First time here? Check out the FAQ!
THIS IS A TEST INSTANCE. Feel free to ask and answer questions, but take care to avoid triggering too many notifications.
0

Confusing swap of text2pcap in/outbound addresses

Hi Forum,

I've been working with some SCTP dumps printed by Chrome logs, using text2pcap -D -i 132 to have it prepend a dummy IP header, and I am confused (and curious!) about why Wireshark flips the source/destination addresses for the outbound case, instead of the inbound one.

A couple packets printed by Chrome in its logs would look like this:

O 22:50:10.356 0000 13 88 13 88 00 00 00 00 (...) # SCTP_PACKET DcSctpTransport0
I 22:50:10.356 0000 13 88 13 88 00 00 00 00 (...) # SCTP_PACKET DcSctpTransport0

Actual payloads don't matter. The thing is that this ends up showing like this in Wireshark:

 No. |      Src |      Dst
   1 | 10.2.2.2 | 10.1.1.1
   2 | 10.1.1.1 | 10.2.2.2

I am just wanting to learn here (and maybe help any interested readers in the future) and understand better:

Why is the Outbound direction flipped instead of the Inbound?

My thought is that given that this is a capture generated from an application (Chrome in this case), the local side, "us", should be the source address for Outbound packets (10.1.1.1), and the remote side, should be the outbound destination (10.2.2.2). By that logic, it is the Inbound ones that should have the address swapped. But Wireshark does the opposite of what I'd find intuitive.

I did my research; this has been the case since Commit 6022ea71 (Flip MAC and IP addresses, and TCP/UDP/SCTP ports, for outgoing packets), which ended up evolving to this code. However, the reasoning behind flipping the outbound instead of the inbound has been kind of lost it seems (https://code.wireshark.org/ is dead).

j1elo's avatar
1
j1elo
asked 2024-06-24 12:50:15 +0000
edit flag offensive 0 remove flag close merge delete

Comments

add a comment see more comments

1 Answer

0

Without the -D option, but with -i option, all packets are considered inbound. So for outbound they must be swapped.

You can specify the dummy IP-addresses of your choosing using -4 dst,src. For example:

text2pcap -D -i 132 -4 10.2.3.4,10.2.3.56 ...

Then "O" respresents src->dst and "I" dst->src, as expected.

Instead of creating dummy headers it is also possible to feed text2pcap with all headers, thus including Ethernet and IP. Then the data already contains the direction.

André's avatar
176
André
answered 2024-07-20 16:25:38 +0000
edit flag offensive 0 remove flag delete link

Comments

add a comment see more comments

Your Answer

Please start posting anonymously - your entry will be published after you log in or create a new account. This space is reserved only for answers. If you would like to engage in a discussion, please instead post a comment under the question or an answer that you would like to discuss.

Add Answer