------------------------------------------+----------------------------------------------+
| 48 | 0x30 | MHRP | Mobile Host Routing Protocol | |
+---------+-----------+-------------------------------------+---------------------------------------------------------------------------------------------+----------------------------------------------+
| 49 | 0x31 | BNA | BNA | |
+---------+-----------+-------------------------------------+---------------------------------------------------------------------------------------------+----------------------------------------------+
| 50 | 0x32 | ESP | Encapsulating Security Payload | RFC 4303 |
+---------+-----------+-------------------------------------+---------------------------------------------------------------------------------------------+----------------------------------------------+
| 51 | 0x33 | AH | Authentication Header | RFC 4302 |
+---------+-----------+-------------------------------------+---------------------------------------------------------------------------------------------+----------------------------------------------+
| 52 | 0x34 | I-NLSP | Integrated Net Layer Security Protocol | TUBA |
+---------+-----------+-------------------------------------+---------------------------------------------------------------------------------------------+----------------------------------------------+
| 53 | 0x35 | SWIPE | SwIPe | IP with Encryption |
+---------+-----------+-------------------------------------+---------------------------------------------------------------------------------------------+----------------------------------------------+
| 54 | 0x36 | NARP | NBMA Address Resolution Protocol | RFC 1735 |
+---------+-----------+-------------------------------------+---------------------------------------------------------------------------------------------+----------------------------------------------+
| 55 | 0x37 | MOBILE | IP Mobility (Min Encap) | RFC 2004 |
+---------+-----------+-------------------------------------+---------------------------------------------------------------------------------------------+----------------------------------------------+
| 56 | 0x38 | TLSP | Transport Layer Security Protocol (using Kryptonet key management) | |
+---------+-----------+-------------------------------------+---------------------------------------------------------------------------------------------+----------------------------------------------+
| 57 | 0x39 | SKIP | Simple Key-Management for Internet Protocol | RFC 2356 |
+---------+-----------+-------------------------------------+---------------------------------------------------------------------------------------------+----------------------------------------------+
| 58 | 0x3A | IPv6-ICMP | ICMP for IPv6 | RFC 4443, RFC 4884 |
+---------+-----------+-------------------------------------+---------------------------------------------------------------------------------------------+----------------------------------------------+
| 59 | 0x3B | IPv6-NoNxt | No Next Header for IPv6 | RFC 2460 |
+---------+-----------+-------------------------------------+---------------------------------------------------------------------------------------------+----------------------------------------------+
| 60 | 0x3C | IPv6-Opts | Destination Options for IPv6 | RFC 2460 |
+---------+-----------+-------------------------------------+---------------------------------------------------------------------------------------------+----------------------------------------------+
| 61 | 0x3D | | Any host internal protocol | |
+---------+-----------+-------------------------------------+---------------------------------------------------------------------------------------------+----------------------------------------------+
| 62 | 0x3E | CFTP | CFTP | |
+---------+-----------+-------------------------------------+---------------------------------------------------------------------------------------------+----------------------------------------------+
| 63 | 0x3F | | Any local network | |
+---------+-----------+-------------------------------------+---------------------------------------------------------------------------------------------+----------------------------------------------+
| 64 | 0x40 | SAT-EXPAK | SATNET and Backroom EXPAK | |
+---------+-----------+-------------------------------------+---------------------------------------------------------------------------------------------+----------------------------------------------+
| 65 | 0x41 | KRYPTOLAN | Kryptolan | |
+---------+-----------+-------------------------------------+---------------------------------------------------------------------------------------------+----------------------------------------------+
| 66 | 0x42 | RVD | MIT Remote Virtual Disk Protocol | |
+---------+-----------+-------------------------------------+---------------------------------------------------------------------------------------------+----------------------------------------------+
| 67 | 0x43 | IPPC | Internet Pluribus Packet Core | |
+---------+-----------+-------------------------------------+---------------------------------------------------------------------------------------------+----------------------------------------------+
| 68 | 0x44 | | Any distributed file system | |
+---------+-----------+-------------------------------------+---------------------------------------------------------------------------------------------+----------------------------------------------+
| 69 | 0x45 | SAT-MON | SATNET Monitoring | |
+---------+-----------+-------------------------------------+---------------------------------------------------------------------------------------------+----------------------------------------------+
