start	end	text
5830	10950	Hi, this is Laura Chappell and welcome to this video on Deep Space Networking Traffic
10950	12070	Analysis.
12510	18290	In this video I'm going to show you how I open up a trace file inside of Wireshark and
18290	24090	begin the process of customizing Wireshark for Deep Space Networking Traffic Analysis.
24130	29410	And we'll go through and learn about the Bundle Protocol and we'll learn about the TCP Convergence
29410	30450	Layer.
30450	33090	So let's go over to Wireshark and get started.
33690	41250	In Wireshark I've opened up the trace file depicting the Deep Space Networking Traffic.
41250	48750	Now we're talking about Delay and Disruption Tolerant Networking here, or DTN we simply
48750	50650	refer to it as.
50650	58270	And in this scenario we have a host that is sending a bundle of data in bundle segments
59230	63650	to another host to be relayed to a third host.
63730	66250	So let's see what we have in this trace file.
66250	71870	First of all we have some traffic that doesn't have anything to do with our DTN communications.
71870	76190	It's this OSPF traffic. So I'm going to get that out of the way.
77430	81690	Now what we're left with are some interesting packets here.
81690	88110	First of all, these top packets that you see, they're UDP packets. They're kind of sprinkled
88110	89470	throughout the trace file.
89470	96430	If you were to select one of those packets and look down in the packet bytes window,
96430	101850	what you would see is in the data portion it appears that we have a host that is announcing
101850	105570	its DTN endpoint ID.
105570	113010	So 10.0.0.1 is announcing that its endpoint ID is N1.
113330	115210	Kind of like its name.
115390	122610	On the second packet there we have 10.0.0.2 announcing its endpoint ID as N2.
122610	129810	And the next packet 10.0.0.3 announcing its endpoint ID as N3.
129810	137850	Alright, that information right there is very interesting but it's not a data transfer process.
137850	139870	That is just an announcement.
139870	145010	What we're interested in are the TCP CL packets.
145010	153030	So frame number 7 there is the first time we see a TCP Convergence Layer packet.
153030	155570	And this is just a keepalive.
155570	163450	By looking at these keepalives we can get a general idea of which hosts can see which hosts.
163450	170390	So in frame number 7 we have 10.0.0.3 sending a keepalive to .4.
170390	174010	In the next packet we have .1 sending a keepalive to 3.
174410	177590	In packet 9 we have 3 sending a keepalive to 1.
177690	185390	And then a little bit further on we see in packet 19 we have .2 sending a keepalive to 4.
185390	187810	Alright, we can build a picture from this.
188030	194490	This is what we know so far. It appears that we have 4 hosts.
195770	202010	And based on the keepalives we can see which hosts are talking to which hosts.
202010	210110	So we can see based on the keepalive that .1 can see .02, .2 can see 4, 4 can see 3,
210110	211210	3 can see 1.
211210	214530	But we don't see any keepalives going between .1 and .4.
214530	217770	We don't see any keepalives between .2 and .3.
217770	221090	So perhaps we have something in the way between those two hosts.
221090	223290	It could be something like a planet.
223530	229670	So here I have a picture, one of the various pictures of Venus with a color filter on it.
229710	231830	Now let's go back to the trace file.
233170	237830	So let's take a look at when data actually begins to be sent here.
237830	243970	We see an awful lot of those endpoint ID announcements and we see a bunch of keepalives and we see
243970	247390	some acknowledgments for those keepalives.
248950	256130	When we get down to frame number 57, that's the first time we see a larger length frame
256130	259350	that probably has some data in it.
259350	266090	So let's create a profile in Wireshark and we'll begin the customization process to help
266090	269510	us analyze deep space networking traffic.
270030	275970	So in the bottom right hand corner on the status bar in Wireshark, it says Profile Default.
275970	282670	I'm going to right mouse click on that column there on the bottom and say New and I'm going
282670	290230	to name this profile DTN Example and I'll say OK.
291170	296550	Now Wireshark takes me back to the default settings for profiles and this font is way
296550	297470	too small.
297470	299370	There's no way I'll be able to see that.
299370	305110	So I'm going to zoom in here using the enlarge button on the main toolbar until I get to
305250	307330	a font size that I like.
