reading packets, udp lenght and the relevance or >

Unanswered Question
Dec 20th, 2008
User Badges:

if an IP address or computer is communicating with another and you see e.g 192.168.246.23.134 > 192.168.246.128.134: udp lenght 50, please how can this be interpreted and what does ">" mean?

  • 1
  • 2
  • 3
  • 4
  • 5
Overall Rating: 0 (0 ratings)
Loading.
ropethic Sat, 12/20/2008 - 09:03
User Badges:
  • Silver, 250 points or more

You are probably seeing 192.168.246.23:134 with 134 being the UDP source port which is defined as ingress-net service.

UDP length greater than 50 is telling you the size of the UDP header (min 8bytes) and the data, which combined is greater than 50 bytes.

see

http://en.wikipedia.org/wiki/User_Datagram_Protocol

deenaija1 Sat, 12/20/2008 - 10:34
User Badges:

thanks a lot, i hope you will be able to help me more often...

ropethic Sat, 12/20/2008 - 14:29
User Badges:
  • Silver, 250 points or more

sure, no problem

deenaija1 Tue, 12/30/2008 - 04:41
User Badges:

thanks for your reply. i have more questions

See the following



1. 13:12:49.751403 arp who-has 192.168.246.13(Broadcast) tell 192.168.246.128

2. 13:12:49.751602 arp reply 192.168.246.13is-at 00:00:01:0f:2e:7e

3. 13:12:50.441259 IP 192.168.246.13.137 > 192.168.246.128.137: UDP, length 50

4. 13:12:50.441632 IP 192.168.246.128 > 192.168.246.13: ICMP 192.168.246.128 udp port 137 unreachable, length 86

5. 13:12:51.942563 IP 192.168.246.13.137 > 192.168.246.128.137: UDP, length 50

6. 13:12:51.943277 IP 192.168.246.128 > 192.168.246.13: ICMP 192.168.246.128 udp port 137 unreachable, length 86

7. 13:12:53.444627 IP 192.168.246.13.137 > 192.168.246.128.137: UDP, length 50


PLEASE WHY DOES LINES 3, 5 AND 7 REPEAT ITSELF? I THINK THE 1ST COMPUTER IS TRYING TO COMMUNICATE WITH ANOTHER ON A NETWORK. IF IT WONT BE A BOTHER CAN YOU EXPLAIN A LITTLE?

Actions

This Discussion