| 70 | 0x46 | VISA | VISA Protocol | |
+---------+-----------+-------------------------------------+---------------------------------------------------------------------------------------------+----------------------------------------------+
| 71 | 0x47 | IPCU | Internet Packet Core Utility | |
+---------+-----------+-------------------------------------+---------------------------------------------------------------------------------------------+----------------------------------------------+
| 72 | 0x48 | CPNX | Computer Protocol Network Executive | |
+---------+-----------+-------------------------------------+---------------------------------------------------------------------------------------------+----------------------------------------------+
| 73 | 0x49 | CPHB | Computer Protocol Heart Beat | |
+---------+-----------+-------------------------------------+---------------------------------------------------------------------------------------------+----------------------------------------------+
| 74 | 0x4A | WSN | Wang Span Network | |
+---------+-----------+-------------------------------------+---------------------------------------------------------------------------------------------+----------------------------------------------+
| 75 | 0x4B | PVP | Packet Video Protocol | |
+---------+-----------+-------------------------------------+---------------------------------------------------------------------------------------------+----------------------------------------------+
| 76 | 0x4C | BR-SAT-MON | Backroom SATNET Monitoring | |
+---------+-----------+-------------------------------------+---------------------------------------------------------------------------------------------+----------------------------------------------+
| 77 | 0x4D | SUN-ND | SUN ND PROTOCOL-Temporary | |
+---------+-----------+-------------------------------------+---------------------------------------------------------------------------------------------+----------------------------------------------+
| 78 | 0x4E | WB-MON | WIDEBAND Monitoring | |
+---------+-----------+-------------------------------------+---------------------------------------------------------------------------------------------+----------------------------------------------+
| 79 | 0x4F | WB-EXPAK | WIDEBAND EXPAK | |
+---------+-----------+-------------------------------------+---------------------------------------------------------------------------------------------+----------------------------------------------+
| 80 | 0x50 | ISO-IP | International Organization for Standardization Internet Protocol | |
+---------+-----------+-------------------------------------+---------------------------------------------------------------------------------------------+----------------------------------------------+
| 81 | 0x51 | VMTP | Versatile Message Transaction Protocol | RFC 1045 |
+---------+-----------+-------------------------------------+---------------------------------------------------------------------------------------------+----------------------------------------------+
| 82 | 0x52 | SECURE-VMTP | Secure Versatile Message Transaction Protocol | RFC 1045 |
+---------+-----------+-------------------------------------+---------------------------------------------------------------------------------------------+----------------------------------------------+
| 83 | 0x53 | VINES | VINES | |
+---------+-----------+-------------------------------------+---------------------------------------------------------------------------------------------+----------------------------------------------+
| 84 | 0x54 | TTP | TTP | |
+---------+-----------+-------------------------------------+---------------------------------------------------------------------------------------------+----------------------------------------------+
| 84 | 0x54 | IPTM | Internet Protocol Traffic Manager | |
+---------+-----------+-------------------------------------+---------------------------------------------------------------------------------------------+----------------------------------------------+
| 85 | 0x55 | NSFNET-IGP | NSFNET-IGP | |
+---------+-----------+-------------------------------------+---------------------------------------------------------------------------------------------+----------------------------------------------+
| 86 | 0x56 | DGP | Dissimilar Gateway Protocol | |
+---------+-----------+-------------------------------------+---------------------------------------------------------------------------------------------+----------------------------------------------+
| 87 | 0x57 | TCF | TCF | |
+---------+-----------+-------------------------------------+---------------------------------------------------------------------------------------------+----------------------------------------------+
| 88 | 0x58 | EIGRP | EIGRP | |
+---------+-----------+-------------------------------------+---------------------------------------------------------------------------------------------+----------------------------------------------+
| 89 | 0x59 | OSPF | Open Shortest Path First | RFC 1583 |
+---------+-----------+-------------------------------------+---------------------------------------------------------------------------------------------+----------------------------------------------+
| 90 | 0x5A | Sprite-RPC | Sprite RPC Protocol | |
+---------+-----------+-------------------------------------+---------------------------------------------------------------------------------------------+----------------------------------------------+
| 91 | 0x5B | LARP | Locus Address Resolution Protocol | |
