Packet capture is the act of capturing data packets crossing a computer network. Packet capture can be: Deep packet capture (headers & payload), or partial packet capture (headers only).

learn more… | top users | synonyms

3
votes
1answer
24 views

Linux NFLOG - documentation, configuration from C

Several different places (e.g. http://wiki.wireshark.org/CaptureSetup/NFLOG) recommend using Linux's "NFLOG" firewall module to capture packets generated by a particular UID, like this: # iptables -A ...
0
votes
0answers
38 views

iperf udp sequence number wireshark

I'm using iperf for generating udp traffic and my objective is to measure paquet loss. I wanted to know if the first 4 Bytes of Iperf Data are currently the sequence number.
1
vote
0answers
50 views

Simple tcp capture tool - output results like chat session? [closed]

I seek a tool which will capture TCP traffic with the resulting output looking almost like an iPhone SMS conversation. Something like: timestamps client stuff is left justified / green server stuff ...
-1
votes
2answers
110 views

block all packets in windows 7 (so nothing appears in wireshark)? Can anything locally installed do it?

is it possible to block all packets in windows 7, so that nothing appears in wireshark? I have tried choosing Block all for incoming. for outgoing, I see it has no block all option, just a block ...
0
votes
1answer
80 views

TCP Sequence & Acknowledgment numbers

I have looked through other questions on here involving the relevant topics, but I am still not clear on this. I have just been reading this explanation of TCP sequence & acknowledgment numbers. ...
0
votes
1answer
57 views

Wireshark seems to ignore my filters

I'm trying to make use of Wireshark 1.10.6 for Windows and I want to only capture the traffic to port 443 (to diagnose some weird HTTPS problems I'm having). So I open Capture -> Capture Filters... ...
0
votes
0answers
79 views

Exporting SNMP OID values from wireshark capture?

I am trying to figure out how I can export the SNMP OID values that wireshark picked up. My issue is that when I export the raw data it is all together and not seperated. All I want to to is get only ...
1
vote
2answers
103 views

Can I capture ISP SNMP information with Wireshark?

I am trying to do some heavy digging into SNMP, BPI+, ISP networks. Since wireshark can be used to capture network data, would I be able to use it to remotely capture my ISP SNMP agent information and ...
0
votes
2answers
179 views

How can I create a packet capture file on a headless server for a single process?

I'm writing a python script on a headless server, and I'd like to see the packet capture output for the script. I can't run ettercap or Wireshark on the server as there is too much other noise ...
2
votes
1answer
128 views

Strange Ethernet II packets in wireshark

Looking at a wireshark capture, I'm seeing something really strange. Ethernet II packets with random data are being sent on the network. The larger packets in the capture seem to contain bits and ...
1
vote
0answers
230 views

USB packet sniffing on Mac OS? [closed]

I want to sniff USB packets being sent from my Mac to a device. For various reasons I cannot use Linux or Windows, and I'm stuck with Mac OS. Can anyone recommend a packet sniffing method? I've tried ...
2
votes
0answers
45 views

Suggestions on how to capture network connections/traffic for determining browser/SSL versions?

Note that I posted this Q to the StackExchange InfoSec site, but its not as populated as ServerFault and this is more on the technical side of network collection for web services. I've started ...
2
votes
2answers
82 views

Linux Full Packet Capture

I’m looking to stand up a full packet capture solution on an Ubuntu server. Our maximum bandwidth is < 60Mb/s and the server has 10K hard drives. Ideally, I’d like to be able to log everything ...
7
votes
1answer
350 views

Why is the “don't fragment” flag set in https and ssh protocols?

I've found a lot of information specifying that this is the case, however, I am really looking for the reason behind this. Why is it necessary? Is it necessary?
0
votes
1answer
75 views

Network card capable of capturing a tonne of packets and not dropping them?

