Packet capture is the act of capturing data packets crossing a computer network. Packet capture can be: Deep packet capture (headers & payload), or partial packet capture (headers only).

learn more… | top users | synonyms

0
votes
1answer
32 views

user agent in http or https request

Is there any way that I can differentiate, the HTTP or HTTPS packets are coming from browser or not ? specially for https request.There is User-Agent field in packet in Http,but I could not found ...
1
vote
0answers
39 views

Redirect Default Gateway Traffic in Linux to File

I am trying to troubleshoot one of my linux servers (ubuntu server). Therefore I want to intercept all traffic that is sent to the default gateway and then write it to a file: preferably some kind of ...
-1
votes
1answer
47 views

Is it Possible to Capture All HTTP Packets to a Target IP on a subnet?

I've been trying to use tcpdump to capture packets to a target IP on my subnet, but am unable to do so successfully. I've tried: tcpdump -i eth0 net network-ip-address/27 -A and tcp port 80 But it ...
0
votes
0answers
28 views

Early tear down of communication

I have an application which performs an LDAP search which works in one domain but not in the other, when analyzing the packets sent between the application server and the domain controller being ...
-1
votes
1answer
50 views

Analyzing twitter packets [closed]

Thanks for your time. I'd like to find a way if a client has made a 'GET' or a 'POST' request for twitter. We are currently doing an educational project and we wanted to understand how we can achieve ...
-1
votes
1answer
81 views

Why is my chunked request removing the trailing CRLF?

I've just spent the past 10 hours trying to figure out why my http request was failing when I did a request.Content.ReadAsMultipartAsync().Result.Contents It kept returning the error: Unexpected ...
-2
votes
1answer
49 views

How many data packets does it take to log in to facebook? [closed]

I want to find out how many packets are sent when visiting a site on the web. What's a good program that would help me get this kind of data?
2
votes
1answer
138 views

Tcpdump on ec2 not seeing all packets

I'm running tcpdump on an Amazon EC2 instance to monitor HTTP traffic going to Nginx (this is just a test box, the only resource is the example test page). Running tcpdump with the command # ...
1
vote
1answer
124 views

Compressing the output of tshark when in multiple files mode

I'm running tshark to dump wireless traffic. I am currently running in multiple files mode, splitting output into 50MB chunks. Is there any way to also have these 50MB chunks compressed with something ...
4
votes
1answer
410 views

Linux NFLOG - documentation, configuration from C

Several different places (e.g. http://wiki.wireshark.org/CaptureSetup/NFLOG) recommend using Linux's "NFLOG" firewall module to capture packets generated by a particular UID, like this: # iptables -A ...
0
votes
1answer
153 views

iperf udp sequence number wireshark

I'm using iperf for generating udp traffic and my objective is to measure paquet loss. I wanted to know if the first 4 Bytes of Iperf Data are currently the sequence number.
-1
votes
2answers
348 views

block all packets in windows 7 (so nothing appears in wireshark)? Can anything locally installed do it?

is it possible to block all packets in windows 7, so that nothing appears in wireshark? I have tried choosing Block all for incoming. for outgoing, I see it has no block all option, just a block ...
0
votes
1answer
660 views

TCP Sequence & Acknowledgment numbers

I have looked through other questions on here involving the relevant topics, but I am still not clear on this. I have just been reading this explanation of TCP sequence & acknowledgment numbers. ...
0
votes
1answer
125 views

Wireshark seems to ignore my filters

I'm trying to make use of Wireshark 1.10.6 for Windows and I want to only capture the traffic to port 443 (to diagnose some weird HTTPS problems I'm having). So I open Capture -> Capture Filters... ...
0
votes
0answers
170 views

Exporting SNMP OID values from wireshark capture?

I am trying to figure out how I can export the SNMP OID values that wireshark picked up. My issue is that when I export the raw data it is all together and not seperated. All I want to to is get only ...
1
vote
2answers
184 views

Can I capture ISP SNMP information with Wireshark?

I am trying to do some heavy digging into SNMP, BPI+, ISP networks. Since wireshark can be used to capture network data, would I be able to use it to remotely capture my ISP SNMP agent information and ...
0
votes
2answers
510 views

How can I create a packet capture file on a headless server for a single process?