308110	312330	Now with all of my profiles, I always add one special column.
312330	317190	I like to have it up with all the work that I do analyzing traffic.
317490	323510	And that column is one that will tell me the conversation numbers in the trace file.
323510	328510	Wireshark numbers all the UDP conversations and it numbers all the TCP conversations.
329130	334150	It starts numbering each of them at zero and they are exclusive of each other.
335030	340770	I'm going to go into the very first packet in here and inside the UDP header, there is
340910	343310	a field called the Stream Index field.
343410	347250	And I want to add this as a column.
347250	352030	To add a field as a column, you simply right mouse click on that field and say Apply as
352030	352870	column.
353270	358750	I'm going to right mouse click on that column heading and choose to align center for the
358750	360530	contents of that column.
360850	365590	Now we've started creating this great column, but we're not quite finished yet.
365590	369730	Because our TCP traffic is not showing up with a stream index number.
369730	374550	We've only told Wireshark to add a stream index column for UDP.
374550	379190	So I'm going to right mouse click on that column header, and I'm going to choose to
379190	380590	edit the column.
381290	388330	And I can see right here that the field that it's based on is udp.stream and I'm going
388330	392010	to add on to this to say or tcp.stream.
392190	398430	Doesn't matter if you do tcp.stream or udp.stream or this direction, doesn't matter, either
398430	399670	way that will work.
399670	401190	And I'm going to say OK.
401770	402890	There we go.
403130	407950	Now, as conversations are intertwined, it's easier for me to see which conversation I'm
407950	413250	currently working in because I have the conversation number on the left hand side.
416850	422310	So the next thing I want to do is I want to pull out the most active conversations in
422310	423490	this trace file.
423490	429690	I'm going to go up to statistics and conversations, and I'm interested in the most active conversations
429690	431730	based on the TCP layer.
432190	439490	I'm going to sort based on the byte count from high to low, and there I can see I have
439490	442410	two conversations of interest here.
442410	444570	These top two are what I want to look at.
444570	446590	That's data flowing.
447530	452530	So I'm going to right mouse click on the very first line here, which is traffic between
452530	454470	.3 and .1.
454850	459430	I'm going to right mouse click and prepare a filter based on the selected value going
459430	460770	in both ways.
461990	465770	And then I'm going to go to the second line, and I'm going to right mouse click, prepare
465990	466730	a filter.
466730	472470	And this time I'm going to say or selected, going in both directions.
473390	480670	Wireshark builds the filter for me in the background, and I can see exactly what this
480670	483890	filter is based on, the IP addresses that it's based on.
484450	487290	And I'll go ahead and I'll just apply that filter now.
487610	493030	So I have two conversations, the top two conversations showing in this trace file.
493890	501050	I'm going to go to file, and I'm going to save this as a separate trace file now.
501050	503170	Just these two conversations.
503750	511890	I'll go to file, export specified packets, and I'm going to call this DTN example.
514710	519410	Now I'm going to open up that trace file called DTN example, because by default, Wireshark
519410	522570	only saves the filtered packets.
522570	524670	So here we go.
524970	527510	Now we have some Keep Alive segments.
528550	531950	Let's take a look down in the packet details window.
532710	537370	Here we can see we have an Ethernet header, an IP header, a TCP header, and then after
537370	545030	the TCP header, we have the DTN, TCP Convergence Layer Protocol, or TCPCL.
545030	551070	It has its own header, and for Keep Alives, all we have is this single little field here
551070	553410	saying that it is a Keep Alive.
553410	557590	I want my Keep Alives to kind of melt into the background here, so I'm going to set up
557750	563430	a coloring rule to change the way these show up in the packet list pane, so they kind of
563430	564690	melt away.
564690	567690	I also don't need my capture filter anymore.
568170	573990	So in the detail window, I'm going to right mouse click on this Keep Alive packet, and
573990	579010	I'm going to colorize this with a filter and create a new coloring rule.
579990	586370	There's the syntax put in there for this coloring rule, and I'm just going to call it TCPCL
586950	588310	Keep Alive.
589790	594110	On the bottom of this coloring rules window, I'm going to click the background button,
594110	601450	and I'm going to change the background color to sort of a washed out grayish color, let's
601450	602230	say.
