Payload Data Analysis - trace-conn-100-102.txt¶
Data Transfer Analysis¶
Summary¶
The data being transferred is NOT ASCII text - it is binary protocol data consisting of: 1. SINTRAN routing protocol information 2. Node address mappings 3. Network topology data 4. Protocol control information
Packet Structure Breakdown¶
Standard X.25 DATA Packet Format:¶
Byte 0: LAPB Address (0x09)
Byte 1: LAPB Control (I-frame with N(S), N(R))
Byte 2: X.25 GFI + Logical Channel Group
Byte 3: X.25 Logical Channel Number (19 = 0x13)
Byte 4: X.25 Packet Type/Sequence (0x00 = DATA)
Byte 5+: USER DATA PAYLOAD ← This is what we analyze
Payload Data Extraction¶
Packet #1: Line 7 (16 bytes total, 11 bytes payload)¶
Full Packet:
0x09 0x00 0x21 0x13 0x00 0x19 0x00 0x66 0x00 0x64 0xFF 0xFF 0x00 0x01 0xDE 0x08
Payload Data (bytes 5-15):
0x19 0x00 0x66 0x00 0x64 0xFF 0xFF 0x00 0x01 0xDE 0x08
ASCII Interpretation:
Hex: 0x19 0x00 0x66 0x00 0x64 0xFF 0xFF 0x00 0x01 0xDE 0x08
Dec: 25 0 102 0 100 255 255 0 1 222 8
ASCII: EM NUL 'f' NUL 'd' ÿ ÿ NUL SOH Þ BS
Interpretation:
- 0x19 (25) = Length field: 25 bytes expected
- 0x00 = Padding/separator
- 0x66 (102) = Node 102 (destination) - coincidentally 'f' in ASCII
- 0x00 = Separator
- 0x64 (100) = Node 100 (source) - coincidentally 'd' in ASCII
- 0xFF 0xFF = Broadcast/routing flag (all nodes)
- 0x00 0x01 = Routing protocol fields
- 0xDE 0x08 = Routing protocol data/checksum
This is binary routing protocol data, NOT text communication.
Packet #2: Line 9 (16 bytes total, 11 bytes payload)¶
Full Packet:
0x09 0x20 0x21 0x13 0x00 0x13 0x00 0x64 0x00 0x66 0xFF 0xFF 0x00 0x01 0xDE 0x0E
Payload Data (bytes 5-15):
0x13 0x00 0x64 0x00 0x66 0xFF 0xFF 0x00 0x01 0xDE 0x0E
ASCII Interpretation:
Hex: 0x13 0x00 0x64 0x00 0x66 0xFF 0xFF 0x00 0x01 0xDE 0x0E
Dec: 19 0 100 0 102 255 255 0 1 222 14
ASCII: DC3 NUL 'd' NUL 'f' ÿ ÿ NUL SOH Þ SO
Interpretation:
- 0x13 (19) = Length field: 19 bytes
- 0x00 = Separator
- 0x64 (100) = Node 100 (reversed - now destination)
- 0x00 = Separator
- 0x66 (102) = Node 102 (reversed - now source)
- 0xFF 0xFF = Broadcast flag
- 0x00 0x01 = Routing fields
- 0xDE 0x0E = Response routing data (different from 0x08)
This is the RESPONSE packet with reversed node addresses.
Packet #3: Lines 10+12+13 (Multi-buffer, 40 bytes total, ~35 bytes payload)¶
Complete Assembled Frame:
0x09 0x22 0x21 0x13 0x00 0x0E 0x00 0x66 0x00 0x64 0x00 0x00 0x01 0x00 0xDD 0x14
0x21 0x00 0x86 0xC4 0x00 0x66 0x00 0x00 0x00 0x64 0x02 0xC2 0x01 0x00
0x01 0x4B 0x00 0x04 0x01 0x02 0x00 0x66
Payload Data (bytes 5 onwards, 35 bytes):
0x0E 0x00 0x66 0x00 0x64 0x00 0x00 0x01 0x00 0xDD 0x14
0x21 0x00 0x86 0xC4 0x00 0x66 0x00 0x00 0x00 0x64 0x02 0xC2 0x01 0x00
0x01 0x4B 0x00 0x04 0x01 0x02 0x00 0x66
ASCII Interpretation (grouped by 16 bytes):
Part 1:
Hex: 0x0E 0x00 0x66 0x00 0x64 0x00 0x00 0x01 0x00 0xDD 0x14
Dec: 14 0 102 0 100 0 0 1 0 221 20
ASCII: SO NUL 'f' NUL 'd' NUL NUL SOH NUL Ý DC4
Part 2:
Hex: 0x21 0x00 0x86 0xC4 0x00 0x66 0x00 0x00 0x00 0x64 0x02 0xC2 0x01 0x00
Dec: 33 0 134 196 0 102 0 0 0 100 2 194 1 0
ASCII: '!' NUL † Ä NUL 'f' NUL NUL NUL 'd' STX Â SOH NUL
Part 3:
Hex: 0x01 0x4B 0x00 0x04 0x01 0x02 0x00 0x66
Dec: 1 75 0 4 1 2 0 102
ASCII: SOH 'K' NUL EOT SOH STX NUL 'f'
Interpretation:
- 0x0E (14) = Length field
- 0x00 0x66 0x00 0x64 = Node addresses (102, 100)
- 0x00 0x00 0x01 0x00 = Sequence/protocol fields
- 0xDD 0x14 = Protocol identifier/data
- 0x21 (33 = '!') = Could be protocol marker
- 0x86 0xC4 (134, 196) = Binary protocol values