I'm writing a python script on a headless server, and I'd like to see the packet capture output for the script. I can't run ettercap or Wireshark on the server as there is too much other noise ...
2
votes
1answer
307 views

Strange Ethernet II packets in wireshark

Looking at a wireshark capture, I'm seeing something really strange. Ethernet II packets with random data are being sent on the network. The larger packets in the capture seem to contain bits and ...
2
votes
0answers
81 views

Suggestions on how to capture network connections/traffic for determining browser/SSL versions?

Note that I posted this Q to the StackExchange InfoSec site, but its not as populated as ServerFault and this is more on the technical side of network collection for web services. I've started ...
2
votes
2answers
128 views

Linux Full Packet Capture

I’m looking to stand up a full packet capture solution on an Ubuntu server. Our maximum bandwidth is < 60Mb/s and the server has 10K hard drives. Ideally, I’d like to be able to log everything ...
7
votes
1answer
1k views

Why is the “don't fragment” flag set in https and ssh protocols?

I've found a lot of information specifying that this is the case, however, I am really looking for the reason behind this. Why is it necessary? Is it necessary?
0
votes
1answer
108 views

Network card capable of capturing a tonne of packets and not dropping them?

Edit: Our server is trying to capture packets at between 500-600Mb/s, but is dropping packets 'due to kernel'. Data is being written to SSDs, and isn't bottleneck there. What things should I look ...
1
vote
1answer
187 views

“tshark: There are no interfaces on which a capture can be done” in Amazon Linux AMI

My goal is to capture packets with tshark in Amazon Linux AMI. While typing tshark in the command line there's an error: "tshark: There are no interfaces on which a capture can be done" How to ...
1
vote
1answer
189 views

tcpdump on a capture card

I have a server with a NT20E Capture Card (2x10Gb Packet Capture Card over PCI Express). I want to be able to dump the output to a pcap format but because this isn't listed as an ethX-interface ...
0
votes
3answers
1k views

How to sniff all HTTP packets on a wifi network? [closed]

I need to sniff all HTTP packets that pass through my wifi network (in particular HTTP requests by my smartphone). I've tried with wireshark, but I can sniff only packets to and from my pc. What am I ...
1
vote
3answers
3k views

Can Wireshark capture an entire Ethernet frame including preamble, CRC and Interframe spacing?

I am examining an Ethernet frame in Wireshark. According to the "Ethernet frame" Wikipedia article and accompanying diagrams, "A frame starts with a 7-octet preamble and 1-octet start frame delimiter ...
-1
votes
1answer
293 views

Incoming Outgoing Packets Wireshark

Is there a way to have a column or a filter that marks each packet as incoming (download) or outgoing (upload) in Wireshark? I guess this should be relative to the selected capture interface device.
0
votes
1answer
258 views

Source and Destination Packets on Wireshark Relative or Absolute?

New in Packet Analysis. Sniffing on the Ethernet device of my computer. Does the Source and Destination columns on Wireshark tell the source and destination from where the packet was originated and ...
0
votes
1answer
338 views

What does a packet capture in pfsense do?

I have some issues with a third party to establish a VPN connection. To debug it, I made a packet capture on the device that represents our synchronous DSL line. The solution I'm using is an old ...
0
votes
1answer
84 views

Meraki VPN Traffic Capture

We have multiple offices interconnected via VPN using Meraki switches. I've been looking around and can't seem to find a way, but was thinking it's possible. Is it possible for me to put my desktop on ...
0
votes
2answers
283 views

monitor network packet rate per IP

my problem is that I've got a report that my IP was used in a DOS attack. Problem is that I do not know which computer is infected and the attack is not active anymore. Is there simple Linux tool for ...
0
votes
1answer
403 views

syn flood attack — packet hits on shared ip

How can I dump the TCP packets to get a better idea to know which website is being attacked? Here is what I have in my logs: May 4 23:10:26 host kernel: [2130002.635000] Firewall: *SYNFLOOD ...
2
votes
6answers
405 views

Wireshark Capture Between Two Routers

How would one go about capturing OSPF traffic in Wireshark between two routers? I'm looking to do something like this: [RTR A] - - - [LAPTOP] - - - [RTR B]
-1
votes
1answer
93 views

Wireshark not displaying GET or POST data [closed]

I'm a student and I'm taking my first networking class. I'm working on an assignment designed to get me used to using Wireshark and understanding packet transfers. Part of the assignment is to collect ...
3
votes
2answers
245 views

What are cables/boxes called for listening in on a RJ45 cable?