603270	605910	I'll click OK and OK.
607630	613770	Now, those Keep Alives have their own background color of this gray showing up.
615610	621310	The next thing I want to do is I want to look for anywhere where it says Bundle Protocol,
621310	627710	and I should expand the protocol column so you can see what's marked as TCPCL.
628390	637130	Frame number 14 shows up, and in the info column it says Bundle TCPCL Segment, TCP Segment
637130	639810	of a Reassembled Protocol Data Unit.
639810	645090	Wireshark's TCP Reassembly function is on, and we'll talk about how that affects the
645090	647130	view in just a little bit.
647370	655350	But if we look inside of frame 14, I'm going to move this up, what we can see is we can
655350	661330	see that we have the TCP header, and then right after that, Wireshark is telling us
661330	670150	that three different segments have been reassembled to create this bundle segment.
670810	676310	Let's stop for a moment and let me show you how bundles relate to bundle segments, which
676310	679070	relates to TCP segments.
679970	687930	So the Bundle Protocol is essentially an application, and you would have some other application
687930	689190	that uses it.
689190	693990	So let's say you wanted to do FTP across the galaxy.
693990	694950	You could do that.
694950	699410	You would type in your FTP commands, but that command would go through the Bundle Protocol
699410	701490	to transfer data.
701510	706050	So we would have a bundle here of data, and bundles need to be transferred around.
706050	713670	It could be scientific information, it could be video, it could be pictures of the surface
714090	716610	of a planet or something like that, it doesn't matter.
716610	722870	You have this big bundle of data, and the Bundle Protocol is a store-and-forward protocol.
722870	728490	Again, it's covered in RFC 5050 if you want to go look up some information about this.
728750	735510	But when a bundle of data is going to a target system, it can be split up into bundle segments,
735510	738010	and that is what we see in this trace file.
738090	742570	In this trace file, the bundle that is being transferred from the first host to the relay
742570	746890	has split the bundle up into four different segments.
747010	752610	When we look at it on the cabling system, it's really strange because we're so used
752610	759410	to an application sending down a certain amount of data, and then the TCP segments go all
759410	761330	the way to the end of the data and stop.
761390	764530	That's not the way it's done with the Bundle Protocol.
764530	771910	A TCP segment may have some data from Bundle Segment A, and it may have some data from
771910	774910	Bundle Segment B inside of it.
776250	784030	So you can see that if this first bundle segment is going across the network, it's got a TCP
784030	789050	segment, another TCP segment, and then part of the third TCP segment is part of Segment
789050	789790	A.
789790	796690	And then Bundle Segment B goes out, but part of Bundle Segment B is sitting in the third
796690	798590	TCP segment here.
798630	803790	And then we have a TCP segment devoted to Bundle Segment B, another one, and then we
803790	808950	only needed part of another TCP segment, but why stop the TCP segment and create a new
808950	809570	one?
809570	810110	Nope.
810110	816110	We will have Bundle Segment C, and it starts in the middle of a TCP segment.
816110	822010	Literally, you will see a header inside of this segment right here, indicating that this
822010	824050	new bundle is coming up.
824710	827530	Same thing with the final bundle segment.
827970	832710	There will be a header right at the beginning of this bundle segment saying that this is
832710	834930	the start of a new set.
836750	845210	So, let's go take a look at these bundle segments as they show up delivered by TCP segments.
846850	853190	So in the Info column, we see on frame number 14, it says Bundle TCP CL Segment, and when
853190	859350	we click on it, we have an indication here of which packets were required to put together
859350	862830	this first bundle segment.
862830	866310	Frame number 11, frame 13, and frame 14.
866310	872330	And the numbers in parentheses are how much data fits into this bundle segment.
874350	876170	Now we can also see below this.
876170	884590	This is the TCP Convergence Header, and unlike the TCP CL Keep Alive, there are more fields.
884590	889090	There are a total of four fields in this TCP Convergence Header.
889090	894790	So we have the packet type field, so this is data.
895030	898410	Then we have, this is indented, so don't get stuck on this.
898410	899930	These are not new fields.
900050	903250	This is the summary line for these two below.
