Analyzing packets on UDP

The user datagram protocol (UDP) is used primarily for real-time communications and in situations where speed matters. The UDP header size is 8 bytes compared to 20 in TCP. A UDP packet does not have segment acknowledgment and is usually much faster, since it is a connectionless protocol. Also, error checking is still a part of UDP, but no reporting of errors takes place. A common example of UDP is Voice over Internet Protocol (VoIP). Comparing to the structure we discussed in the very beginning of the chapter, we have the following structure for UDP:

We can see that we have so many fields reduced and primarily have ...

Get Hands-On Network Forensics now with the O’Reilly learning platform.

O’Reilly members experience books, live events, courses curated by job role, and more from O’Reilly and nearly 200 top publishers.