<?xml version="1.0" encoding="UTF-8"?>
<xliff xmlns="urn:oasis:names:tc:xliff:document:1.1" version="1.1">
  <file original="NoName" source-language="en" datatype="plaintext" target-language="en">
    <body>
      <trans-unit xml:space="preserve" approved="no" id="156a3742bf2df8c6" weblate-flags="read-only">
        <source>Analyzing packet traces</source>
        <target state="translated">Analyzing packet traces</target>
        <context-group name="" purpose="location">
          <context context-type="sourcefile">../../exercises/trace.rst</context>
          <context context-type="linenumber">6</context>
        </context-group>
      </trans-unit>
      <trans-unit xml:space="preserve" approved="no" id="b5d0ad218d04bd7d" weblate-flags="read-only">
        <source>When debugging networking problems or to figure out performance problems, it is sometimes useful to capture the segments that are exchanged between two hosts and to analyze them.</source>
        <target state="translated">When debugging networking problems or to figure out performance problems, it is sometimes useful to capture the segments that are exchanged between two hosts and to analyze them.</target>
        <context-group name="" purpose="location">
          <context context-type="sourcefile">../../exercises/trace.rst</context>
          <context context-type="linenumber">8</context>
        </context-group>
      </trans-unit>
      <trans-unit xml:space="preserve" approved="no" id="7baa0e28ead868d2" weblate-flags="read-only">
        <source>Several packet trace analysis tools are available, either as commercial or open-source tools. These tools are able to capture all the packets exchanged on a link. Of course, capturing packets require administrator privileges. They can also analyze the content of the captured packets and display information about them. The captured packets can be stored in a file for offline analysis.</source>
        <target state="translated">Several packet trace analysis tools are available, either as commercial or open-source tools. These tools are able to capture all the packets exchanged on a link. Of course, capturing packets require administrator privileges. They can also analyze the content of the captured packets and display information about them. The captured packets can be stored in a file for offline analysis.</target>
        <context-group name="" purpose="location">
          <context context-type="sourcefile">../../exercises/trace.rst</context>
          <context context-type="linenumber">10</context>
        </context-group>
      </trans-unit>
      <trans-unit xml:space="preserve" approved="no" id="0fd8167843210c1a" weblate-flags="read-only">
        <source>tcpdump_ is probably one of the most well known packet capture software. It is able to both capture packets and display their content. tcpdump_ is a text-based tool that can display the value of the most important fields of the captured packets. Additional information about tcpdump_ may be found in :manpage:`tcpdump(1)`.</source>
        <target state="translated">tcpdump_ is probably one of the most well known packet capture software. It is able to both capture packets and display their content. tcpdump_ is a text-based tool that can display the value of the most important fields of the captured packets. Additional information about tcpdump_ may be found in :manpage:`tcpdump(1)`.</target>
        <context-group name="" purpose="location">
          <context context-type="sourcefile">../../exercises/trace.rst</context>
          <context context-type="linenumber">12</context>
        </context-group>
      </trans-unit>
      <trans-unit xml:space="preserve" approved="no" id="9ccd8e1f8af9f66e" weblate-flags="read-only">
        <source>As an illustration, let us use tcpdump_ to analyze the packets exchanged while executing the following command on a Linux host:</source>
        <target state="translated">As an illustration, let us use tcpdump_ to analyze the packets exchanged while executing the following command on a Linux host:</target>
        <context-group name="" purpose="location">
          <context context-type="sourcefile">../../exercises/trace.rst</context>
          <context context-type="linenumber">15</context>
        </context-group>
      </trans-unit>
      <trans-unit xml:space="preserve" approved="no" id="83548722d015698c" weblate-flags="read-only">
        <source>The ``-6`` parameter passed to curl_ forces the utilization of IPv6. curl_ returns an HTML page that indicates that https must be used instead of http to access this web site.</source>
        <target state="translated">The ``-6`` parameter passed to curl_ forces the utilization of IPv6. curl_ returns an HTML page that indicates that https must be used instead of http to access this web site.</target>
        <context-group name="" purpose="location">
          <context context-type="sourcefile">../../exercises/trace.rst</context>
