--- title: "Getting Started" slug: "application-packetscope2-getting-started" updated: 2026-05-30T13:52:40Z published: 2026-05-30T13:52:40Z canonical: "docs.fmad.io/application-packetscope2-getting-started" --- > ## Documentation Index > Fetch the complete documentation index at: https://docs.fmad.io/llms.txt > Use this file to discover all available pages before exploring further. # Getting Started FMADIO Packetscope2 is a protocol discovery / analysis tool designed to understand what kind of traffic is on the network. ## Supported Protocols List of the protocols and the encapsulation depth of each one - 4 Layers x Ethernet - 8 Layers x VLAN (both 0×8100, 0×9100 and QinQ) - 8 Layer x MPLS - 6 Layers x IPv4 - 4 Layers x IPv6 - 4 Layers x GRE tunneling (Including ERSPAN1, ERSPAN2, ERSPAN3) - 4 Layers x TCP - 4 Layers x UDP - 4 Layers x VXLAN - 4 Layers x GENEVE - 4 Layers x ICMP - 2 Layers x SCTP - 1 Layer x GTPC - 1 Layer x GTPU - ESP decode (IPSec) - Pseudo Wire decode (L2 encapsulation) GeoIP Information - Continent - Country Name - Country ISO - Longitude - Latitude - City Name - ISP - Network - Organisation - ASN - ASN Organisation - Domain - Connection Type The protocols are decoded and sent to an SQL database via a JSON decoded format in a non-Realtime mode. Once in the database Grafana is used to visualize the traffic. ## Basic Protocol Encapsulation Example decode is shown below. This example is a basic IPv4 UDP traffic pattern. ![](https://cdn.document360.io/b9aab0c4-36d0-4616-9673-30b661455571/Images/Documentation/image(114).png?sv=2026-02-06&spr=https&st=2026-11-13T18%3A58%3A32Z&se=2026-11-13T19%3A58%3A32Z&sr=c&sp=r&sig=ubvjF2k8PFh9Bbtk6GfqHavCpnwsQVYE%2F7iA4ZRm%2BRI%3D) With IPv4 and UDP port numbers shown per below. This traffic has only 1 Layer of IPv4 and UDP. ![](https://cdn.document360.io/b9aab0c4-36d0-4616-9673-30b661455571/Images/Documentation/image(115).png?sv=2026-02-06&spr=https&st=2026-11-13T18%3A58%3A32Z&se=2026-11-13T19%3A58%3A32Z&sr=c&sp=r&sig=ubvjF2k8PFh9Bbtk6GfqHavCpnwsQVYE%2F7iA4ZRm%2BRI%3D) ## Multiple Encapsulation The above is a simple ipv4:udp like protocol stack. The utility is designed for decoding more complicated network topologies. Below is such an example ![](https://cdn.document360.io/b9aab0c4-36d0-4616-9673-30b661455571/Images/Documentation/image(116).png?sv=2026-02-06&spr=https&st=2026-11-13T18%3A58%3A32Z&se=2026-11-13T19%3A58%3A32Z&sr=c&sp=r&sig=ubvjF2k8PFh9Bbtk6GfqHavCpnwsQVYE%2F7iA4ZRm%2BRI%3D) In the above analysis we see 30-40 different VLANs on the network, with :ether:ipv4:udp and VLAN 2055 taking the majority of the traffic One can filter just the UDP traffic by select the frameProto and filtering on “udp” ![](https://cdn.document360.io/b9aab0c4-36d0-4616-9673-30b661455571/Images/Documentation/image(117).png?sv=2026-02-06&spr=https&st=2026-11-13T18%3A58%3A32Z&se=2026-11-13T19%3A58%3A32Z&sr=c&sp=r&sig=ubvjF2k8PFh9Bbtk6GfqHavCpnwsQVYE%2F7iA4ZRm%2BRI%3D) Which will select just the ether:ipv4:udp traffic. From here we see there are no VLAN or MPLS tags ![](https://cdn.document360.io/b9aab0c4-36d0-4616-9673-30b661455571/Images/Documentation/image(118).png?sv=2026-02-06&spr=https&st=2026-11-13T18%3A58%3A32Z&se=2026-11-13T19%3A58%3A32Z&sr=c&sp=r&sig=ubvjF2k8PFh9Bbtk6GfqHavCpnwsQVYE%2F7iA4ZRm%2BRI%3D) Single