+---------+-----------+-------------------------------------+---------------------------------------------------------------------------------------------+----------------------------------------------+
| 92 | 0x5C | MTP | Multicast Transport Protocol | |
+---------+-----------+-------------------------------------+---------------------------------------------------------------------------------------------+----------------------------------------------+
| 93 | 0x5D | AX.25 | AX.25 | |
+---------+-----------+-------------------------------------+---------------------------------------------------------------------------------------------+----------------------------------------------+
| 94 | 0x5E | IPIP | IP-within-IP Encapsulation Protocol | RFC 2003 |
+---------+-----------+-------------------------------------+---------------------------------------------------------------------------------------------+----------------------------------------------+
| 95 | 0x5F | MICP | Mobile Internetworking Control Protocol | |
+---------+-----------+-------------------------------------+---------------------------------------------------------------------------------------------+----------------------------------------------+
| 96 | 0x60 | SCC-SP | Semaphore Communications Sec. Pro | |
+---------+-----------+-------------------------------------+---------------------------------------------------------------------------------------------+----------------------------------------------+
| 97 | 0x61 | ETHERIP | Ethernet-within-IP Encapsulation | RFC 3378 |
+---------+-----------+-------------------------------------+---------------------------------------------------------------------------------------------+----------------------------------------------+
| 98 | 0x62 | ENCAP | Encapsulation Header | RFC 1241 |
+---------+-----------+-------------------------------------+---------------------------------------------------------------------------------------------+----------------------------------------------+
| 99 | 0x63 | | Any private encryption scheme | |
+---------+-----------+-------------------------------------+---------------------------------------------------------------------------------------------+----------------------------------------------+
| 100 | 0x64 | GMTP | GMTP | |
+---------+-----------+-------------------------------------+---------------------------------------------------------------------------------------------+----------------------------------------------+
| 101 | 0x65 | IFMP | Ipsilon Flow Management Protocol | |
+---------+-----------+-------------------------------------+---------------------------------------------------------------------------------------------+----------------------------------------------+
| 102 | 0x66 | PNNI | PNNI over IP | |
+---------+-----------+-------------------------------------+---------------------------------------------------------------------------------------------+----------------------------------------------+
| 103 | 0x67 | PIM | Protocol Independent Multicast | |
+---------+-----------+-------------------------------------+---------------------------------------------------------------------------------------------+----------------------------------------------+
| 104 | 0x68 | ARIS | IBM's ARIS (Aggregate Route IP Switching) Protocol | |
+---------+-----------+-------------------------------------+---------------------------------------------------------------------------------------------+----------------------------------------------+
| 105 | 0x69 | SCPS | SCPS (Space Communications Protocol Standards) | SCPS-TP[1] |
+---------+-----------+-------------------------------------+---------------------------------------------------------------------------------------------+----------------------------------------------+
| 106 | 0x6A | QNX | QNX | |
+---------+-----------+-------------------------------------+---------------------------------------------------------------------------------------------+----------------------------------------------+
| 107 | 0x6B | A/N | Active Networks | |
+---------+-----------+-------------------------------------+---------------------------------------------------------------------------------------------+----------------------------------------------+
| 108 | 0x6C | IPComp | IP Payload Compression Protocol | RFC 3173 |
+---------+-----------+-------------------------------------+---------------------------------------------------------------------------------------------+----------------------------------------------+
| 109 | 0x6D | SNP | Sitara Networks Protocol | |
+---------+-----------+-------------------------------------+---------------------------------------------------------------------------------------------+----------------------------------------------+
| 110 | 0x6E | Compaq-Peer | Compaq Peer Protocol | |
+---------+-----------+-------------------------------------+---------------------------------------------------------------------------------------------+----------------------------------------------+
| 111 | 0x6F | IPX-in-IP | IPX in IP | |
+---------+-----------+-------------------------------------+---------------------------------------------------------------------------------------------+----------------------------------------------+
| 112 | 0x70 | VRRP | Virtual Router Redundancy Protocol, Common Address Redundancy Protocol (not IANA assigned) | VRRP:RFC 3768 |
+---------+-----------+-------------------------------------+---------------------------------------------------------------------------------------------+----------------------------------------------+
| 113 | 0x71 | PGM | PGM Reliable Transport Protocol | RFC 3208 |
