Packet capture is the act of capturing data packets crossing a computer network. Packet capture can be: Deep packet capture (headers & payload), or partial packet capture (headers only).

learn more… | top users | synonyms

1
vote
1answer
34 views

Figuring out the most efficient use of an ip range

I am working with Packet Tracer atm and have 3 subnet plans : assigned(management(104users) staff(43 users) admin(35 users)). I have an ip address range of:38.191.0.0 and subnet mask of ...
0
votes
0answers
18 views

Which wireshark output format aligns closest with actual SMTP data?

I have a packet capture of a SMTP session (containing an email with international characters). I'd like to extract the message data from that and try reproducing an issue. When I follow the TCP ...
0
votes
0answers
9 views

What filter in Wireshark, can return the ACKs packets employed to complete TCP three-way handshakes instigated by a particular party?

What filter in Wireshark, can return the ACKs packets employed to complete TCP three-way handshakes instigated by a particular party? For instance if machine A requests for a TCP connection to be ...
1
vote
1answer
22 views

Is there a quick way to determine what applications are present within a Wireshark capture? If so how

Is there a quick way to determine what applications are present within a Wireshark capture? If so how As most captures contain over 10 thousand lines, I can't expect people would by hand check which ...
-2
votes
2answers
49 views

Why do different packet analyzers sometimes produce different results?

I ran wireshark and windump at the same time. Both packet analyzers use the same winpcap library. However after doing a row by row comparison of the results I noticed both every column between the 2 ...
0
votes
1answer
17 views

Is it possible to specify tcpdump that I want it to interpret packet differently before printing it to STDOUT?

I am using iperf to pinpoint packet reordering issue. Unfortunately, tcpdump does not know how to parse iperf's UDP payload that I could use to pinpoint the issue. I know that iperf stores packet ...
0
votes
1answer
36 views

Why are ICMP packets not captured on the target interface?

I have a network setup as in the picture: The central box is a gateway (Ubuntu 15.10) which relays the packets betwen the various networks (only one is shown on the picture - lan0) and Internet. ...
0
votes
1answer
25 views

PCAP filter for first few packets, and packets related to disconnection, TCP-only

I'd like to use tcpdump with a filter for some long-running debugging. Specifically, I only want to capture packets with the following conditions: First 10 packets or so of a new TCP connection ...
1
vote
1answer
32 views

udp broadcast on port 25860

I used wireshark on my local network (to test it), and i noticed that there is a lot of udp packets send one broadcast, and the majority is coming from only one host. Theses udp packets are send on ...
0
votes
1answer
25 views

PCAP traffic frame length short

I'm trying to make traffic and capture it using pcap file. I get pcap file from CAIDA(caida.org) site. This pcap file too big and doesn't have ethernet header. So i splitted pcap file to small size(40 ...
0
votes
0answers
17 views

ICMP Packet Flood a local device over Wireless AP to figure out packet loss?

I'm using a utility to create an ICMP packet flood/attack called Hyanea since windows doesn't have native support like linux does. I want to be able to test a new AP to see if any packet loss ...
0
votes
0answers
51 views

Colasoft Packet Player with Loopback-Adapter - Cannot recieve UDP-Packages

I have some problems with Colasoft Packet Player. I am trying to send the UDP-Packages over a Loopback-Adapter (Windows 7, I want to send and receive them over the same computer) and to read them with ...
0
votes
2answers
268 views

How to log all inbound connections on Windows server

I need to log a summary of all inbound TCP connections on a Windows 2008R2 server, but only including the Source IP, Source Port, Destination IP and Destination Port. I do not want to log the payload ...
1
vote
1answer
90 views

Is it possible to run 2 concurrent tcpdump with different options?

I need to run 2 concurrent tcpdump commands with different arguments/options. Why ? Because we wrote some long long scripts compatible with following options : tcpdump -ixenbr0 -s 400 -n -A 'port sip ...
0
votes
0answers
87 views

Capture all mysql requests/responses and caculate the response time using tcpdump

I need to capture all mysql requests/responses using tcpdump and after that need to find out which response related to which request in order to caculate the response time of each request. I used the ...
1
vote
1answer
182 views

centos doesn't reply to icmp request

I have the following situation: Centos7, 2 NIC with following setup: em2(NIC2) : 82.79.24.74/29 82.79.24.75/29 em3(NIC3) : 192.168.0.240/24 192.168.133.240/24 ...
0
votes
0answers
93 views

Filter packets with layer 7 (raw) data with iptables

Let's suppose I've got the following iptables rule: iptables -A INPUT -p tcp -s $IP --sport $PORT -j DROP filtering (and dropping, in this case) packets coming from $IP:$PORT. This filter drop ...
0
votes
0answers
92 views

Using I/O graph how to interept bytes/tick against packet details information?

