|
Q: Why sometimes copying data from Hex-Editor in Packet Data window doesn't take effect?
A: It surely does. Sometimes a packet begins with 0 (like CISCO MAC address
00:00:0c:...) so the string begins with "0", what in windows (indeed not only) means "end of
string", so it won't paste to text editor. But remember you can always paste it
to Packet Editor in Send tab, and it will work.
Q: What means: "!*!" by IP address at MAC Statistics?
A: That means that under that MAC address hides multiple IP address. It may be a
gateway, or a spoofer.
Q: Sending custom packets cuts of newtwork access.
A: Some firewalls cuts off network access when they see outgoing packets with bad
MAC addresses. For example a faked source MAC address in outgoing packet
causes Sygate Firewall[TM] to cut off network access.
Q: Why a UDP packet (created with the UDP wizard) is translated as only Eth-IPv4, not Eth-IPv4-UDP packet?
A: That's probably because of the fact that an IPv4 offset field is greater than 0,
what means it is an IP fragment - so it cannot be translated higher than on IPv4 layer.
Q: Why in MAC statistics there are records with MAC but without IP addresse?
A: Because of that the mapping from MAC address to IP address is taken from ARP packets
and source and destination fields in pair Ethernet-IPv4, but from IEEE 802.2 packets only MAC addresses
are taken.
|