903250	908350	There is one bit that would indicate if this is the start of the entire bundle, and there's
908350	913930	another bit that indicates if this would be the last packet of the entire bundle.
913930	922470	And then we have a line that tells us how large that TCP bundle segment is.
922470	925910	That is a bundle segment length.
929100	936040	So let's do some customization of Wireshark based on these fields.
936340	940960	Number one, I want to take the packet type field, and I'm going to right mouse click
940960	943020	on this and apply this as a column.
943260	943980	There we go.
943980	948780	It's easy now to see the difference between Keep Alives There and where data packets are.
948780	953880	And then I also want to do the same thing for Segment Contains Start of Bundle.
953920	959560	I'm going to right mouse click here, and this is the Start of Bundle packet, so I'm going
959560	963420	to apply this as a column, and we can see that it's true.
963640	965740	I'm going to center align that.
967100	973600	And then this next field, Segment Contains End of Bundle, I'm going to add that as a
973600	976700	column, and I'll center align that.
977060	983320	Now it's pretty easy to look through the trace file and see which packets are the start of
983320	991420	the bundle, and then farther on we'll be able to see which packets are the end of the bundle.
991420	998880	That's the end of the entire bundle, not the bundle segment, but the bundle itself.
998880	1004620	To make it even easier to detect these, I'm going to set up two coloring rules.
1004640	1009660	I'm going to set up one coloring rule that turns all packets that are the start of the
1009660	1014520	bundle a green color and then the end of the bundle red.
1014820	1019740	So in frame number 14 I'm going to right mouse click on this line that says Segment Contains
1019740	1028780	Start of Bundle, and I'm going to choose Colorize with Filter, New Coloring Rule, and it's
1028780	1036520	already set to a 1 because this is the start, so I'm going to just name this Start of Bundle,
1036520	1044380	and then for the background I'm going to choose sort of a lime green-ish.
1047720	1054160	Now by setting that coloring up, it's very easy for me to detect where the start of the
1054160	1056280	bundles are in the trace file.
1056280	1058680	Three of the packets should have matched that.
1058780	1060320	Here's another thing we can do.
1060320	1066700	We can right mouse click on that field and just simply prepare a filter based on the
1066700	1067980	selected value.
1067980	1075360	That just puts that filter to detect the start of bundle packets up in my display filter
1075360	1076300	area.
1076500	1080920	And on the far right hand side of the display filter area there's a little plus there.
1081240	1085180	I'm going to click that plus and I'm going to turn this into a button.
1085280	1089640	I'm going to give the button a label which is going to be S-Bundle.
1089640	1092500	That to me means Start of Bundle.
1092900	1094400	I'll say OK.
1094980	1096020	Now I have a button.
1096020	1102580	When I click on it, any packets that have the Start of Bundle bit set to a 1 will show
1102580	1103360	up.
1104000	1107300	Let me clear out the filter that the button just applied.
1107920	1112280	I want to do the same thing with the End of Bundle.
1112280	1113880	I want to give it a color.
1113880	1117620	I'm going to give it a vibrant red and then I'll make a button so I can easily detect
1117620	1120780	the End of Bundle and just show those packets.
1120860	1124680	Now this packet has the End of Bundle bit set to a 0.
1124680	1128580	I'm going to change that to a 1 when I do my coloring rule.
1128580	1132740	I'm going to change that to a 1 when I do my display filter button.
1133120	1139880	So I'm going to right mouse click on this packet, colorize with a filter, new coloring
1139880	1144460	rule, name it End of Bundle.
1145420	1149600	And I'm going to give it a background color of this vibrant red.
1149880	1152420	I'll say OK, OK.
1152640	1155320	So now it's very easy.
1156740	1159020	Oh, I forgot to change the number.
1159500	1162920	Well, it's good for you to see how to edit coloring rules.
1162940	1167040	To edit a coloring rule, we go to View, Coloring Rules.
1167280	1170760	And I wanted to change this to a 1 at the end.
1171400	1172900	There we go.
1174760	1181200	Alright, so now we can see there's the start of a bundle, there's the end of a bundle.
1181360	1187120	There's a start of a bundle, and there's the end of a bundle right here.
