Packet Analysis: Advanced Techniques

Use hex signatures, statistics, talkers, conversations, and timing to diagnose IoT traffic

animation
packet-analysis
hex-dump
statistics
timing
mqtt
coap
http
zigbee
A guided packet analysis workbench for interpreting raw bytes and capture statistics together.
Animation Packet analysis Intermediate

Advanced Packet Analysis Workbench

Use raw bytes, statistics, top talkers, conversation pairs, and timing evidence together. A good packet diagnosis is not just "what protocol is this?" It is "what does the capture prove?"

CoAP CON POSTProtocol signature
Retry patternTraffic health
Sensor to gatewayConversation shape
Check loss pathNext action

Learning Path

Goal

Turn byte-level evidence and capture statistics into one clear troubleshooting conclusion.

Try First

Start with CoAP Retry. Step through the hex signature, then compare timing to the retry diagnosis.

Watch

The highlighted bytes identify protocol structure while the charts show whether behavior is normal.

Why It Matters

Parsers can fail or hide context. Hex and statistics help you defend the diagnosis from raw evidence.

Capture Scenario

A CoAP confirmable POST is repeated with the same message ID, which points to lost acknowledgements or an unreachable endpoint.

Playback

Packet List

Start with a selected packet, then collect evidence instead of jumping straight to a conclusion.
0x40 CoAP version/typeSignature evidence
2s, 4s, 8s retry spacingTiming evidence
Likely packet loss or no ACKWorking diagnosis

Hex Dump

green: protocol signature blue: length or ID yellow: ASCII payload red: warning evidence

Protocol Distribution

Top Talkers

Conversation Pairs

Packets Over Time

Repeated confirmable CoAP messages with the same message ID are a stronger retry clue than a single hex dump.

Hex Evidence

Hex helps when a parser fails or when you need to prove the exact bytes. Identify fixed headers, length fields, message IDs, and ASCII signatures before interpreting behavior.

Statistical Evidence

Protocol distribution, top talkers, and conversations explain capture shape: star topology, mesh relay, provisioning burst, retry storm, or one device going quiet.

Timing Evidence

Timing shows health. Periodic intervals are normal for sensors; repeated gaps, exponential retries, or sudden bursts usually point to a network or endpoint problem.

Common Signatures

  • MQTT CONNECT: fixed header 0x10 and ASCII MQTT.
  • MQTT PUBLISH: high nibble 0x3; the low nibble carries valid PUBLISH flags.
  • HTTP: ASCII GET, POST, HTTP, and CRLF CRLF.

CoAP Header

  • First two bits are version. Version 1 starts with 0x40 to 0x7f.
  • Next two bits are type: CON, NON, ACK, or RST.
  • Bytes 2 and 3 are the Message ID.

Analysis Order

  • Filter to the affected device or conversation.
  • Check the packet bytes and protocol fields.
  • Use statistics and timing before deciding root cause.

Practice 1

Choose Healthy MQTT. Which bytes prove the selected packet is an MQTT PUBLISH rather than a CONNECT?

Practice 2

Choose CoAP Retry. What is repeated: source, destination, message ID, timing pattern, or all of them?

Practice 3

Choose Sensor Outage. Why is the valid MQTT hex not enough to prove that MQTT is the root cause?

Related Study

Packet Capture Analyzer Packet Analysis Layers IoT Protocol Scenarios Network Conditions Emulator