Edit: Our server is trying to capture packets at between 500-600Mb/s, but is dropping packets 'due to kernel'. Data is being written to SSDs, and isn't bottleneck there. What things should I look ...
1
vote
1answer
77 views

“tshark: There are no interfaces on which a capture can be done” in Amazon Linux AMI

My goal is to capture packets with tshark in Amazon Linux AMI. While typing tshark in the command line there's an error: "tshark: There are no interfaces on which a capture can be done" How to ...
1
vote
1answer
83 views

tcpdump on a capture card

I have a server with a NT20E Capture Card (2x10Gb Packet Capture Card over PCI Express). I want to be able to dump the output to a pcap format but because this isn't listed as an ethX-interface ...
0
votes
3answers
641 views

How to sniff all HTTP packets on a wifi network? [closed]

I need to sniff all HTTP packets that pass through my wifi network (in particular HTTP requests by my smartphone). I've tried with wireshark, but I can sniff only packets to and from my pc. What am I ...
0
votes
0answers
42 views

Capture packets from Access Point in bridge mode

From a linux router I would like to capture all incoming packets from a certain Access Point IP which is configured in bridge mode. Is it posible with some tools? tcpdump does not show me anything. ...
0
votes
3answers
1k views

Can Wireshark capture an entire Ethernet frame including preamble, CRC and Interframe spacing?

I am examining an Ethernet frame in Wireshark. According to the "Ethernet frame" Wikipedia article and accompanying diagrams, "A frame starts with a 7-octet preamble and 1-octet start frame delimiter ...
-1
votes
1answer
153 views

Incoming Outgoing Packets Wireshark

Is there a way to have a column or a filter that marks each packet as incoming (download) or outgoing (upload) in Wireshark? I guess this should be relative to the selected capture interface device.
0
votes
1answer
114 views

Source and Destination Packets on Wireshark Relative or Absolute?

New in Packet Analysis. Sniffing on the Ethernet device of my computer. Does the Source and Destination columns on Wireshark tell the source and destination from where the packet was originated and ...
0
votes
1answer
228 views

What does a packet capture in pfsense do?

I have some issues with a third party to establish a VPN connection. To debug it, I made a packet capture on the device that represents our synchronous DSL line. The solution I'm using is an old ...
0
votes
1answer
61 views

Meraki VPN Traffic Capture

We have multiple offices interconnected via VPN using Meraki switches. I've been looking around and can't seem to find a way, but was thinking it's possible. Is it possible for me to put my desktop on ...
0
votes
2answers
186 views

monitor network packet rate per IP

my problem is that I've got a report that my IP was used in a DOS attack. Problem is that I do not know which computer is infected and the attack is not active anymore. Is there simple Linux tool for ...
0
votes
1answer
320 views

syn flood attack — packet hits on shared ip

How can I dump the TCP packets to get a better idea to know which website is being attacked? Here is what I have in my logs: May 4 23:10:26 host kernel: [2130002.635000] Firewall: *SYNFLOOD ...
2
votes
6answers
241 views

Wireshark Capture Between Two Routers

How would one go about capturing OSPF traffic in Wireshark between two routers? I'm looking to do something like this: [RTR A] - - - [LAPTOP] - - - [RTR B]
-1
votes
1answer
76 views

Wireshark not displaying GET or POST data [closed]

I'm a student and I'm taking my first networking class. I'm working on an assignment designed to get me used to using Wireshark and understanding packet transfers. Part of the assignment is to collect ...
3
votes
2answers
203 views

What are cables/boxes called for listening in on a RJ45 cable?

I would like to capture the traffic from a router, so I assume there must exist a cable or hardware box with 3 RJ45 socks, where two of them are IN and OUT, and the third is for capturing device (a ...
1
vote
2answers
356 views

Method to drop 50% packets of the total

On my machine I want that only 50% packets will receive. I am working on centOS 5.5. For that I searched on net. I got IPtables. I used random patch of IPtables. Command sudo iptables -A INPUT -p ...
0
votes
1answer
108 views

Possible causes of high download activity on network [closed]

We had an issue where we noticed approximately 170GB of data downloaded as http traffic over a one week period on our network. After locking down many services and running a hub as an in between ...
1
vote
1answer
142 views

Capturing packets via l7filter

As a part of my Ph. D study, I compile linux-2.6.28 kernel to support in-kernel l7filtering capabilities. I'm adding a single rule to iptables with the following: iptables -t mangle -A PREROUTING -m ...
0
votes
1answer
52 views

Filter ip traffic based on certain packet bits

I want to capture ip traffic at a linux machine based on the following bpf filter: ether[45]=0x11 and ether[68]=0x34 Incoming traffic is around 20Gbps and the filter discards 95% of the traffic. As ...
1
vote
0answers
165 views

Is there a tool to do packet mirroring in CentOS 5.9?

