cancel
Showing results for 
Search instead for 
Did you mean: 
cancel
442
Views
0
Helpful
4
Replies

reading packets, udp lenght and the relevance or >

deenaija1
Level 1
Level 1

if an IP address or computer is communicating with another and you see e.g 192.168.246.23.134 > 192.168.246.128.134: udp lenght 50, please how can this be interpreted and what does ">" mean?

4 Replies 4

ropethic
Level 4
Level 4

You are probably seeing 192.168.246.23:134 with 134 being the UDP source port which is defined as ingress-net service.

UDP length greater than 50 is telling you the size of the UDP header (min 8bytes) and the data, which combined is greater than 50 bytes.

see

http://en.wikipedia.org/wiki/User_Datagram_Protocol

thanks a lot, i hope you will be able to help me more often...

sure, no problem

thanks for your reply. i have more questions

See the following

1. 13:12:49.751403 arp who-has 192.168.246.13(Broadcast) tell 192.168.246.128

2. 13:12:49.751602 arp reply 192.168.246.13is-at 00:00:01:0f:2e:7e

3. 13:12:50.441259 IP 192.168.246.13.137 > 192.168.246.128.137: UDP, length 50

4. 13:12:50.441632 IP 192.168.246.128 > 192.168.246.13: ICMP 192.168.246.128 udp port 137 unreachable, length 86

5. 13:12:51.942563 IP 192.168.246.13.137 > 192.168.246.128.137: UDP, length 50

6. 13:12:51.943277 IP 192.168.246.128 > 192.168.246.13: ICMP 192.168.246.128 udp port 137 unreachable, length 86

7. 13:12:53.444627 IP 192.168.246.13.137 > 192.168.246.128.137: UDP, length 50

PLEASE WHY DOES LINES 3, 5 AND 7 REPEAT ITSELF? I THINK THE 1ST COMPUTER IS TRYING TO COMMUNICATE WITH ANOTHER ON A NETWORK. IF IT WONT BE A BOTHER CAN YOU EXPLAIN A LITTLE?

Getting Started

Find answers to your questions by entering keywords or phrases in the Search bar above. New here? Use these resources to familiarize yourself with the community:

Innovations in Cisco Full Stack Observability - A new webinar from Cisco