Analyzing packets on UDP

The user datagram protocol (UDP) is used primarily for real-time communications and in situations where speed matters. The UDP header size is 8 bytes compared to 20 in TCP. A UDP packet does not have segment acknowledgment and is usually much faster, since it is a connectionless protocol. Also, error checking is still a part of UDP, but no reporting of errors takes place. A common example of UDP is Voice over Internet Protocol (VoIP). Comparing to the structure we discussed in the very beginning of the chapter, we have the following structure for UDP:

We can see that we have so many fields reduced and primarily have ...

Get Hands-On Network Forensics now with O’Reilly online learning.

O’Reilly members experience live online training, plus books, videos, and digital content from 200+ publishers.