I'm working on a trace-file which has reported ISP throttling occurrences in it. My task is to use IO graph to understand at what point in time the throttling process effected client upload ...
0
votes
0answers
54 views

iptables — capture pptp connection attempt packets and place into holding pattern

Problem I have a problem of too many simultaneous connection attempts to a vpn server causing all connections to drop. Staggering connection attempts fixes problem. How can I use iptables to do the ...
0
votes
1answer
230 views

tcpdump freezes and not capturing properly without internet connection

When I don't have any internet conncetion and I want to capture network between local computers, tcpdump acts like this: 1.I start tcpdump using following command: tcpdump -ixenbr0 2.After I run ...
0
votes
1answer
140 views

How to ping a host with different MTU size to simulate icmpv6 packet too big scenario?

As the Title states,I want to check whether my host will actually send a ICMPv6 packet too big if i send a packet with beyond the defined MTU size.I don't have a cisco router(extended ping) to try out ...
0
votes
1answer
305 views

server is not responding on SYN packets

On the attached tcp dump, the first two SYN packets (#21800 and 21801) came to the server, however SYN ACK was sent for the second SYN. Is that correct behaviour? My understanding is that the client ...
2
votes
1answer
152 views

Suspicious IP packets on port 53

I have discovered a strange issue, and I hope someone can help me to fix it. If I'm capturing the ip packets on em1 network interface on port 53 with the "tcpdump -i em1 -vvv -s 0 -l -n port 53" ...
0
votes
2answers
748 views

user agent in http or https request

Is there any way that I can differentiate, the HTTP or HTTPS packets are coming from browser or not ? specially for https request.There is User-Agent field in packet in Http,but I could not found ...
1
vote
0answers
99 views

Redirect Default Gateway Traffic in Linux to File

I am trying to troubleshoot one of my linux servers (ubuntu server). Therefore I want to intercept all traffic that is sent to the default gateway and then write it to a file: preferably some kind of ...
-1
votes
1answer
177 views

Is it Possible to Capture All HTTP Packets to a Target IP on a subnet?

I've been trying to use tcpdump to capture packets to a target IP on my subnet, but am unable to do so successfully. I've tried: tcpdump -i eth0 net network-ip-address/27 -A and tcp port 80 But it ...
0
votes
0answers
91 views

Early tear down of communication

I have an application which performs an LDAP search which works in one domain but not in the other, when analyzing the packets sent between the application server and the domain controller being ...
-1
votes
1answer
379 views

Analyzing twitter packets [closed]

Thanks for your time. I'd like to find a way if a client has made a 'GET' or a 'POST' request for twitter. We are currently doing an educational project and we wanted to understand how we can achieve ...
-1
votes
1answer
387 views

Why is my chunked request removing the trailing CRLF?

I've just spent the past 10 hours trying to figure out why my http request was failing when I did a request.Content.ReadAsMultipartAsync().Result.Contents It kept returning the error: Unexpected ...
-2
votes
1answer
83 views

How many data packets does it take to log in to facebook? [closed]

I want to find out how many packets are sent when visiting a site on the web. What's a good program that would help me get this kind of data?
2
votes
1answer
802 views

Tcpdump on ec2 not seeing all packets

I'm running tcpdump on an Amazon EC2 instance to monitor HTTP traffic going to Nginx (this is just a test box, the only resource is the example test page). Running tcpdump with the command # ...
1
vote
2answers
600 views

Compressing the output of tshark when in multiple files mode

I'm running tshark to dump wireless traffic. I am currently running in multiple files mode, splitting output into 50MB chunks. Is there any way to also have these 50MB chunks compressed with something ...
5
votes
1answer
2k views