1187600	1195180	The first start of bundle we see going from 10.0.0.1 to 10.0.0.3.
1195180	1203740	So the first thing we see in here is we see a bundle being transferred from .1 to .3 in
1203740	1205140	Bundle Segments.
1205320	1214380	After that bundle is done, right there, then down on frame 37, we see another bundle starting.
1214380	1217460	And this bundle is from .3 to .4.
1217460	1221560	This is the first bundle being forwarded on by .3.
1221560	1223780	So it's being relayed on.
1225020	1232840	And then we see the end of that bundle after it's been relayed.
1233500	1240580	And the very last packet that we see here, from .3 going back to .1, it's a little strange.
1240580	1242440	It's its own bundle.
1242440	1248520	We can see that the start of bundle is set at true, and the end of bundle is set at true.
1248520	1253020	First of all, I want to pop up a button up here for end of bundle.
1253380	1258480	Well I'll use this packet since it has the end of bundle bit set on.
1258900	1265480	I'm going to go inside the TCP Convergence Layer here, right mouse click, I'm just going
1265480	1268600	to prepare it as a filter based on the selected value.
1268960	1269660	There it is.
1269660	1271440	That's what I want to build the button on.
1271540	1276240	So I'm going to click plus and give it a name, eBundle.
1276240	1278420	That means end of bundle to me.
1278620	1283720	So now if I want to see the end of bundle packets only, I can click on the second button.
1283720	1287160	I want to see the start, I can click on the first button.
1287340	1289680	I'm going to go ahead and clear this out.
1290040	1297080	Now you'll notice that after this bundle has been relayed from 3 to 4, there's this packet,
1297080	1303240	this strange packet here, where it has the start and end of bundle bits set on.
1303240	1305820	That means it's its own little bundle.
1306140	1310780	And this is actually a reporting packet.
1310900	1314020	So let's go inside of it and take a look.
1314420	1322480	Let me bring up this, let's see, I'm going to bring this sort of up so we see it up on
1322480	1323440	top.
1325360	1328760	And it is frame 49 we're interested in.
1328760	1334420	And when we look inside of frame number 49, we see the TCP convergence layer indicating
1334420	1337120	it's the start of a bundle and the end of a bundle also.
1337120	1339700	So we're obviously not transferring a bunch of data here.
1339900	1343900	And then we'll see the primary bundle header.
1344880	1350420	And if we look a little bit further in here, we will see a payload header.
1350620	1354400	And beyond this we have the administrative record.
1354400	1360580	So this is indicating right here that this is a bundle status report.
1360580	1362960	That's the purpose of this packet.
1363480	1369820	I don't want this packet to be colored red just because it hit the end of bundle coloring.
1369820	1372660	I want this packet to have its own coloring.
1372660	1377740	So I'm going to right mouse click on the line that says administrative record type, bundle
1377740	1384080	status report, and I'm going to choose to colorize this with a filter, make a new coloring
1384080	1391900	rule, there's that line, admin record type 1, and I'm just going to say that this is
1391900	1394160	the admin report.
1394620	1405520	I'm going to turn the background yellow for this one, say OK, and now there we go.
1405520	1408960	This is the admin report.
1408960	1415960	And that admin report is being sent from .3 to .1 to say that I successfully delivered
1415960	1418700	the bundle on for you.
1419180	1425300	So now let's go up and just take a look at some of the packets in here and how this works.
1426090	1432900	In frame number 14, Wireshark says this is a bundle segment.
1433820	1439080	And sure enough, if we look inside, we can see the data packets that were required to
1439080	1444620	make up this bundle segment, packet 11, packet 13, and packet 14, and we can see the amount
1444620	1449760	of data in each of those segments to make up, in each of those TCP segments to make
1449760	1451120	up this bundle segment.
1451220	1457320	And then when we look down at frame number 18, again on the right hand side, it says
1457320	1460380	bundle TCP CL segment.
1460640	1469840	And if we look inside of that frame, we can see which TCP segments were required to make
1469840	1472000	up this bundle segment.
1472000	1474540	And there's the weird one right there.
1475100	1483140	So some of the data that's in packet number 14 is part of bundle segment A, whereas some
1483140	1487060	of the data in packet 14 is part of bundle segment B.