IPv4 layer with a number of different UDP ports ![](https://cdn.document360.io/b9aab0c4-36d0-4616-9673-30b661455571/Images/Documentation/image(119).png?sv=2026-02-06&spr=https&st=2026-11-13T18%3A58%3A32Z&se=2026-11-13T19%3A58%3A32Z&sr=c&sp=r&sig=ubvjF2k8PFh9Bbtk6GfqHavCpnwsQVYE%2F7iA4ZRm%2BRI%3D) ## Filtering on Outer VLAN One can filter on the outer VLAN, in this case VLAN 2055 by selecting it from the drop down menu ![](https://cdn.document360.io/b9aab0c4-36d0-4616-9673-30b661455571/Images/Documentation/image(120).png?sv=2026-02-06&spr=https&st=2026-11-13T18%3A58%3A32Z&se=2026-11-13T19%3A58%3A32Z&sr=c&sp=r&sig=ubvjF2k8PFh9Bbtk6GfqHavCpnwsQVYE%2F7iA4ZRm%2BRI%3D) Which shows, VLAN 2055 is moslty IPv4 UDP and TCP. ![](https://cdn.document360.io/b9aab0c4-36d0-4616-9673-30b661455571/Images/Documentation/image(121).png?sv=2026-02-06&spr=https&st=2026-11-13T18%3A58%3A32Z&se=2026-11-13T19%3A58%3A32Z&sr=c&sp=r&sig=ubvjF2k8PFh9Bbtk6GfqHavCpnwsQVYE%2F7iA4ZRm%2BRI%3D) With the TCP ports looking like HTTP and HTTPS traffic ![](https://cdn.document360.io/b9aab0c4-36d0-4616-9673-30b661455571/Images/Documentation/image(122).png?sv=2026-02-06&spr=https&st=2026-11-13T18%3A58%3A32Z&se=2026-11-13T19%3A58%3A32Z&sr=c&sp=r&sig=ubvjF2k8PFh9Bbtk6GfqHavCpnwsQVYE%2F7iA4ZRm%2BRI%3D) ## Mobile GTPC GTPU Encapsulation Mobile mid-plane traffic encapsulation can be quite deep. By default the system will decode all the way inside a GTPU payload extracting out the IP TCP UDP etc information. Example shown below ![](https://cdn.document360.io/b9aab0c4-36d0-4616-9673-30b661455571/Images/Documentation/image(126).png?sv=2026-02-06&spr=https&st=2026-11-13T18%3A58%3A32Z&se=2026-11-13T19%3A58%3A32Z&sr=c&sp=r&sig=ubvjF2k8PFh9Bbtk6GfqHavCpnwsQVYE%2F7iA4ZRm%2BRI%3D) This can be drilled down further by selecting only the GTPU inner TCP traffic, as shown below ![](https://cdn.document360.io/b9aab0c4-36d0-4616-9673-30b661455571/Images/Documentation/image(127).png?sv=2026-02-06&spr=https&st=2026-11-13T18%3A58%3A32Z&se=2026-11-13T19%3A58%3A32Z&sr=c&sp=r&sig=ubvjF2k8PFh9Bbtk6GfqHavCpnwsQVYE%2F7iA4ZRm%2BRI%3D) Which looks like ![](https://cdn.document360.io/b9aab0c4-36d0-4616-9673-30b661455571/Images/Documentation/image(128).png?sv=2026-02-06&spr=https&st=2026-11-13T18%3A58%3A32Z&se=2026-11-13T19%3A58%3A32Z&sr=c&sp=r&sig=ubvjF2k8PFh9Bbtk6GfqHavCpnwsQVYE%2F7iA4ZRm%2BRI%3D) Where there are 4 Layers of IPv4 addresses within a single packet. ![](https://cdn.document360.io/b9aab0c4-36d0-4616-9673-30b661455571/Images/Documentation/image(129).png?sv=2026-02-06&spr=https&st=2026-11-13T18%3A58%3A32Z&se=2026-11-13T19%3A58%3A32Z&sr=c&sp=r&sig=ubvjF2k8PFh9Bbtk6GfqHavCpnwsQVYE%2F7iA4ZRm%2BRI%3D) With 2 layers of UDP (e.g. VXLAN and GTPU/GTPC) with the final inner TCP layer typically HTTP / HTTPS traffic all within a single packet. ![](https://cdn.document360.io/b9aab0c4-36d0-4616-9673-30b661455571/Images/Documentation/image(130).png?sv=2026-02-06&spr=https&st=2026-11-13T18%3A58%3A32Z&se=2026-11-13T19%3A58%3A32Z&sr=c&sp=r&sig=ubvjF2k8PFh9Bbtk6GfqHavCpnwsQVYE%2F7iA4ZRm%2BRI%3D) That is quite a deep encapsulation.