          <context context-type="linenumber">28</context>
        </context-group>
      </trans-unit>
      <trans-unit xml:space="preserve" approved="no" id="48433b4175999ce5" weblate-flags="read-only">
        <source>A first solution to analyze this trace is to use tcpdump_ on the command line. The `-n` disables the reverse DNS lookups that tcpdump_ does by default for all IP addresses. The `-r` argument is the name of the file contained the captured packets. The trace starts with the DNS request. This request was sent over IPv4 which is the default on this host. tcpdump_ indicates the query and the response returned by the local DNS resolver.</source>
        <target state="translated">A first solution to analyze this trace is to use tcpdump_ on the command line. The `-n` disables the reverse DNS lookups that tcpdump_ does by default for all IP addresses. The `-r` argument is the name of the file contained the captured packets. The trace starts with the DNS request. This request was sent over IPv4 which is the default on this host. tcpdump_ indicates the query and the response returned by the local DNS resolver.</target>
        <context-group name="" purpose="location">
          <context context-type="sourcefile">../../exercises/trace.rst</context>
          <context context-type="linenumber">35</context>
        </context-group>
      </trans-unit>
      <trans-unit xml:space="preserve" approved="no" id="1c6947b5b08bebb9" weblate-flags="read-only">
        <source>The following three lines of the tcpdump_ output correspond to TCP's three-way handshake. There are several interesting points to note in this output. First, ``Flags [S]`` indicates that the `SYN` flag was set in the first and second segments. In this first segment, tcpdump_ indicates the initial sequence number (``2681184541``). In the second segment, tcpdump_ indicates both the initial sequence number (``3804204915``) and the acknowledgment number (``2681184542``). Both segments contain TCP options. Starting in the third segment, tcpdump_ shows relative sequence numbers. Thus, the acknowledgment that you observe in the third segment is an acknowledgment for the `SYN` returned by the server.</source>
        <target state="translated">The following three lines of the tcpdump_ output correspond to TCP's three-way handshake. There are several interesting points to note in this output. First, ``Flags [S]`` indicates that the `SYN` flag was set in the first and second segments. In this first segment, tcpdump_ indicates the initial sequence number (``2681184541``). In the second segment, tcpdump_ indicates both the initial sequence number (``3804204915``) and the acknowledgment number (``2681184542``). Both segments contain TCP options. Starting in the third segment, tcpdump_ shows relative sequence numbers. Thus, the acknowledgment that you observe in the third segment is an acknowledgment for the `SYN` returned by the server.</target>
        <context-group name="" purpose="location">
          <context context-type="sourcefile">../../exercises/trace.rst</context>
          <context context-type="linenumber">45</context>
        </context-group>
      </trans-unit>
      <trans-unit xml:space="preserve" approved="no" id="02113d1637cb84db" weblate-flags="read-only">
        <source>The two lines above correspond to the request sent by the client and the acknowledgment returned by the server. Note that the first byte sent by the client has `1` as relative sequence number. In this example, the HTTP request has a total length of 92 bytes. This request is immediately acknowledged by the server.</source>
        <target state="translated">The two lines above correspond to the request sent by the client and the acknowledgment returned by the server. Note that the first byte sent by the client has `1` as relative sequence number. In this example, the HTTP request has a total length of 92 bytes. This request is immediately acknowledged by the server.</target>
        <context-group name="" purpose="location">
          <context context-type="sourcefile">../../exercises/trace.rst</context>
          <context context-type="linenumber">59</context>
        </context-group>
      </trans-unit>
      <trans-unit xml:space="preserve" approved="no" id="e9022802e7d2f7d3" weblate-flags="read-only">
        <source>The server then sends its response, which fits inside a single segment. The client acknowledges the reception of this segment.</source>
        <target state="translated">The server then sends its response, which fits inside a single segment. The client acknowledges the reception of this segment.</target>
        <context-group name="" purpose="location">
          <context context-type="sourcefile">../../exercises/trace.rst</context>
          <context context-type="linenumber">62</context>
        </context-group>
      </trans-unit>
      <trans-unit xml:space="preserve" approved="no" id="ed8a58117a3999b8" weblate-flags="read-only">
