RX and TX packets identification
When I am capturing packets of some intarface how can I detect which are RX and TX packets?
Depends on the network technology in use, but for the most common Ethernet, Tx packets will have the MAC address of the interface as the source and Rx packets will have the MAC address as the destination.
Broadcasts (i.e. with a MAC address of all f) are a bit more difficult to work out.
In the case shown above, which is Wi-Fi not Ethernet, additional info is available which shows the mac address of the transmitter (Transmitter address). All packets are effectively both Tx and Rx packets, generally what counts is who transmitted the packet and who was the intended recipient.
This also points out another issue when determining if a packet is an "Rx" packet, in that if the capture interface is in promiscuous mode (or monitoring for Wi-Fi), then the interface will "receive" packets not intended for that interface. Whether you count those as "Rx" packets is up to you.
Asked: 2019-10-11 09:56:33 +0000
Seen: 4,750 times
Last updated: Oct 11 '19