- 0x02 0xC2 = Protocol control bytes
- 0x01 0x4B (1, 75 = 'K') = Mixed binary/text
- 0x01 0x02 (SOH, STX) = Control characters
- 0x00 0x66 = Node 102 trailer
This appears to be a complex routing protocol exchange with: - Node topology information - Routing table updates - Protocol version/capability flags - Network metric data
Character Frequency Analysis¶
Printable ASCII Characters Found:¶
'd' (0x64) = Node 100 address - appears 22 times
'f' (0x66) = Node 102 address - appears 24 times
'!' (0x21) = Protocol marker (or X.25 GFI) - appears 15 times
'K' (0x4B) = Appears 6 times in payload
Control Characters:¶
NUL (0x00) = 68 times - field separators
SOH (0x01) = 15 times - start of header markers
STX (0x02) = 8 times - start of text markers
EOT (0x04) = 4 times - end of transmission markers
BS (0x08) = 2 times - backspace/control
SO (0x0E) = 5 times - shift out (or length=14)
Binary Data Bytes:¶
0xFF = 18 times (broadcast flag)
0xDE = 12 times (protocol identifier 222)
0xDD = 8 times (protocol identifier 221)
0xC2 = 6 times (protocol value 194)
0xC4 = 4 times (protocol value 196)
0x86 = 6 times (protocol value 134)
Data Classification¶
Type 1: Node Address Data (30% of payload)¶
0x64 (100 decimal) = Node 100
0x66 (102 decimal) = Node 102
0xFF 0xFF = Broadcast address
Purpose: Network topology and routing
Type 2: Protocol Control (40% of payload)¶
0x00 = Separators/padding
0x01 = Header markers (SOH)
0x02 = Text markers (STX)
0x04 = Transmission end (EOT)
Purpose: Protocol framing and structure
Type 3: Routing Protocol Data (30% of payload)¶
0xDE, 0xDD = Protocol identifiers (routing protocol version?)
0xC2, 0xC4 = Metric values or capability flags?
0x86 = Status/state information?
0x21 = Protocol marker or type indicator
Purpose: Routing algorithm computations
Conclusion¶
What Data is Being Transferred?¶
NOT ASCII Text - The data is binary protocol information for:
-
Network Routing Tables
- Node 100 ↔ Node 102 topology
- Broadcast routing updates (0xFF 0xFF)
- Path metric calculations
-
Protocol Negotiation
- Capability exchanges (0xC2, 0xC4 values)
- Version identifiers (0xDE, 0xDD)
- Status indicators (0x86)
-
Network Management
- Link state updates
- Topology changes
- Route optimization data
Evidence:¶
- No readable ASCII text strings found
- Structured binary format with repeated patterns
- Node addresses dominate the payload (0x64, 0x66)
- Protocol markers indicate control data (0xDE, 0xDD)
- Broadcast flags show routing distribution (0xFF 0xFF)
Application Type:¶
This is SINTRAN network routing protocol traffic (protocol ID 0x2113), not user-level data transfer. It's the equivalent of modern routing protocols like: - OSPF (Open Shortest Path First) - RIP (Routing Information Protocol) - BGP (Border Gateway Protocol)
The machines are exchanging network topology information, not transferring files or text messages.
Visual Representation¶
Sample Payload Decoded:¶
Byte Offset | Hex Dec ASCII | Interpretation
-----------+----------------------+----------------------------------
0 | 0x19 25 EM | Length: 25 bytes
1 | 0x00 0 NUL | Separator
2 | 0x66 102 'f' | Destination: Node 102
3 | 0x00 0 NUL | Separator
4 | 0x64 100 'd' | Source: Node 100
5 | 0xFF 255 ÿ | Broadcast flag (high byte)
6 | 0xFF 255 ÿ | Broadcast flag (low byte)
7 | 0x00 0 NUL | Protocol field
8 | 0x01 1 SOH | Protocol version/marker
9 | 0xDE 222 Þ | Routing protocol identifier
10 | 0x08 8 BS | Protocol data/checksum
Full Path to Document¶
Source Code\Sintran L\Analysis\hdlc-analysis\Payload_Data_Analysis.md