The tag has no wiki summary.

learn more… | top users | synonyms

2
votes
1answer
61 views

Any way that I can feed tshark a live capture written to a file without reading from the start?

I'm capturing traffic from a microtik router to my linux server and writing to a big file. I'm searching for a way to feed from the current file end forward since it is a several GB file and I can't ...
-3
votes
2answers
499 views

how to intercept(not only capture) outgoing packets from TCP programs(or specifically TCP stack)? [closed]

I have a web server running on a host and I want to intercept all packets(including IP/TCP header) sent by the webserver, so the packets are not sent out to the Internet by the web server directly. ...
0
votes
1answer
52 views

Filter ip traffic based on certain packet bits

I want to capture ip traffic at a linux machine based on the following bpf filter: ether[45]=0x11 and ether[68]=0x34 Incoming traffic is around 20Gbps and the filter discards 95% of the traffic. As ...
1
vote
1answer
149 views

Custom analysis of pcap capture files

I want to do an analysis on pcap files, but tshark seems rather heavy for the simple analysis I want, such as: number of packets capture duration total bytes Is there an easier way to get these ...
2
votes
1answer
419 views

Is Winpcap able to capture all packets going through a Gigabit NIC without missing any packets?

I want to use Winpcap to capture all network packets going through a Gigabit NIC of a server. Assuming that I am able to utilize the network link up to 100%, the maximum network speed is 1000Mbps. If ...
2
votes
2answers
246 views

Start tomcat webapp with root privileges

I built a webapp that uses libpcap (via jpcap). In order to be able to get the network interfaces list or to bind to a network interface, the application (in this case a webaap that runs from tomcat ...
2
votes
1answer
290 views

Can I connect multiple SPAN Ports to a hub to monitor both from one NIC

Suppose I had two Cisco switches each outputting some network traffic to a SPAN port, and I needed to send the sum of all that traffic to a third device for monitoring that traffic via libpcap. The ...
0
votes
2answers
654 views

How to use tshark to do this task

I don't have any base knowledge about tshark, and it is hard to find any tutorial to help me with this. So now I have a pcap file which consists a lot of network flows; a time range; an ip addr; a ...
2
votes
2answers
377 views

Why packets sent through libpcap are filtered out for the local host?

I have some simulator software running on linux (linux_host) in which is another linux (linux_sim) is running. The simulator uses libpcap to access the ethernet to provide network simulation on ...
0
votes
1answer
238 views

How to do MAC based one to one NAT on Linux?

I have a linux machine running ubuntu server with 2NICS (WAN and LAN). I want the LAN side machines to use the linux box as a gateway to get on the internet (WAN side). The only problem is that the ...
4
votes
2answers
801 views

Anyone can tell their experience with 10g Ethernet adapters on Linux

I wonder if any of you have an experience with 10g NICs (Intel, Myricom, SMC tiget, napatech, or by any other brand). Questions are: Was it easy to install, or a hassle, How does this adapter ...
3
votes
1answer
1k views

Kill FINished sockets (using libpcap - tcpdump/tcpkill)

I'm trying to create a small service that monitors and kills sockets which have the FIN flag. I can get them with tcpdump (I also tried tcp[13] & 1): tcpdump "tcp[tcpflags] & tcp-fin != 0" ...
4
votes
2answers
3k views

tcpdump filter that excludes private ip traffic

For a generic filter to exclude all traffic in my dump that is between private IP address, I came up with the following: sudo tcpdump -n ' (not ( (src net 172.16.0.0/20 or src net ...