I would like to capture the traffic from a router, so I assume there must exist a cable or hardware box with 3 RJ45 socks, where two of them are IN and OUT, and the third is for capturing device (a ...
1
vote
2answers
701 views

Method to drop 50% packets of the total

On my machine I want that only 50% packets will receive. I am working on centOS 5.5. For that I searched on net. I got IPtables. I used random patch of IPtables. Command sudo iptables -A INPUT -p ...
0
votes
1answer
128 views

Possible causes of high download activity on network [closed]

We had an issue where we noticed approximately 170GB of data downloaded as http traffic over a one week period on our network. After locking down many services and running a hub as an in between ...
1
vote
1answer
169 views

Capturing packets via l7filter

As a part of my Ph. D study, I compile linux-2.6.28 kernel to support in-kernel l7filtering capabilities. I'm adding a single rule to iptables with the following: iptables -t mangle -A PREROUTING -m ...
0
votes
1answer
52 views

Filter ip traffic based on certain packet bits

I want to capture ip traffic at a linux machine based on the following bpf filter: ether[45]=0x11 and ether[68]=0x34 Incoming traffic is around 20Gbps and the filter discards 95% of the traffic. As ...
1
vote
0answers
173 views

Is there a tool to do packet mirroring in CentOS 5.9?

I know iptables + xtables can do it in more recent versions using the TEE target supplied by the xtables-addon package for iptables. However, the kernel in CentOS 5.9 is 2.6.18 and this version is not ...
0
votes
1answer
189 views

Filtering inbound traffic without knowing the destination subnet

I have a linux machine configured as a router with two interfaces facing LAN A and LAN B. I want to filter traffic passing from LAN A to LAN B (inbound traffic) using tcpdump, but I don't have the ...
2
votes
2answers
2k views

using wireshark/tshark in command line to ignore ssh connections

I'm trying to debug some by looking at the packets and I would like to avoid getting all the SSH traffic to the server. Is there a way to ignore? I tried to do something like tshark -f "port !22" but ...
0
votes
0answers
258 views

Method to capture traffic going through a wireless router (802.11)

I am interested in monitoring and saving all wireless traffic going through a router (that includes the management frames sent from and the router too) but I am not sure what is the optimal strategy ...
1
vote
0answers
135 views

Is Snort able to efficiently demux and log large HTTP POST requests?

I'm trying to debug some failed HTTP POST requests containing large file uploads (~500 MB). The end-user is receiving strange HTTP responses that are not being logged in either varnish's varnishncsa ...
0
votes
1answer
223 views

Log http data in unique files using tcpick

I'm trying to use tcpick to log http data in unique files (client and server mixed together). This is one of the examples from tcpick's man page: $ tcpick -i eth0 "port 80" -wRub I expected this to ...
2
votes
1answer
739 views

Why do some machines respond with many RST packets instead of RST-ACK to refuse a connection?

I have recently been trying to track down a problem with one of our systems and have noticed that it is simply not allowed to connect to a remote machine. However, the remote machine (not controlled ...
5
votes
0answers
134 views

Why does our Windows 7 Desktop keep continually making SMB requests to our SBS2003 server? [duplicate]

Possible Duplicate: How do I deal with a compromised server? One of our desktop machines (Win 7 64 bit) has recently been complaining of slow down, particularly when accessing resources on ...
1
vote
1answer
232 views

What is the best way/tool to analyze raw data(network stats) from Simulation?

After running a simulation(using a simulator(QualNet)) of a simulated network I end up with ip stats stored in a database, I then extract the data to a csv file So now I have 750mb of raw network ...
0
votes
1answer
555 views

Capturing network traffic (rtmp) between VMs or using loopback in the same VM using wireshark

I need to to capture RTMP traffic between two virtual machines (server and client) or atleast have the server and client on the same machine and capture the traffic. I am able to capture the traffic ...
1
vote
2answers
109 views

Hardware for Capturing Packets

One of my clients is a small school district in Texas. Like any school, they often have problems with network'd peripherals such as printers, et al. It would be nice to be able to simply "listen" to ...