I need help with pcap file

[Olim Yalgashev]

Hi guys!

I'm learning mesh helper in ns3,
There is an example: mesh.cc

With source, no problem, it is clear.


Generally, I understand why do we need pcap, sure, it is for capturing packets,

how the process described in pcap?

I googled trying to find tutorial, but I can not find good information
(of course there are a lot of sources about it, but they are too hard to understand to a dummy like me :) )

I need help with pcap and xml,

1) Traced *.pcap files with WireShark, I don't understand what is going on (please see attached file 1.png)

2) Traced with tcpdump, not clear AGAIN (please see attached file mp--0-1.txt):

3) What process is going on in xml-files (please see reports.zip)???

Guys, please, I'll be very thankful!!!
HELP ME!

[Daniel Camara]

Hi Olim,

When you say it is not clear you are talking about the output, or
the pcap file itself? The pcap file is just the register of all the
files that passed at one interface... If I am not wrong it is short
for Packets capture. You have the order of the packets the type and
content. They are saying malformed packets because, if I am not wrong,
ns-3, by default for performance reasons do not calculate CRC, for
example.

Your problem is in:
1. Analyzing/visualizyng the pcap? (wireshark is the best, even if
you want to analyze things like throughput etc, using the tshark, or
you can go for tools like http://research.protocollabs.com/captcp/...
where you have the python code and can change if you wish)
2. Understanding what is PCAP and the fields you have there: (see
http://wiki.wireshark.org/Development/LibpcapFileFormat)
3. Understanding what is happening with the mesh example. Then i
guess you should go step by step using the pcap as a "road map" to
understand the meaning of the messages (run the example step by step
with gdb look into
http://www.nsnam.org/docs/manual/html/troubleshoot.html, and /or
http://www.nsnam.org/wiki/index.php/HOWTO_configure_eclipse_with_ns-3)

4. None of the above, I did't get the problem, please let me know
what is going on :)

Best regards...

Daniel

> --
> You received this message because you are subscribed to the Google Groups
> "ns-3-users" group.
> To unsubscribe from this group and stop receiving emails from it, send an
> email to ns-3-users+...@googlegroups.com.
> To post to this group, send email to ns-3-...@googlegroups.com.
> Visit this group at http://groups.google.com/group/ns-3-users.
> For more options, visit https://groups.google.com/groups/opt_out.



--
Best regards...

Daniel

[Olim Yalgashev]

Hi there!
Daniel, thank you very much for your reply :)

I don't understand both of them (and output, and pcap)
For simple ns3 scripts, pcap files are very simple
For example here

 tcpdump -nn -tt -r myfirst-0-0.pcap
  reading from file myfirst-0-0.pcap, link-type PPP (PPP)
  2.000000 IP 10.1.1.1.49153 > 10.1.1.2.9: UDP, length 1024
  2.514648 IP 10.1.1.2.9 > 10.1.1.1.49153: UDP, length 1024

  tcpdump -nn -tt -r myfirst-1-0.pcap
  reading from file myfirst-1-0.pcap, link-type PPP (PPP)
  2.257324 IP 10.1.1.1.49153 > 10.1.1.2.9: UDP, length 1024
  2.257324 IP 10.1.1.2.9 > 10.1.1.1.49153: UDP, length 1024

Everything is clear!

BUT!!! Here (also attached in mp--0-1.txt) I don't understand anything:

reading from file mp--0-1.pcap, link-type IEEE802_11 (802.11)
0.004917 Beacon () [6.0* 9.0 12.0 18.0 24.0 36.0 48.0 54.0 Mbit] IBSS
0.004951 Action (00:00:00:00:00:01): MeshPeering Open
0.005411 Acknowledgment RA:00:00:00:00:00:04 
0.005577 Action (00:00:00:00:00:02): MeshPeering Confirm
0.005817 Action (00:00:00:00:00:02): MeshPeering Open
0.006103 Acknowledgment RA:00:00:00:00:00:04 
0.006173 Action (00:00:00:00:00:01): MeshPeering Open
0.006370 Acknowledgment RA:00:00:00:00:00:01 
0.006536 Action (00:00:00:00:00:02): MeshPeering Confirm
0.006552 Acknowledgment RA:00:00:00:00:00:02 
0.006767 Action (00:00:00:00:00:02): MeshPeering Open
0.006783 Acknowledgment RA:00:00:00:00:00:02 
0.006879 Action (00:00:00:00:00:01): MeshPeering Confirm
0.007071 Acknowledgment RA:00:00:00:00:00:01 
0.033228 Action (00:00:00:00:00:03): MeshPeering Open
0.033515 Acknowledgment RA:00:00:00:00:00:04 
0.033763 Acknowledgment RA:00:00:00:00:00:04 
0.033929 Action (00:00:00:00:00:03): MeshPeering Confirm
0.063424 Beacon () [6.0* 9.0 12.0 18.0 24.0 36.0 48.0 54.0 Mbit] IBSS
0.063458 Action (00:00:00:00:00:01): MeshPeering Open
0.063654 Acknowledgment RA:00:00:00:00:00:01 
0.063820 Action (00:00:00:00:00:03): MeshPeering Confirm
0.063836 Acknowledgment RA:00:00:00:00:00:03 
0.064060 Action (00:00:00:00:00:03): MeshPeering Open
0.064076 Acknowledgment RA:00:00:00:00:00:03 
0.064154 Action (00:00:00:00:00:01): MeshPeering Confirm
0.064347 Acknowledgment RA:00:00:00:00:00:01 
0.065062 Beacon () [6.0* 9.0 12.0 18.0 24.0 36.0 48.0 54.0 Mbit] IBSS
0.504933 Beacon () [6.0* 9.0 12.0 18.0 24.0 36.0 48.0 54.0 Mbit] IBSS
0.551750 Beacon () [6.0* 9.0 12.0 18.0 24.0 36.0 48.0 54.0 Mbit] IBSS
0.563432 Beacon () [6.0* 9.0 12.0 18.0 24.0 36.0 48.0 54.0 Mbit] IBSS
1.004933 Beacon () [6.0* 9.0 12.0 18.0 24.0 36.0 48.0 54.0 Mbit] IBSS
1.051750 Beacon () [6.0* 9.0 12.0 18.0 24.0 36.0 48.0 54.0 Mbit] IBSS
1.063432 Beacon () [6.0* 9.0 12.0 18.0 24.0 36.0 48.0 54.0 Mbit] IBSS
1.504933 Beacon () [6.0* 9.0 12.0 18.0 24.0 36.0 48.0 54.0 Mbit] IBSS
1.551750 Beacon () [6.0* 9.0 12.0 18.0 24.0 36.0 48.0 54.0 Mbit] IBSS
1.563432 Beacon () [6.0* 9.0 12.0 18.0 24.0 36.0 48.0 54.0 Mbit] IBSS

Actually, I know some packet is flowing to somewhere, but which packet is flowing (what's the header information?)
Daniel, if you know what process is going on here, please answer, please!
Thank you so much!!!

Best Regards,
Olim

[Cuong Uong]

hi guys!
Have you understood what the Ackowledgement field means yet?
I still don't understand. Pls, tell me?

Vào 09:54:04 UTC-8 Thứ năm, ngày 21 tháng mười một năm 2013, Olim đã viết: