TCP Retransmission, Reordering, or a Capture Artifact?
Compare controlled loss, reordering, and one filtered capture frame. Use both endpoint traces and queue evidence before diagnosing TCP loss.
Packet Analysis
Reading what actually crossed the wire. Articles tagged Packet Analysis cover capture points, filters, and decoding protocol exchanges frame by frame.
Latest posts — page 2
tc netem: Reproduce Delay, Loss, Jitter, and Reordering
Add one impairment at a time to an isolated Linux path. Compare ping results, queue counters, and packet arrival order, then verify recovery.
TCP Three-Way Handshake and Teardown, Captured
The three-way handshake is the first thing anyone learns about TCP and the last thing most people actually look at. SYN, SYN-ACK, ACK is easy to draw. What is harder, and far more useful, is reading a real
DHCP DORA Explained with a Real Packet Capture
Discover, Offer, Request, Ack. You can recite DORA in your sleep, and it still will not help you the day a client comes up with a 169.254 address and the server insists the pool is fine. What helps is
OSPF Hello Packets Explained with a Real Capture
Every OSPF adjacency you have ever built started with a Hello packet, and almost every adjacency that refuses to build is a Hello packet being quietly thrown away. The trouble is that show ip ospf neighbor only tells you the
ngrep: grep for Network Traffic
Pattern matching against live packet payloads. The syntax, the hex mode, the file interop, and a real capture showing the server name leaking out of an encrypted session.
tshark: Wireshark in the Terminal
Wireshark’s full dissector library driven from an SSH session: capture filters against display filters, custom field output, ring buffers and the statistics taps that make triage fast.
Scapy vs Cisco Layer 2 Defenses: Crafting and Spoofing Packets
Craft spoofed ARP and IP packets with Scapy against a Cisco IOS-XE lab, then watch Dynamic ARP Inspection drop every forgery and name the attacker's real MAC.
tcpdump for Network Engineers: A Practical Reference
Interface selection, BPF filters, reading the output line, writing and re-filtering pcap files, and safe long captures - all from a live run of tcpdump 4.99.5 against IOS-XE routers. Includes the privilege drop that kills rotating captures, and a telnet password readable on the wire.