Ethereal-users: Re: ***SPAM*** [Ethereal-users] Help reading captured packets

Note: This archive is from the project's previous web site, ethereal.com. This list is no longer active.

Date Index Thread Index Other Months All Mailing Lists
Date Prev Date Next Thread Prev Thread Next
From: Alexandros Papadopoulos <apapadop@xxxxxxxxxxxxxx>
Date: Mon, 14 Feb 2005 12:12:10 +0200
On Saturday 12 February 2005 22:58, Stefrae15@xxxxxxx wrote:
> I'm doing a lab in my class using Ethereal. We are to find out what
> operating system is being used by the client. Where would we find
> this  information in captured packets.

So, the question is how does one do *your* homework?

Generally speaking, you look for OS-specific protocol headers or 
identification data in the payload of captured packets. Capture a HTTP 
stream and look in the first packets after connection establishment 
(also referred to as three-way-handshake) and you'll find out a lot 
both about the server and the client.

-A