Some examples of UDP packets. ************************************************************************ DNS query from 192.168.23.107 to DNS server at 192.168.23.1 asking about www.yahoo.com Frame: 73 bytes Ethernet: Destination: 20:4e:7f:6e:b9:74 Source: e8:39:df:68:b7:f3 Type: IP (0x0800) Internet Protocol: Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 Total Length: 59 Identification: 0x68b0 (26800) Flags: 0x00 Fragment offset: 0 Time to live: 128 * Protocol: UDP (17) Header checksum: 0x2245 [correct] Source: 192.168.23.107 Destination: 192.168.23.1 User Datagram Protocol: {in IP's Data field} Source port: 59186 {ephemeral port used on this client} * Destination port: domain (53) {DNS server listens on port 53} Length: 39 Checksum: 0xa52f [validation disabled] Domain Name System (query) {in UPD's Data field} Transaction ID: 0xfc3a {various fields of DNS message} Flags: 0x0100 (Standard query) Questions: 1 Answer RRs: 0 Authority RRs: 0 Additional RRs: 0 * Queries www.yahoo.com: type A, class IN Name: www.yahoo.com Type: A (Host address) Class: IN (0x0001) ************************** Response from that DNS server: Frame: 203 bytes Ethernet: Destination: e8:39:df:68:b7:f3 Source: 20:4e:7f:6e:b9:74 Type: IP (0x0800) Internet Protocol: Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 Total Length: 189 Identification: 0x0a35 (2613) Flags: 0x02 (Don't Fragment) Fragment offset: 0 Time to live: 64 * Protocol: UDP (17) Header checksum: 0x803e [correct] Source: 192.168.23.1 Destination: 192.168.23.107 User Datagram Protocol: * Source port: domain (53) {from the DNS server listening at port 53} * Destination port: 59186 {to the DNS client using this ephemeral port} Length: 169 Checksum: 0xf698 [validation disabled] Domain Name System (response) {the various fields of DNS...} Transaction ID: 0xfc3a Flags: 0x8180 (Standard query response, No error) Questions: 1 Answer RRs: 6 Authority RRs: 0 Additional RRs: 0 Queries www.yahoo.com: type A, class IN * Answers www.yahoo.com: type CNAME, class IN, cname fd-fp3.wg1.b.yahoo.com fd-fp3.wg1.b.yahoo.com: type CNAME, class IN, cname ds-fp3.wg1.b.yahoo.com ds-fp3.wg1.b.yahoo.com: type CNAME, class IN, cname ds-fo-tw-sg.wg1.b.yahoo.com ds-fo-tw-sg.wg1.b.yahoo.com: type CNAME, class IN, cname ds-tw-fp3.wg1.b.yahoo.com ds-tw-fp3.wg1.b.yahoo.com: type A, class IN, addr 203.84.197.25 ds-tw-fp3.wg1.b.yahoo.com: type A, class IN, addr 203.84.197.9 ********************************************************************************** NTP client request from 192.168.23.107 to NTP server at 65.55.21.15 (NTP is a protocol to set the client's clock) Frame: 90 bytes Ethernet: Destination: 20:4e:7f:6e:b9:74 Source: e8:39:df:68:b7:f3 Type: IP (0x0800) Internet Protocol: Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 Total Length: 76 Identification: 0x67a0 (26528) Flags: 0x00 Fragment offset: 0 Time to live: 128 * Protocol: UDP (17) Header checksum: 0xa4a7 [correct] Source: 192.168.23.107 Destination: 65.55.21.15 User Datagram Protocol: {in IP packet's Data field} * Source port: ntp (123) * Destination port: ntp (123) {NTP client uses 123 as its ephemeral port} Length: 56 Checksum: 0xb147 [validation disabled] Network Time Protocol {in UPD Data field} Flags: 0xdb Peer Clock Stratum: unspecified or unavailable (0) Peer Polling Interval: 17 (131072 sec) Peer Clock Precision: 0.015625 sec Root Delay: 0.7153 sec Root Dispersion: 8.8497 sec Reference Clock ID: NULL Reference Clock Update Time: Sep 13, 2012 13:19:27.357313 UTC Originate Time Stamp: NULL Receive Time Stamp: NULL Transmit Time Stamp: Sep 17, 2012 10:21:25.483313 UTC ************************** NTP server response: Frame: 90 bytes Ethernet: Destination: e8:39:df:68:b7:f3 Source: 20:4e:7f:6e:b9:74 Type: IP (0x0800) Internet Protocol Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 Total Length: 76 Identification: 0x399d (14749) Flags: 0x00 Fragment offset: 0 Time to live: 44 * Protocol: UDP (17) Header checksum: 0x26ab [correct] Source: 65.55.21.15 Destination: 192.168.23.107 User Datagram Protocol: * Source port: ntp (123) * Destination port: ntp (123) Length: 56 Checksum: 0xb081 [validation disabled] Network Time Protocol Flags: 0x1c Peer Clock Stratum: secondary reference (2) Peer Polling Interval: 17 (131072 sec) Peer Clock Precision: 0.015625 sec Root Delay: 0.0468 sec Root Dispersion: 0.0441 sec Reference Clock ID: 132.163.4.102 Reference Clock Update Time: Sep 17, 2012 10:17:45.200395 UTC Originate Time Stamp: Sep 17, 2012 10:21:25.483313 UTC Receive Time Stamp: Sep 17, 2012 10:21:25.489395 UTC Transmit Time Stamp: Sep 17, 2012 10:21:25.489395 UTC