The Academy is free // the war room is optional
DAEMONCORE // ACADEMY
← FIELD NOTES

Breaking down packet anatomy for network analysts

2026.09.13//10 MIN READnetworkingwiresharkincident-responsedetection-engineering

// Understanding packet anatomy

Packets are the building blocks of network communication. To analyze network traffic effectively, you must first understand the components of a packet: headers and payloads. Each part serves a specific purpose, and knowing where to look can streamline your analysis and troubleshooting efforts.

Packet structure

A typical packet consists of several key components:

  • Headers: These contain metadata about the packet, such as source and destination IP addresses, protocol type, and other control information.
  • Payload: This is the actual data being transmitted, such as a segment of a file, a command, or an HTTP request.

#### Example packet structure

Let's visualize a simplified TCP packet:

+----------------+----------------+----------------+
|     Header 1   |     Header 2   |     Payload     |
+----------------+----------------+----------------+
|  TCP Header    |  IP Header     |  Data           |
+----------------+----------------+----------------+

Breaking down headers

#### IP Header The IP header includes the following fields:

  • Version: Indicates the IP version (IPv4 or IPv6).
  • Source IP: The IP address of the sender.
  • Destination IP: The IP address of the recipient.
  • Protocol: Indicates the encapsulated protocol (e.g., TCP, UDP).
  • Header Length: The length of the header in 32-bit words.

Here's an example of a snippet from an IP header:

Version | IHL | Type of Service | Total Length
-------------------------------------------------
4      | 5   | 0               |  40
  • Version: 4 indicates IPv4.
  • IHL: 5 indicates that there are 5 32-bit words in the header, or 20 bytes total.
  • Total Length: Indicates the entire length of the IP packet, header plus payload.

#### TCP Header The TCP header includes:

  • Source Port: The port on the sender's side.
  • Destination Port: The port on the receiver's side.
  • Sequence Number: Used for ordered delivery.
  • Acknowledgment Number: Used to confirm received packets.

Example TCP header snippet:

Source Port | Destination Port | Sequence Number
-------------------------------------------------
12345       | 80              | 1420001

Analyzing packet payloads

The payload is where the actual data resides. Depending on the protocol, the payload can contain different types of data. For example:

  • In an HTTP packet, the payload may contain the HTTP request or response body.
  • In a file transfer, it might contain file data.

#### Mistakes to avoid

  • Ignoring the headers: Many analysts focus solely on payload content. However, headers provide context crucial for understanding the flow of data and potential issues.
  • Overlooking packet size: A common mistake is neglecting to check the total packet size. Larger packets can indicate fragmentation issues, which may affect performance.

Where to look first

When analyzing packets, start with: 1. Source and Destination IPs: This helps you understand the traffic flow. 2. Protocol Type: Knowing whether it's TCP, UDP, or another protocol can dictate your next steps. 3. Flags in TCP headers: Flags such as SYN, ACK, or FIN provide insights into connection states. 4. Payload content: Inspect the payload for anomalies or significant data points relevant to your analysis.

Analyzing with Wireshark

Wireshark is a powerful tool for packet analysis. You can filter packets and inspect different layers easily. Here’s a basic filter to capture only HTTP traffic:

http

To view TCP details, utilize:

tcp.port == 80

This allows you to see all traffic to and from HTTP port 80, giving you a concentrated view of web traffic.

Wireshark's GUI makes it easy to drill down into specific packets. Clicking on a packet expands the details, showing you all headers and payloads in a friendly view. Remember to save your captures for later analysis.

Checklist for packet analysis

  • [ ] Examine the source and destination IPs.
  • [ ] Determine the protocol used.
  • [ ] Check for flags in the TCP header.
  • [ ] Analyze the payload for significant data.
  • [ ] Use filtering tools like Wireshark to hone in on specific traffic.

Defensive implications

Understanding packet structure not only aids in troubleshooting but also plays a role in security. Misconfigured headers can lead to vulnerabilities. For instance, an incorrect source IP in a packet can be indicative of IP spoofing, while unusual payload sizes may suggest data exfiltration or DDoS attacks. Stay vigilant about these indicators.

Conclusion

Packet analysis is foundational for network security and troubleshooting. By dissecting packets into headers and payloads, you can improve your understanding of network behavior and enhance your response strategies. The techniques discussed are applicable in a controlled environment, such as a disposable lab range you own.

Explore more about packet analysis and firewall methodologies in our Finding critical conversations with Wireshark and Developing a repeatable firewall ruleset review methodology.

--- // FIELDOPS REPORT AUTHORIZED BY: Bruce H. //