Decoding sniffed packets

Question

I understand that each packet has some header that seems like a random mix of chars. On the other hand, the content itself can be in pure ascii and therefore it might be human friendly. Some of the packets I sniffed were readable (raw html headers for sure). But some packets looked like this:

0000  00 15 af 51 68 b2 00 e0  98 be cf d6 08 00 45 00   ...Qh... ......E.
0010  05 dc 90 39 40 00 2e 06  99 72 08 13 f0 49 c0 a8   ...9@... .r...I..
0020  64 6b 00 50 c1 32 02 7a  60 4f 4c b6 45 62 50 10   dk.P.2.z `OL.EbP.

That was just a part, these packets were usually longer. My question is, how can I decode the packet content/data? Do I need the whole stream? Is the decoding simple, or every application can encode it slightly else, to ensure these packets are secured?

Edit: I don't care about the header, Wireshark shows that. However, that's totally worthless info. I want to decode the data/content.

Answer 1

The content of a packet is defined by the process sending it. Think of it like a telephone call. What's said is dependent on who is calling and who they are talking to. You have to study the programs that construct it to determine how to "decode" it. There are some sniffers that will parse some commonly used methods of encoding and try to do this already.

Answer 2

Why not just use something like wireshark?

Answer 3

Packet headers will depend on the application sending the packet in question, as mentioned in an earlier post. You can also use Wiresharks protocol reference for understanding some of the common protocols.

What you have listed here is the Packet Byte, what you need to see is the Packet Detail view to understand what does the seemingly random data correspond to. In Packet Detail view, when you select various parts of the packet, it will highlight corresponding byte in the Packet Byte view.

Answer 4

If you're using C#, grab SharpPcap and look at the examples in code to get a feel for how it works.

Set the filter to only capture UDP, capture a packet, parse it to udp, and extract the payload. The payload's format is based on the application sending it.

There's a lot of extra gibberish because every udp packet contains a stack of:

• Ethernet header
• IP header
• UDP header

of information before your data and all incoming data is in binary format until you parse it to something meaningful.