+---------+-----------+-------------------------------------+---------------------------------------------------------------------------------------------+----------------------------------------------+
| 114 | 0x72 | | Any 0-hop protocol | |
+---------+-----------+-------------------------------------+---------------------------------------------------------------------------------------------+----------------------------------------------+
| 115 | 0x73 | L2TP | Layer Two Tunneling Protocol Version 3 | RFC 3931 |
+---------+-----------+-------------------------------------+---------------------------------------------------------------------------------------------+----------------------------------------------+
| 116 | 0x74 | DDX | D-II Data Exchange (DDX) | |
+---------+-----------+-------------------------------------+---------------------------------------------------------------------------------------------+----------------------------------------------+
| 117 | 0x75 | IATP | Interactive Agent Transfer Protocol | |
+---------+-----------+-------------------------------------+---------------------------------------------------------------------------------------------+----------------------------------------------+
| 118 | 0x76 | STP | Schedule Transfer Protocol | |
+---------+-----------+-------------------------------------+---------------------------------------------------------------------------------------------+----------------------------------------------+
| 119 | 0x77 | SRP | SpectraLink Radio Protocol | |
+---------+-----------+-------------------------------------+---------------------------------------------------------------------------------------------+----------------------------------------------+
| 120 | 0x78 | UTI | Universal Transport Interface Protocol | |
+---------+-----------+-------------------------------------+---------------------------------------------------------------------------------------------+----------------------------------------------+
| 121 | 0x79 | SMP | Simple Message Protocol | |
+---------+-----------+-------------------------------------+---------------------------------------------------------------------------------------------+----------------------------------------------+
| 122 | 0x7A | SM | Simple Multicast Protocol | draft-perlman-simple-multicast-03 |
+---------+-----------+-------------------------------------+---------------------------------------------------------------------------------------------+----------------------------------------------+
| 123 | 0x7B | PTP | Performance Transparency Protocol | |
+---------+-----------+-------------------------------------+---------------------------------------------------------------------------------------------+----------------------------------------------+
| 124 | 0x7C | IS-IS over IPv4 | Intermediate System to Intermediate System (IS-IS) Protocol over IPv4 | RFC 1142 and RFC 1195 |
+---------+-----------+-------------------------------------+---------------------------------------------------------------------------------------------+----------------------------------------------+
| 125 | 0x7D | FIRE | Flexible Intra-AS Routing Environment | |
+---------+-----------+-------------------------------------+---------------------------------------------------------------------------------------------+----------------------------------------------+
| 126 | 0x7E | CRTP | Combat Radio Transport Protocol | |
+---------+-----------+-------------------------------------+---------------------------------------------------------------------------------------------+----------------------------------------------+
| 127 | 0x7F | CRUDP | Combat Radio User Datagram | |
+---------+-----------+-------------------------------------+---------------------------------------------------------------------------------------------+----------------------------------------------+
| 128 | 0x80 | SSCOPMCE | Service-Specific Connection-Oriented Protocol in a Multilink and Connectionless Environment | ITU-T Q.2111 (1999) |
+---------+-----------+-------------------------------------+---------------------------------------------------------------------------------------------+----------------------------------------------+
| 129 | 0x81 | IPLT | | |
+---------+-----------+-------------------------------------+---------------------------------------------------------------------------------------------+----------------------------------------------+
| 130 | 0x82 | SPS | Secure Packet Shield | |
+---------+-----------+-------------------------------------+---------------------------------------------------------------------------------------------+----------------------------------------------+
| 131 | 0x83 | PIPE | Private IP Encapsulation within IP | Expired I-D draft-petri-mobileip-pipe-00.txt |
+---------+-----------+-------------------------------------+---------------------------------------------------------------------------------------------+----------------------------------------------+
| 132 | 0x84 | SCTP | Stream Control Transmission Protocol | |
+---------+-----------+-------------------------------------+---------------------------------------------------------------------------------------------+----------------------------------------------+
| 133 | 0x85 | FC | Fibre Channel | |
+---------+-----------+-------------------------------------+---------------------------------------------------------------------------------------------+----------------------------------------------+
| 134 | 0x86 | RSVP-E2E-IGNORE | Reservation Protocol (RSVP) End-to-End Ignore | RFC 3175 |
+---------+-----------+-------------------------------------+---------------------------------------------------------------------------------------------+----------------------------------------------+