Linux NFLOG - documentation, configuration from C

Several different places (e.g. http://wiki.wireshark.org/CaptureSetup/NFLOG) recommend using Linux's "NFLOG" firewall module to capture packets generated by a particular UID, like this: # iptables -A ...
0
votes
1answer
477 views

iperf udp sequence number wireshark

I'm using iperf for generating udp traffic and my objective is to measure paquet loss. I wanted to know if the first 4 Bytes of Iperf Data are currently the sequence number.
-1
votes
2answers
983 views

block all packets in windows 7 (so nothing appears in wireshark)? Can anything locally installed do it?

is it possible to block all packets in windows 7, so that nothing appears in wireshark? I have tried choosing Block all for incoming. for outgoing, I see it has no block all option, just a block ...
0
votes
1answer
3k views

TCP Sequence & Acknowledgment numbers

I have looked through other questions on here involving the relevant topics, but I am still not clear on this. I have just been reading this explanation of TCP sequence & acknowledgment numbers. ...
0
votes
1answer
271 views

Wireshark seems to ignore my filters

I'm trying to make use of Wireshark 1.10.6 for Windows and I want to only capture the traffic to port 443 (to diagnose some weird HTTPS problems I'm having). So I open Capture -> Capture Filters... ...
1
vote
2answers
496 views

Can I capture ISP SNMP information with Wireshark?

I am trying to do some heavy digging into SNMP, BPI+, ISP networks. Since wireshark can be used to capture network data, would I be able to use it to remotely capture my ISP SNMP agent information and ...
0
votes
3answers
1k views

How can I create a packet capture file on a headless server for a single process?

I'm writing a python script on a headless server, and I'd like to see the packet capture output for the script. I can't run ettercap or Wireshark on the server as there is too much other noise ...
2
votes
1answer
702 views

Strange Ethernet II packets in wireshark

Looking at a wireshark capture, I'm seeing something really strange. Ethernet II packets with random data are being sent on the network. The larger packets in the capture seem to contain bits and ...
2
votes
0answers
152 views

Suggestions on how to capture network connections/traffic for determining browser/SSL versions?

Note that I posted this Q to the StackExchange InfoSec site, but its not as populated as ServerFault and this is more on the technical side of network collection for web services. I've started ...
2
votes
2answers
214 views

Linux Full Packet Capture

I’m looking to stand up a full packet capture solution on an Ubuntu server. Our maximum bandwidth is < 60Mb/s and the server has 10K hard drives. Ideally, I’d like to be able to log everything ...
7
votes
1answer
5k views

Why is the “don't fragment” flag set in https and ssh protocols?

I've found a lot of information specifying that this is the case, however, I am really looking for the reason behind this. Why is it necessary? Is it necessary?
0
votes
1answer
200 views

Network card capable of capturing a tonne of packets and not dropping them?

Edit: Our server is trying to capture packets at between 500-600Mb/s, but is dropping packets 'due to kernel'. Data is being written to SSDs, and isn't bottleneck there. What things should I look ...
1
vote
1answer
428 views

“tshark: There are no interfaces on which a capture can be done” in Amazon Linux AMI

My goal is to capture packets with tshark in Amazon Linux AMI. While typing tshark in the command line there's an error: "tshark: There are no interfaces on which a capture can be done" How to ...
1
vote
1answer
462 views

tcpdump on a capture card

I have a server with a NT20E Capture Card (2x10Gb Packet Capture Card over PCI Express). I want to be able to dump the output to a pcap format but because this isn't listed as an ethX-interface ...
0
votes
3answers
2k views

How to sniff all HTTP packets on a wifi network? [closed]

I need to sniff all HTTP packets that pass through my wifi network (in particular HTTP requests by my smartphone). I've tried with wireshark, but I can sniff only packets to and from my pc. What am I ...
0
votes
3answers
6k views

Can Wireshark capture an entire Ethernet frame including preamble, CRC and Interframe spacing?

I am examining an Ethernet frame in Wireshark. According to the "Ethernet frame" Wikipedia article and accompanying diagrams, "A frame starts with a 7-octet preamble and 1-octet start frame delimiter ...
-1
votes
1answer
682 views

Incoming Outgoing Packets Wireshark

Is there a way to have a column or a filter that marks each packet as incoming (download) or outgoing (upload) in Wireshark? I guess this should be relative to the selected capture interface device.
0
votes
1answer
533 views

Source and Destination Packets on Wireshark Relative or Absolute?

New in Packet Analysis. Sniffing on the Ethernet device of my computer. Does the Source and Destination columns on Wireshark tell the source and destination from where the packet was originated and ...