1487060	1488680	The second bundle segment.
1489170	1490800	It's very interesting.
1490840	1493220	It's a bit of a different protocol.
1494120	1502440	And if we keep looking down here, in frame number 26, frame number 26 is listed here
1502440	1506160	as bundle TCP CL segment.
1506160	1514160	And if we look inside of there, we can see, oh let's see, 14, I think I did that one before.
1514160	1519520	Let's clear that out and let's go beyond that to the next bundle segment.
1520040	1521920	Oh, maybe I didn't, I don't remember.
1523280	1532260	So I'm clicking on frame number 26, and in frame 26, oh it just hadn't clicked, I didn't
1532260	1538020	click on frame 26 before, it was still selecting frame number 18.
1538280	1543840	So now I'm on frame number 26 that says some of its data is in frame number 18, some of
1543840	1547760	it is in 23, 24, and 26.
1550660	1558960	And then the last bundle segment is actually the one that finishes up the whole bundle.
1558960	1567660	So frame number 32, we can see its data, and if we look down here we can see exactly which
1567660	1574020	frames were required, which TCP segments were required to get this bundle segment across.
1574760	1580780	It is pretty, it can be pretty confusing to look at this because we have bundle segments
1580780	1584840	and then we have TCP segments, and they don't necessarily align.
1585700	1588880	Along the way here we had some ACKs showing up.
1588940	1596000	So here we have the first bundle segment up here, and then we have an ACK down here on
1596000	1597300	frame number 20.
1597300	1606380	This frame number 20 ACK that we see, it is acknowledging receipt of this bundle segment.
1608750	1616000	This ACK down here on frame 27 is going to be acknowledging this bundle segment.
1617510	1619340	The ACK counts up.
1619340	1625020	So if I look at frame 20, I see an acknowledgement saying ACK length 4096.
1625020	1629420	That was how much data was in the first bundle segment.
1629420	1637980	I go to the next ACK and it says now I'm ACKing up to 8192 bytes because it's now acknowledging
1637980	1640900	the second bundle segment.
1640900	1644180	We'll see the next ACK coming up right here.
1644180	1647860	This ACK is acknowledging the third bundle segment.
1647860	1657720	So this guy is acknowledging this bundle segment, which of course includes those packets.
1658440	1663920	And we can see that it's counted up to 12,288.
1663920	1673240	And then we have the last ACK here, which is counting up also the very last bundle segment.
1675340	1680620	It can be sort of confusing to see what's happening, especially when we have Wireshark's
1680620	1682700	reassembly feature built into it.
1682700	1688580	But what I did was I made a little TCP spreadsheet that goes through what's happening here.
1688580	1696280	We have bundle segment A, bundle segment B, bundle segment C, bundle segment D there.
1696360	1701600	And these are the frames required and the amount of data in each of those frames.
1701600	1704340	And we add the data up in the bundle segment.
1704340	1710280	We subtract 3 for the TCP convergence layer overhead, and that leaves us with the actual
1710280	1714440	segment of data, the amount of data in there.
1714440	1716600	Same thing here on the second one.
1716600	1719700	It required four packets to get this across.
1720000	1724760	Subtract the TCP CL overhead, and we're at 4096 here.
1725580	1728440	Another 4096 bundle segment.
1728440	1731200	And then the last one isn't quite as long.
1731200	1736840	So I'll bring that back in in a moment when we talk about the bundle header itself.
1738700	1745720	So all of that was the bundle being transferred from 10.0.0.1 to 10.0.0.3.
1745720	1754480	And then all of a sudden we see 10.0.0.3 transferring this data over to 10.0.0.4.
1756160	1757700	And the same thing.
1757700	1761060	We have data, data, data, data.
1761420	1768180	Interestingly enough, we have some acts that show up later, but for something else.
1770060	1777400	So when we look at this, let's reassemble what is being transferred across this network
1777400	1779920	as this bundle is being relayed.
1779920	1787580	We can go into any one of the Stream 1 packets and just right mouse click on the frame in
1787580	1793140	the packet list pane and select Follow TCP Stream.
1793440	1799220	This is the data that is being transferred by this bundle.
