Previous Topic
Next Topic
Book Contents
Book Index

Logs and packet analysis

The log allows you to see all IP packets (TCP, UDP, ICMP, ARP, DNS) that physically cross any of the interfaces present in the WinRoute computer.

How to read the log?

From the left you may see the following:

Time stamp - the date and time displaying exactly when the event happened or packet crossed the interface.

The protocol - the type of protocol of the packet, TCP, UDP, ARP, ICMP etc.

From/To Interface name - the name of the interface and whether the packet went To or came From the interface (imagine that WinRoute is running on the PC and interfaces are meant to be the "gates" between the computer and the network).

Source IP -> Destination IP address - the source and destination IP addresses present in the packet.

The flags - Are the extended information of the packet. They keep additional information about the packet used by routers or in standard TCP communication. Here is the list of flags displayed by WinRoute:

SYN - Synchronize - the establishing packet from a TCP connection

ACK - Acknowledge - acknowledgement about the data exchange

RST - Reset - request for re-establishing of the connection

URG - Urgent - urgent packet

PSH - Push - request for immediate delivery of the packet to the higher layers

FIN - Finalize - finalize the connection

Example:

[10/Nov/1999 09:32:38] TCP: packet 511464, from lan, length 1514, 192.168.1.7:2442 -> 192.168.1.1:25, flags: ACK

[10/Nov/1999 09:32:38] TCP: packet 511465, to lan, length 54, 192.168.1.1:25 -> 192.168.1.7:2442, flags: ACK