If you have tried to sniff the packet traffic of an ongoing MSN chat (with a Wireshark client), you will notice that the protocol used between the sender and the recipient is msnp (1863).

Enter "msnms" in the Wireshark display Filter text box to narrow down the display packets if you did not use any capture filter during the Wireshark capture.

In the screen capture below, ip address 192.168.1.106 is my desktop.



To figure out the "owner" of ip address 64.4.37.20, I use the Whois feature from the website www.samspade.org. If you would like to resolve the ip_address-to-dns_name, use nslookup.



From the information gathered from this snoop capture, we find out that my desktop establishes a connection to the MSN Hotmail server instead of a direct connection to the ip address of the remote MSN friend whom I was having a text conversation with.

As I was working on a pile of paperwork, I realized that I need to convert a pdf document into a MS-word document format for some extensive editing. Previously, I was able to retrieve the documents in pdf and MS-word format. However, recently the document creator decided to stick with publishing the documents in pdf and sdif format. (What in the world is sdif format anyway? Who uses it?)

At about the same time as I was pulling my hair over the issue above, my colleague had a requirement to convert a pdf document to Excel format and he asked me for some help. Great!

I googled around and found a pretty cool software which could handle the document conversions from PDF to Excel/Word and more! Able2Extract 5.0

It is relatively simple to get the hang of using the software, and you can select portions of the document for conversion into the desired format.

If you are not convinced, download the 7-Day Trial copy and try it out for yourself. And in case you are wondering about the difference between the Able2Extract 5.0 and the Able2Extract 5.0 Professional, you can check out the product comparison here.

Hope you find this recommendation beneficial!

Protocol Data Unit (PDU)
- comprises of the Layer's Header + Upper Layer's Data
- The figure below shows an example of a PDU:











Service Data Unit (SDU)
- a subset of PDU
- comprises of the Upper Layer's PDU
- In the OSI Layer encapsulation, where the OSI Layer goes from N to N-1, the Upper Layer's PDU becomes the SDU in Layer N-1. The figure below shows the example:

To translate an IP address from a string of decimals (in little endian* order) into a real IP address, follow this procedure:

Using the decimal number 26999818 as an example.

1) Convert the number to hex

    26999818 (in dec) = 19BFC0A (in hex)

2) If the hex number is 7 digits long, add a leading 0. If the hex number is 8 digits, skip to step 3.

    => 019BFC0A (in hex)

3) Split this value into 4 bytes

     01 9B FC 0A

4) Reverse the order of the bytes, as this value is little endian*

    0A FC 9B 01

5) Convert each byte (in hex) back to decimal

    10 252 155 1

This is the real IP address in dot-decimal notation: 10.252.155.1


*The least significant byte (LSB) value, 0x01, is stored in memory at the lowest address. And the most significant byte (MSB) value, 0x0A, is stored in memory at the highest address.

Note: For a better understanding on "Endian", check out the explanation here.

snoop & tcpdump belongs to the class of tools known as packet sniffers. If you had worked on troubleshooting IT systems, and you can't quite figure out if the issue lies at the application or network, you can use these packet sniffers to help narrow down on where the problem lies.


Solaris includes the packet sniffer: snoop.
To setup, you need to know on which interface (device) you want to run the snoop command. Use ifconfig -a to find out.

# snoop -d device -o filename

Example:
# snoop -d bge0 -o /var/tmp/snoop_activity_name.cap

If there are no interfaces specified, snoop collects packets from the first interface it finds. This is determined from netstat -i (excluding the loopback)

More specific captures can be set up using expressions such as host, port, tcp, udp, ip. These expressions can be combined with primitives such as and, or, and not.

Here are some examples
# snoop host sarah and host connor and tcp port 25
# snoop -d bge0 port 9048

To filter out traffic from your telnet session:

# snoop not host sarah

Linux and FreeBSD platform includes the packet sniffer: tcpdump

To setup, you need to know on which interface (device) you want to run the tcpdump command. Use ifconfig -a to find out.

# tcpdump -i interface -s snaplen -w file

Example:
# tcpdump -i wm0 -s 0 -w /data/SMTP.cap

-i wm0                specifies that interface wm0 should be traced
-s 0                  store the complete packet regardless of length
-w /data/SMTP.cap     store the output in file SMTP.cap in directory /data

Like the snoop command, similar expressions such as host, port, tcp, udp, ip can be combined with primitives such as and, or, and not.

Here are some examples
# tcpdump host john and host connor and tcp port 25
# tcpdump -i wm0 -s 0 -w /data/radius.cap port 1812

To filter out traffic from your telnet session:

# tcpdump not host john

When you have stored the .cap file(s), use Wireshark to view the file contents.