I created a scenario in VirtualBox (configured as internal network) with two machines: Windows XP and Kali Linux. I used ms08_067_netapi exploit from Metasploit and the payload windows/meterpreter/reverse_tcp. I tested the scenario two times (with 1 repetition) with exactly the same configurations, however I noticed the traffic generated is different.
Look at these traffic examples:
Make sense for why network ports can be different. But, as it is possible to see, the packet length is variable, and i don't understand why.
What is the reason why traffic is different if the attack is exactly the same? What can be the possible root cause?
Note: In the link https://we.tl/t-hEVze7d0L4 is possible to check samples on pcap format (they are not the same from the pictures I mentioned, but the attacks are the same). I also included Snort IDS output for the different pcap files, and as it is possible to see were triggered alerts with different attributes for the same attacks.