let' test out our previous code to see what kind of information we are extracting from the raw packets being sent definitely recommend that you do this test from your windows machineas you will be able to see tcpudpand icmpwhich allows you to do some pretty neat testing (open up browserfor exampleif you are confined to linuxthen perform the previous ping test to see it in action open terminal and typepython sniffer_ip_header_decode py nowbecause windows is pretty chattyyou're likely to see output immediately tested this script by opening internet explorer and going to www google comand here is the output from our scriptprotocoludp - protocoludp - protocoludp - protocoltcp - protocoltcp - protocoltcp - protocoltcp - because we aren' doing any deep inspection on these packetswe can only guess what this stream is indicating my guess is that the first couple of udp packets are the dns queries to determine where google com livesand the subsequent tcp sessions are my machine actually connecting and downloading content from their web server to perform the same test on linuxwe can ping google comand the results will look something like thisprotocolicmp - protocolicmp - protocolicmp - you can already see the limitationwe are only seeing the response and only for the icmp protocol but because we are purposefully building host discovery scannerthis is completely acceptable we will now apply the same techniques we used to decode the ip header to decode the icmp messages