Question

How to define the encoding that was applied to obtain the payload (in wireshark)? How to determine the size of the data before encoding?

Answer 1

1. Define the encoding that was applied to obtain the payload and deteremining the size of data before encdoing as follows:

• The TCP payload size is determined from the IP header (ip.len) by taking the "Total Length" and then subtracting the "IP header length" (ip.hdr len) and the "TCP header length" (tcp.hdr len).
• The field 'Bytes in Flight' displays the amount of data that was sent, but not yet ACKed (seen from the point of capture perspective).

• When you opens the capture packet and extend the IPV4 option using Wireshark,you will see the total packet length and that's your maximum packet size.

• Unless defined, the header is always 20 bytes, so subtract it from the total length and now you have your packet size without the header data.

• Below are the size of data before encoding

• Rules to Encoding that was applied to obtain the payload:

1. Field Name: ber.encoding
2. Description : encoding
3. Type : Unsigned integer, 4 bytes
4. Version : 1.0.0 to 3.2.7

• Steps to encoding the protocols:

1. Select the type which you wanted to do encode.
2. At the Top, click on the Analize
3. Enabled Protocols.
4. You will see the protocols which are encoded.