Every packet that moves across a network carries structured metadata in its headers, and this metadata governs how the packet is routed, delivered, and processed. By systematically analyzing these headers, security analysts can detect anomalies, identify attack signatures, and reconstruct the sequence of events during a security incident.
This report provides a structured methodology for analyzing packet headers within the framework of the Open Systems Interconnection (OSI) model. Each layer of the OSI model contributes distinct header types, and each header carries fields that are relevant to specific categories of security threats. The analysis is grounded in practical steps using Wireshark, the industry-standard protocol analyzer, which provides both graphical and command-line interfaces for deep packet inspection.
For each header type covered, this report identifies the header structure and length, the specific fields most relevant to security analysis, the attack scenarios that make analysis of that header necessary, and step-by-step instructions for performing the analysis in Wireshark.
| OSI Layer | Protocol / Header | Typical Length | Wireshark Filter | Security Use Case |
|---|---|---|---|---|
| 2 | Ethernet II | 14 bytes | eth |
MAC spoofing detection, VLAN hopping |
| 3 | IPv4 | 20–60 bytes | ip |
IP spoofing, fragmentation attacks |
| 3 | IPv6 | 40 bytes (fixed) | ipv6 |
Extension header abuse, tunneling |
| 3 | ARP | 28 bytes | arp |
ARP poisoning and cache attacks |
| 3 | ICMP | 8 bytes minimum | icmp |
Ping floods, covert channels |
| 4 | TCP | 20–60 bytes | tcp |
SYN floods, port scans, session hijack |
| 4 | UDP | 8 bytes (fixed) | udp |
DNS amplification, reflection attacks |
| 7 | HTTP/1.1 | Variable | http |
Injection, header manipulation |
| 7 | DNS | 12 bytes (header) | dns |
DNS tunneling, cache poisoning |
| 7 | TLS | 5 bytes (record) | tls |
Downgrade attacks, cert validation |
Header length: 14 bytes (fixed). The Ethernet II frame header consists of a 6-byte destination MAC address, a 6-byte source MAC address, and a 2-byte EtherType field that identifies the encapsulated protocol (for example, 0x0800 for IPv4 or 0x0806 for ARP). If 802.1Q VLAN tagging is present, an additional 4-byte tag is inserted before the EtherType, extending the effective header to 18 bytes.
Security relevance: Ethernet header analysis is critical for detecting MAC address spoofing, where an attacker forges source MAC addresses to impersonate legitimate devices or bypass port-based access controls. It is also essential for identifying VLAN hopping attacks, where crafted 802.1Q tags allow traffic to escape its intended VLAN segment.
In forensic investigations, correlating MAC addresses with known device inventories helps identify rogue devices on the network:
Wireshark procedure: Apply the display filter eth.src == aa:bb:cc:dd:ee:ff to isolate traffic from a specific source MAC address. To detect potential spoofing, use the Statistics menu and select Endpoints, then sort by the Ethernet tab to identify MAC addresses that appear with multiple IP addresses. To inspect VLAN tags, filter with vlan.id == 100 to isolate traffic tagged for a particular VLAN. Examining the EtherType field (eth.type) helps identify unusual or unexpected protocols being carried on the network segment.
Header length: 28 bytes for IPv4 over Ethernet. The ARP header includes hardware and protocol type fields, address lengths, an operation code (1 for request, 2 for reply), followed by the sender and target hardware (MAC) and protocol (IP) address pairs.
Security relevance: ARP operates without authentication, making it inherently vulnerable to ARP poisoning (also called ARP spoofing). In this attack, a malicious host sends gratuitous ARP replies to associate its own MAC address with the IP address of another host, such as the default gateway. This enables man-in-the-middle interception of all traffic intended for that IP. Detecting ARP anomalies is one of the most common and high-impact tasks at Layer 2.
Wireshark procedure: Apply the filter arp to view all ARP traffic. To detect poisoning, look for multiple ARP replies (arp.opcode == 2) that map different MAC addresses to the same IP address within a short time window. Wireshark's built-in Expert Information system (Analyze > Expert Information) will flag duplicate IP-to-MAC mappings automatically. Additionally, filter with arp.duplicate-address-detected to see Wireshark's own alerts about conflicting ARP entries.