| 135 | 0x87 | Mobility Header | Mobility Extension Header for IPv6 | RFC 6275 |
+---------+-----------+-------------------------------------+---------------------------------------------------------------------------------------------+----------------------------------------------+
| 136 | 0x88 | UDPLite | Lightweight User Datagram Protocol | RFC 3828 |
+---------+-----------+-------------------------------------+---------------------------------------------------------------------------------------------+----------------------------------------------+
| 137 | 0x89 | MPLS-in-IP | Multiprotocol Label Switching Encapsulated in IP | RFC 4023 |
+---------+-----------+-------------------------------------+---------------------------------------------------------------------------------------------+----------------------------------------------+
| 138 | 0x8A | manet | MANET Protocols | RFC 5498 |
+---------+-----------+-------------------------------------+---------------------------------------------------------------------------------------------+----------------------------------------------+
| 139 | 0x8B | HIP | Host Identity Protocol | RFC 5201 |
+---------+-----------+-------------------------------------+---------------------------------------------------------------------------------------------+----------------------------------------------+
| 140 | 0x8C | Shim6 | Site Multihoming by IPv6 Intermediation | RFC 5533 |
+---------+-----------+-------------------------------------+---------------------------------------------------------------------------------------------+----------------------------------------------+
| 141 | 0x8D | WESP | Wrapped Encapsulating Security Payload | RFC 5840 |
+---------+-----------+-------------------------------------+---------------------------------------------------------------------------------------------+----------------------------------------------+
| 142 | 0x8E | ROHC | Robust Header Compression | RFC 5856 |
+---------+-----------+-------------------------------------+---------------------------------------------------------------------------------------------+----------------------------------------------+
| 143-252 | 0x8F-0xFC | UNASSIGNED | | |
+---------+-----------+-------------------------------------+---------------------------------------------------------------------------------------------+----------------------------------------------+
| 253-254 | 0xFD-0xFE | Use for experimentation and testing | RFC 3692 | |
+---------+-----------+-------------------------------------+---------------------------------------------------------------------------------------------+----------------------------------------------+
| 255 | 0xFF | Reserved. | | |
+---------+-----------+-------------------------------------+---------------------------------------------------------------------------------------------+----------------------------------------------+
— Есть зарезервированные в стандарте IP адреса/диапазоны, желательно их иметь перед глазами, что-бы по возможности сразу определить назначение и в контексте этого осуществлять дальнейший анализ.
-
Список зарезервированных IP адресов
+-----------------+------------------------------------------------+-----------+ | Range | Description | Reference | +-----------------+------------------------------------------------+-----------+ | 0.0.0.0/8 | Current network (only valid as source address) | RFC 6890 | +-----------------+------------------------------------------------+-----------+ | 10.0.0.0/8 | Private network | RFC 1918 | +-----------------+------------------------------------------------+-----------+ | 100.64.0.0/10 | Shared Address Space | RFC 6598 | +-----------------+------------------------------------------------+-----------+ | 127.0.0.0/8 | Loopback | RFC 6890 | +-----------------+------------------------------------------------+-----------+ | 169.254.0.0/16 | Link-local | RFC 3927 | +-----------------+------------------------------------------------+-----------+ | 172.16.0.0/12 | Private network | RFC 1918 | +-----------------+------------------------------------------------+-----------+ | 192.0.0.0/24 | IETF Protocol Assignments | RFC 6890 | +-----------------+------------------------------------------------+-----------+ | 192.0.2.0/24 | TEST-NET-1, documentation and examples | RFC 5737 | +-----------------+------------------------------------------------+-----------+ | 192.88.99.0/24 | IPv6 to IPv4 relay | RFC 3068 | +-----------------+------------------------------------------------+-----------+ | 192.168.0.0/16 | Private network | RFC 1918 | +-----------------+------------------------------------------------+-----------+ | 198.18.0.0/15 | Network benchmark tests | RFC 2544 | +-----------------+------------------------------------------------+-----------+ | 198.51.100.0/24 | TEST-NET-2, documentation and examples | RFC 5737 | +-----------------+------------------------------------------------+-----------+ | 203.0.113.0/24 | TEST-NET-3, documentation and examples | RFC 5737 | +-----------------+------------------------------------------------+-----------+ | 224.0.0.0/4 | IP multicast (former Class D network) | RFC 5771 | +-----------------+------------------------------------------------+-----------+ | 240.0.0.0/4 | Reserved (former Class E network) | RFC 1700 | +-----------------+------------------------------------------------+-----------+ | 255.255.255.255 | Broadcast | RFC 919 | +-----------------+------------------------------------------------+-----------+
И так, когда расшифрован заголовок IPv4 необходимо изучить что за протокол вложен в него(данные IPv4). К слову многое в мире информатики представляет из себя матрёшку.