        <source>The TCP connection is then closed by exchanging three segments, the first two having the `FIN` flag set.</source>
        <target state="translated">The TCP connection is then closed by exchanging three segments, the first two having the `FIN` flag set.</target>
        <context-group name="" purpose="location">
          <context context-type="sourcefile">../../exercises/trace.rst</context>
          <context context-type="linenumber">71</context>
        </context-group>
      </trans-unit>
      <trans-unit xml:space="preserve" approved="no" id="74f8062660d0a788" weblate-flags="read-only">
        <source>tcpdump_ can provide more detailed information about the packets by using the `-v` or `-vv` option.</source>
        <target state="translated">tcpdump_ can provide more detailed information about the packets by using the `-v` or `-vv` option.</target>
        <context-group name="" purpose="location">
          <context context-type="sourcefile">../../exercises/trace.rst</context>
          <context context-type="linenumber">79</context>
        </context-group>
      </trans-unit>
      <trans-unit xml:space="preserve" approved="no" id="a7efd88c7aa87e69" weblate-flags="read-only">
        <source>wireshark_ is more recent than tcpdump_. It evolved from the ethereal packet trace analysis software. It can be used as a text tool like tcpdump_. For a TCP connection, wireshark_ can provide almost the same output as tcpdump_. The main advantage of wireshark_ is that it also includes a graphical user interface that allows performing various types of analysis on a packet trace.</source>
        <target state="translated">wireshark_ is more recent than tcpdump_. It evolved from the ethereal packet trace analysis software. It can be used as a text tool like tcpdump_. For a TCP connection, wireshark_ can provide almost the same output as tcpdump_. The main advantage of wireshark_ is that it also includes a graphical user interface that allows performing various types of analysis on a packet trace.</target>
        <context-group name="" purpose="location">
          <context context-type="sourcefile">../../exercises/trace.rst</context>
          <context context-type="linenumber">82</context>
        </context-group>
      </trans-unit>
      <trans-unit xml:space="preserve" approved="no" id="1f616dce2f23efc4" weblate-flags="read-only">
        <source>Wireshark : default window</source>
        <target state="translated">Wireshark : default window</target>
        <context-group name="" purpose="location">
          <context context-type="sourcefile">../../exercises/trace.rst</context>
          <context context-type="linenumber">88</context>
        </context-group>
      </trans-unit>
      <trans-unit xml:space="preserve" approved="no" id="0ccebcb4bf3b4773" weblate-flags="read-only">
        <source>The wireshark_ window is divided in three parts. The top part of the window is a summary of the first packets from the trace. By clicking on one of the lines, you can show the detailed content of this packet in the middle part of the window. The middle of the window allows you to inspect all the fields of the captured packet. The bottom part of the window is the hexadecimal representation of the packet, with the field selected in the middle window being highlighted.</source>
        <target state="translated">The wireshark_ window is divided in three parts. The top part of the window is a summary of the first packets from the trace. By clicking on one of the lines, you can show the detailed content of this packet in the middle part of the window. The middle of the window allows you to inspect all the fields of the captured packet. The bottom part of the window is the hexadecimal representation of the packet, with the field selected in the middle window being highlighted.</target>
        <context-group name="" purpose="location">
          <context context-type="sourcefile">../../exercises/trace.rst</context>
          <context context-type="linenumber">94</context>
        </context-group>
      </trans-unit>
      <trans-unit xml:space="preserve" approved="no" id="81d9846c9bf7a745" weblate-flags="read-only">
        <source>wireshark_ is very good at displaying packets, but it also contains several analysis tools that can be very useful. The first tool is `Follow TCP stream`. It is part of the `Analyze` menu and allows you to reassemble and display all the payload exchanged during a TCP connection. This tool can be useful if you need to analyze for example the commands exchanged during an HTTP or SMTP session.</source>
        <target state="translated">wireshark_ is very good at displaying packets, but it also contains several analysis tools that can be very useful. The first tool is `Follow TCP stream`. It is part of the `Analyze` menu and allows you to reassemble and display all the payload exchanged during a TCP connection. This tool can be useful if you need to analyze for example the commands exchanged during an HTTP or SMTP session.</target>