I know iptables + xtables can do it in more recent versions using the TEE target supplied by the xtables-addon package for iptables. However, the kernel in CentOS 5.9 is 2.6.18 and this version is not ...
0
votes
1answer
161 views

Filtering inbound traffic without knowing the destination subnet

I have a linux machine configured as a router with two interfaces facing LAN A and LAN B. I want to filter traffic passing from LAN A to LAN B (inbound traffic) using tcpdump, but I don't have the ...
2
votes
2answers
1k views

using wireshark/tshark in command line to ignore ssh connections

I'm trying to debug some by looking at the packets and I would like to avoid getting all the SSH traffic to the server. Is there a way to ignore? I tried to do something like tshark -f "port !22" but ...
0
votes
0answers
190 views

Method to capture traffic going through a wireless router (802.11)

I am interested in monitoring and saving all wireless traffic going through a router (that includes the management frames sent from and the router too) but I am not sure what is the optimal strategy ...
1
vote
0answers
119 views

Is Snort able to efficiently demux and log large HTTP POST requests?

I'm trying to debug some failed HTTP POST requests containing large file uploads (~500 MB). The end-user is receiving strange HTTP responses that are not being logged in either varnish's varnishncsa ...
0
votes
1answer
157 views

Log http data in unique files using tcpick

I'm trying to use tcpick to log http data in unique files (client and server mixed together). This is one of the examples from tcpick's man page: $ tcpick -i eth0 "port 80" -wRub I expected this to ...
2
votes
1answer
597 views

Why do some machines respond with many RST packets instead of RST-ACK to refuse a connection?

I have recently been trying to track down a problem with one of our systems and have noticed that it is simply not allowed to connect to a remote machine. However, the remote machine (not controlled ...
5
votes
0answers
134 views

Why does our Windows 7 Desktop keep continually making SMB requests to our SBS2003 server? [duplicate]

Possible Duplicate: How do I deal with a compromised server? One of our desktop machines (Win 7 64 bit) has recently been complaining of slow down, particularly when accessing resources on ...
1
vote
1answer
188 views

What is the best way/tool to analyze raw data(network stats) from Simulation?

After running a simulation(using a simulator(QualNet)) of a simulated network I end up with ip stats stored in a database, I then extract the data to a csv file So now I have 750mb of raw network ...
0
votes
1answer
455 views

Capturing network traffic (rtmp) between VMs or using loopback in the same VM using wireshark

I need to to capture RTMP traffic between two virtual machines (server and client) or atleast have the server and client on the same machine and capture the traffic. I am able to capture the traffic ...
1
vote
2answers
103 views

Hardware for Capturing Packets

One of my clients is a small school district in Texas. Like any school, they often have problems with network'd peripherals such as printers, et al. It would be nice to be able to simply "listen" to ...
3
votes
2answers
2k views

unexplainable packet drops with 5 ethernet NICs and low traffic on Ubuntu

I'm stuck on problem where my machine started to drops packets with no sign of ANY system load or high interrupt usage after an upgrade to Ubuntu 12.04. My server is a network monitoring sensor, ...
1
vote
1answer
185 views

Capture network traffic simultaneously on three interfaces

I need to capture traffic on a CentOS 5 server which acts as a web proxy with 2 wan interfaces and 1 LAN. In order to troubleshoot a weird proxy problem, I would like to have a capture of a full ...
3
votes
1answer
211 views

How Wireshark could read data from other ips

When I open wireshark I could see the packets send by machines other than mine. How could its possible? Example 8252 99.150192 somoeneip 239.255.255.250 SSDP NOTIFY * HTTP/1.1 8253 ...
1
vote
2answers
1k views

interrupt coalescing for high bandwidth packet capture?

I have an application which does packet capture from an ethernet card. Once in a while we see packets dropped (we suspect due to the buffer in the network card or kernel being overrun). I am trying ...
3
votes
1answer
282 views

What are capture interfaces in Wireshark?

I am really new to Wireshark, and I am little confused about the term capture interface. I see a list of about 9 to 10 so-called interfaces. What are they? I mean, I have only one Ethernet interface ...
1
vote
4answers
2k views

Sniffing packets of specific binaries / apps / process id?

Is there a way to associate packets with executing binaries? I would be open to traditional sniffing methods or even dtrace for that matter. I have a specific issue on a system with very high ...