— HEX: 0x11 DEC: 17 это протокол UDP, заголовок которого выглядит следующим образом:
[img mjb-udp-header-800x264.png]http://stud.ashcherbakov.ru/uploads/_pages/34/mjb-udp-header-800x264.png[/img]
* Текстом
+------------------------------------------------------------------------------+ | UDP заголовок | +------------------------------------------------------------------------------+ | Октет | 1 | 2 | 3 | 4 | +--------+----------------+---------------+------------------+-----------------+ | Биты | 0 - 15 | 16 - 31 | +--------+--------------------------------+------------------------------------+ | 0-31 | Порт отправителя (Source port) | Порт получателя (Destination port) | +--------+--------------------------------+------------------------------------+ | 32-63 | Длина датаграммы (Length) | Контрольная сумма (Checksum) | +--------+--------------------------------+------------------------------------+ | 64-... | Данные (Data) | +--------+---------------------------------------------------------------------+
По порту получателя/отправителя можно узнать для кого или от кого поступила посылка и соответственно предположить что внутри. В моём случае характерным оказался порт получателя равный 69, порт отправителя же 32920, это один из свободных портов, что система может выделять под нужды приложений на своё усмотрение. Порт 69 это протокол передачи данных tftp(Trivial File Transfer Protocol)
* Заголовок tftp следующий:
+------------------------+----------------+---------------------+----------------+---------------------+--------------------+ | 0x01/0x02 (тип пакета) | Имя файла | 0x00 (конец строки) | Режим передачи | 0x00 (конец строки) | Опции… (если есть) | +------------------------+----------------+---------------------+----------------+---------------------+--------------------+ | 2 байта | строка в ASCII | 1 байт | строка в ASCII | 1 байт | См. «Опции» | +------------------------+----------------+---------------------+----------------+---------------------+--------------------+
* Типы пакета
— Read Request (RRQ, #1) — запрос на чтение файла.
— Write Request (WRQ, #2) — запрос на запись файла.
— Data (DATA, #3) — данные, передаваемые через TFTP.
— Acknowledgment (ACK, #4) — подтверждение пакета.
— Error (ERR, #5) — ошибка.
— Error2 (ERR2, #6) — ошибка2.
* В TFTP существует 2 режима передачи:
— netascii — файл перед передачей перекодируется в ASCII.
— octet — файл передается без изменений.
— tftp
<a href = "https://ru.wikipedia.org/wiki/TFTP">tftp на wikipedia</a>
— udp
<a href = "http://rfc2.ru/2544.rfc/28">Перевод стандарта RFC 2544</a>
— Всякого рода переводы из системы в систему, когда поле состоит из двух октетов и необходимо получить из него десятичное значение лучше использовать Hex2Dec
— <a href ="http://www.binaryhexconverter.com/hex-to-decimal-converter">Hex2dec</a>
— <a href ="http://www.rapidtables.com/convert/number/hex-to-ascii.htm">Hex2ANSII</a>
— <a href ="http://www.epochconverter.com/epoch/unix-hex-timestamp.php">Hex2time</a>
— <a href ="https://disk.yandex.ru/client/disk/stud.ashcherbakov.ru/Ethernet%20II">Дополнительные материалы</a>
— <a href ="https://yadi.sk/d/PUUAxdB4ncqRi">Остальные варианты для самостоятельного разбора</a>
— <a href = "https://yadi.sk/i/wSrfYF8FncpP9">Готовый правильный вариант 25</a>