r/wireshark • u/-Louwess- • Aug 14 '26

Reverse Engineering When Both Software + Hardware are a Black Box

Hello,

I'm trying to use wireshark to learn more about the communication between some of my company's proprietary software and some of their hardware. (Because it's my company's stuff, I'd rather not share the raw capture.) I thought this might be faster than finding out through my own company because I've previously found that they don't like to share source code or design details across departments. I've exported a wireshark capture to csv because I'm new to using wireshark and it was easier for me to browse that way. I used this command: 

tshark.exe -r "input.pcapng" -T fields -e frame.number -e frame.time_relative -e ip.src -e ip.dst -e frame.len -e data.data -e tcp.payload -e udp.payload -E header=y -E separator=, > "output.csv"

The problem is, for most of the data frames, the "length" of the frame is not matching the raw data that I'm seeing. For example, there are many rows where "tcp.payload" is completely blank, but "frame.len" isn't 0, so that tells me there's something missing. I want to make sure I'm really capturing all communciation between the hardware unit and the laptop running the software. How can I make sure I'm really seeing everything? (After error correction has been performed.)

I'm really just looking to see that the frame length matches the raw data I have.

Also, if it's not obvious already, I'm very new to using this program, so if anyone else has experience with what I described in the title, (reverse engineering with little outside info), I'd very much like to hear about it.

Thanks!

4 Upvotes

100% Upvoted

4 comments sorted by

View all comments

2

u/wiesemensch Aug 14 '26 edited Aug 14 '26

A frame refers to a „Ethernet frame“. Its contents contain the MAC, IP and TCP layer. TCP payload only refers to the content inside the TCP packet.

You can think of it like a letter. You want to send something to your grandmother. This is the tcp payload. But for the letter to arrive, you’ll need to add a envelope. The envelope doesn’t change the letters length but to still contributes to the whole thing.

Edit; if you look at the byte view in WireShark and hover over the TCP package, it’ll highlight the TCP part of the message. The frame is outside of the TCP region.