1799580	1808080	At the top of this bundle, you have these at signs and those are Keep Alives.
1808580	1813220	So when you click on those, you can see, you can click and that Wireshark will take you
1813220	1816040	to the Keep Alive packets in the background.
1816330	1822460	What is following that immediately, the next three bytes, is actually the TCP Convergence
1822460	1825080	Layer for the very first bundle.
1825640	1828900	After that, we have a Bundle Header.
1829540	1832680	And after that, this is all the Bundle Header.
1832680	1837960	And then after that, we have the Payload Header.
1839160	1847020	So, when we look at our segments going across, we have a Bundle Header that is applied only
1847020	1851560	on the first bundle segment.
1852480	1858100	Every single one of these bundle segments, though, starts with a TCP Convergence Layer
1858100	1859120	Header.
1859520	1863900	That's how we know it's the beginning of a bundle segment.
1864320	1871400	The very first bundle will be followed by a Bundle Header, and then it will be followed
1871400	1873200	by a Payload Header.
1873660	1878520	So these are the header structures that you would see in something like this.
1878520	1884320	We need to have that TCP CL Header in there because that provides us with the interface
1884320	1887040	between TCP and the Bundle Protocol.
1887040	1890480	It's kind of the shim between the two of them.
1891940	1897880	In this slide, I'm showing you the amount of data that is carried in each one of these
1898380	1900200	TCP segments.
1901180	1905720	And when we add those up, these are the payload values.
1905720	1912680	And when you look at the X, we just count up from 4096, then we count up from there
1913160	1915760	until we get to our final value.
1916580	1921460	Let me just finish up by taking you into the Bundle Header for a moment.
1923400	1931360	We're going to go all the way down here to... let's pull frame number 32.
1931760	1943600	This is the last frame of the bundle after it has been forwarded to... oh, wait... nope,
1943600	1945140	that's not the one I want.
1945140	1952020	I want to go up to the first... hang on, I've got a filter on there, no wonder.
1953840	1958800	Let's go to... it doesn't matter which one of the red packets we go to.
1958920	1962420	They'll basically have this very similar information in them.
1962420	1965620	I'm going to go to this frame 46, let's say.
1965620	1973580	That is the final packet of the bundle after it's been forwarded to 10.0.0.4.
1973580	1980700	And let's go into the Bundle Header... and let me bring the Bundle Header up in that
1980700	1981260	top window.
1981260	1982120	There we go.
1982640	1985640	There are some strange things about the Bundle Header here.
1985640	1990140	Like for example, one of the big things that catches people is that this Bundle Header
1990140	1994080	length field does not include the whole entire Bundle Header.
1994080	1998700	It includes only the fields that follow the Bundle Header length field.
1998700	2006120	So the Bundle Header is actually 49 bytes.
2006740	2013800	And then the Payload Header is another 4 bytes.
2013800	2023400	So this packet is telling me the last packet of each of the Bundle Segments.
2023400	2030240	And then I can see down here, this is the amount of payload.
2030240	2034880	Now this is different than the final ACK.
2034880	2039500	So if I come up here, and let me just show you what I'm talking about here.
2039500	2050320	This ACK right here that we saw, this ACK says that the amount of payload is 15,272
2051120	2052060	bytes.
2052060	2057820	Sure enough, that's what it is if we add up all of the payload from each of the Bundle
2057820	2058920	Segments.
2059560	2067240	But when we look inside of a Bundle Header to see how much payload it thinks has crossed
2067240	2071240	the network, it's giving us a different value.
2071240	2073660	It's giving us 15,219.
2073660	2080320	And the way it gets there is we have to subtract out the 49 bytes of the Bundle Header plus
2080320	2082220	the 4 bytes of the Payload Header.
2082220	2088160	We've got to get rid of 53 bytes from the extra Payload Headers and Bundle Headers at
2088160	2089080	the front.
2089080	2092960	So that's how we get to that particular number.
2093500	2100780	So I've shown you how we can add columns, I've shown you how we can add buttons into
2100780	2107580	Wireshark, and I've shown you how we can add coloring rules into Wireshark to make analyzing
2107580	2115460	the Bundle Protocol and the TCP Convergence Layer Protocol a little bit easier.