Wireshark mailing list archives

How source and destination is identified in Wireshark?


From: Berkay Celik <argusflow () gmail com>
Date: Mon, 24 Jan 2011 22:31:47 -0500

If there is a syn bit set seen from an endpoint, this is the source. I am curious about if wireshark defines in some other ways or only the syn bit is enough to identify the source and destination? Secondly,

if my traces has are partial conversations, not any syn bit is seen, which one is the source and destination? port numbers can be used to determine them but what if both port numbers makes sense. server uses 80 and the client uses a port number let say something more than 1024 but it's also possible for servers to give services from that port number as a kind of database queries.

Thanks

___________________________________________________________________________
Sent via:    Wireshark-users mailing list <wireshark-users () wireshark org>
Archives:    http://www.wireshark.org/lists/wireshark-users
Unsubscribe: https://wireshark.org/mailman/options/wireshark-users
             mailto:wireshark-users-request () wireshark org?subject=unsubscribe

Current thread: