1

I have a pcap file and I am trying to analyze it using Snort and Wireshark.

When I tried the command, which I had showed below, in Ubuntu I was provided with various output such as the date, time, source host, destination host, protocol and there are some others like TTL, TOS, ID, IpLen, DgmLen, Ack, Seq.

Snort -r myfile.pcap

My question is: What do each of these fields mean, and what threats or attacks can be performed with those fields?

TTL, TOS, ID, IpLen, DgmLen, Ack, Seq

I'm attaching a part of the Snort output of the pcap file.Output

Do I have to write a Snort rule in order to detect attacks? Any help would be appreciated.

closed as too broad by schroeder, Xander, TildalWave, RoraΖ, Jens Erat Jan 22 '15 at 22:58

Please edit the question to limit it to a specific problem with enough detail to identify an adequate answer. Avoid asking multiple distinct questions at once. See the How to Ask page for help clarifying this question. If this question can be reworded to fit the rules in the help center, please edit the question.

  • 3
    I'm sorry but you can't analyze technical data for attacks if you lack the most basic knowledge of the technology. If you don't know what a sequence number is in TCP, you need to build a foundation. We can't help you. – schroeder Jan 22 '15 at 19:10
  • 1
    Reports that say that something hasn't happened are always interesting to me, because as we know, there are known knowns; there are things we know we know. We also know there are known unknowns; that is to say we know there are some things we do not know. But there are also unknown unknowns -- the ones we don't know we don't know. -Donald Rumsfeld (former United States Secretary of Defense) – user1801810 Jan 29 '15 at 5:55

Browse other questions tagged or ask your own question.