        <context-group name="" purpose="location">
          <context context-type="sourcefile">../../exercises/trace.rst</context>
          <context context-type="linenumber">96</context>
        </context-group>
      </trans-unit>
      <trans-unit xml:space="preserve" approved="no" id="fed33221d179f115" weblate-flags="read-only">
        <source>The second tool is the flow graph that is part of the `Statistics` menu. It provides a time sequence diagram of the packets exchanged with some comments about the packet contents. See below for an example.</source>
        <target state="translated">The second tool is the flow graph that is part of the `Statistics` menu. It provides a time sequence diagram of the packets exchanged with some comments about the packet contents. See below for an example.</target>
        <context-group name="" purpose="location">
          <context context-type="sourcefile">../../exercises/trace.rst</context>
          <context context-type="linenumber">98</context>
        </context-group>
      </trans-unit>
      <trans-unit xml:space="preserve" approved="no" id="c9a701c3ac82c33e" weblate-flags="read-only">
        <source>Wireshark : flow graph</source>
        <target state="translated">Wireshark : flow graph</target>
        <context-group name="" purpose="location">
          <context context-type="sourcefile">../../exercises/trace.rst</context>
          <context context-type="linenumber">104</context>
        </context-group>
      </trans-unit>
      <trans-unit xml:space="preserve" approved="no" id="6b9320609d6ccbd8" weblate-flags="read-only">
        <source>Use wireshark to analyze the packet traces described earlier :download:`traces/simple-trace.pcap`.</source>
        <target state="translated">Use wireshark to analyze the packet traces described earlier :download:`traces/simple-trace.pcap`.</target>
        <context-group name="" purpose="location">
          <context context-type="sourcefile">../../exercises/trace.rst</context>
          <context context-type="linenumber">107</context>
        </context-group>
      </trans-unit>
      <trans-unit xml:space="preserve" approved="no" id="d16e6349910a21b9" weblate-flags="read-only">
        <source>When analyzing packet traces with wireshark_, it is often very useful to use `Display filters` that only show the packets that match some specific criteria. There filters are described in several online documents:</source>
        <target state="translated">When analyzing packet traces with wireshark_, it is often very useful to use `Display filters` that only show the packets that match some specific criteria. There filters are described in several online documents:</target>
        <context-group name="" purpose="location">
          <context context-type="sourcefile">../../exercises/trace.rst</context>
          <context context-type="linenumber">109</context>
        </context-group>
      </trans-unit>
      <trans-unit xml:space="preserve" approved="no" id="5ac5d037969b361c" weblate-flags="read-only">
        <source>the `wireshark wiki &lt;https://wiki.wireshark.org/&gt;` page on `Display filters &lt;https://wiki.wireshark.org/DisplayFilters&gt;`_</source>
        <target state="translated">the `wireshark wiki &lt;https://wiki.wireshark.org/&gt;` page on `Display filters &lt;https://wiki.wireshark.org/DisplayFilters&gt;`_</target>
        <context-group name="" purpose="location">
          <context context-type="sourcefile">../../exercises/trace.rst</context>
          <context context-type="linenumber">111</context>
        </context-group>
      </trans-unit>
      <trans-unit xml:space="preserve" approved="no" id="aa24262c6fb32cfa" weblate-flags="read-only">
        <source>a nice `list of Wireshark Display Filters &lt;https://networksecuritytools.com/list-wireshark-display-filters/&gt;`_ by Robert Allen</source>
        <target state="translated">a nice `list of Wireshark Display Filters &lt;https://networksecuritytools.com/list-wireshark-display-filters/&gt;`_ by Robert Allen</target>
        <context-group name="" purpose="location">
          <context context-type="sourcefile">../../exercises/trace.rst</context>
          <context context-type="linenumber">112</context>
        </context-group>
      </trans-unit>
      <trans-unit xml:space="preserve" approved="no" id="a76d971d1c689ebb" weblate-flags="read-only">
        <source>You can now use your understanding of wireshark_ and tcpdump_ to analyze a 2-minutes long packet trace.</source>
        <target state="translated">You can now use your understanding of wireshark_ and tcpdump_ to analyze a 2-minutes long packet trace.</target>
        <context-group name="" purpose="location">
          <context context-type="sourcefile">../../exercises/trace.rst</context>
          <context context-type="linenumber">114</context>
        </context-group>
      </trans-unit>
    </body>
  </file>
</xliff>
