Determine the Packet Direction (Inbound or Outbound)

asked 2020-07-27 16:12:27 +0000

Artemis
5 ●2 ●2 ●3

Hello:) I'd like to ask what is the best way to determine if a packet direction is inboud or outbound by using wireshark or pyshark?

Currently i tried two ways: the first one is based on the source and destination IP address of the packets (the packet is outbound if the source ip is the pc ip), while the second one is based on the port numbers (the packet is outbound if the source port number is less than 1024, and the destination port number is more than 1023). However, in both cases, i got exceptions in my captured files.

I wonder if there's any better way to determine the direction of the captured packet? thanks a lot.

edit retag flag offensive close merge delete

Comments

Can you go a down a layer and look at the MAC addresses in the Ethernet header?

Chuckc ( 2020-07-27 16:26:57 +0000 )edit

Thank you for the kind insight, i will try this way to see if it works better.

Artemis ( 2020-07-27 16:36:04 +0000 )edit

Hello, did you find a solution? I am trying to solve this problem but till now I did find one, please if you have an idea how to determine the packet inbound or outbound help me! thank you

omar ( 2021-10-06 11:41:04 +0000 )edit

add a comment

answered 2020-07-27 17:46:08 +0000

zchbrsn
1 ●1 ●1

Artemis,

There are a few ways you can determine if it is inbound or outbound.

By looking in the Source or Destination fields in the packet count pane (tried uploading a picture to assist in locating, but can't post pictures yet).
By looking for "src" or "dst" followed by the IP Address in the details pane of a packet (src = Source, dst = Destination).
Conventionally, if you are looking at the hexdump of a packet, the Source IP Address will come first, followed by the Destination IP Address.

Note: I wouldn't advise determining the orientation of the packet by using the Source or Destination port. It is very likely that common ports are used, but it's not always the case. Protocols can go over virtually any port number in the port range (e.g. HTTP over 8080 which is greater than 1024).

Hope this helps.

edit flag offensive delete link

add a comment

Your Answer

Please start posting anonymously - your entry will be published after you log in or create a new account.

Determine the Packet Direction (Inbound or Outbound)

Comments

1 Answer

Your Answer

Question Tools

Stats

Related questions

Determine the Packet Direction (Inbound or Outbound) edit

Comments

1 Answer

Your Answer

Question Tools

Stats

Related questions

Determine the Packet Direction (Inbound or Outbound)