Questions tagged [packet-capture]

Packet capture is the act of capturing data packets crossing a computer network. Packet capture can be: Deep packet capture (headers & payload), or partial packet capture (headers only).

Filter by
Sorted by
Tagged with
0 votes
3 answers
325 views

How to see an application network protocol communication in real time

I would like to see the protocol used by client-server application in real-time. I'm not interested in any statistics. All I want to see is the message sent by server and the client. This is FreeBSD ...
Srikanth's user avatar
  • 101
0 votes
1 answer
3k views

Analyzing twitter packets [closed]

Thanks for your time. I'd like to find a way if a client has made a 'GET' or a 'POST' request for twitter. We are currently doing an educational project and we wanted to understand how we can achieve ...
Dark Knight's user avatar
0 votes
2 answers
134 views

Port forwarding for 100K+ IP's

I need to do port forwarding on my Linux (Debian 8) to intercept packets going through the machine. It needs to be based on source IP, so different ports for different IPs. I've though of using ...
Alfred Balle's user avatar
0 votes
1 answer
868 views

PCAP filter for first few packets, and packets related to disconnection, TCP-only

I'd like to use tcpdump with a filter for some long-running debugging. Specifically, I only want to capture packets with the following conditions: First 10 packets or so of a new TCP connection (...
Brad's user avatar
  • 1,427
0 votes
2 answers
4k views

iperf udp sequence number wireshark

I'm using iperf for generating udp traffic and my objective is to measure paquet loss. I wanted to know if the first 4 Bytes of Iperf Data are currently the sequence number.
progloverfan's user avatar
0 votes
2 answers
310 views

Identify Executable Creating Network Traffic

I've got some application on my Windows XP machine that is generating an HTTP request to aaronsw.com every half hour. We've trapped the packets in wireshark, but wireshark doesn't tell what ...
jeffspost's user avatar
  • 139
0 votes
2 answers
2k views

Who can issue a RST?

I have a client connecting to a server via a VPN tunnel. The connectivity is in place, I can ping the server and requests some other services (a curl request on an API for instance) through that ...
WoJ's user avatar
  • 3,657
0 votes
1 answer
6k views

Why are ICMP packets not captured on the target interface?

I have a network setup as in the picture: The central box is a gateway (Ubuntu 15.10) which relays the packets betwen the various networks (only one is shown on the picture - lan0) and Internet. ...
WoJ's user avatar
  • 3,657
0 votes
3 answers
4k views

How to sniff all HTTP packets on a wifi network? [closed]

I need to sniff all HTTP packets that pass through my wifi network (in particular HTTP requests by my smartphone). I've tried with wireshark, but I can sniff only packets to and from my pc. What am I ...
giozh's user avatar
  • 101
0 votes
1 answer
2k views

Incoming Outgoing Packets Wireshark

Is there a way to have a column or a filter that marks each packet as incoming (download) or outgoing (upload) in Wireshark? I guess this should be relative to the selected capture interface device.
Ventolinmono's user avatar
0 votes
1 answer
2k views

What does a packet capture in pfsense do?

I have some issues with a third party to establish a VPN connection. To debug it, I made a packet capture on the device that represents our synchronous DSL line. The solution I'm using is an old ...
noamik's user avatar
  • 173
0 votes
1 answer
1k views

obtaining nimbuzz server certificate for nmdecrypt expert in NetMon

I'm using Network Monitor 3.4 with the nmdecrypt expert. I'm opening a nimbuzz conversation node in the conversation window and i click Expert-> nmDecrpt -> run Expert that shows up a window where i ...
lurscher's user avatar
  • 172
0 votes
3 answers
2k views

How do I trace from my client PC what databases it connects to

I wonder if there is some way to trace what servers my program using OLEDB tries to connect to. Problem: I have a program displaying some reports made in Crystal Reports. The loading of some reports ...
mortb's user avatar
  • 103
0 votes
2 answers
10k views

How can I see http/https URL's in Microsoft Network Monitor 3.x capture files?

I've used Microsoft Network Monitor 3.x before for various reasons but realized today I don't know how to tell the URL inside a conversation. I've got it set for "Windows" Parser Profile and I see a ...
Bret Fisher's user avatar
  • 3,983
0 votes
2 answers
3k views

Packet Sniffing through proxy PC via router

i have a linksys wireless N router. I want to setup a proxy on my Windows 7 PC along with a packet sniffer, and setup my devices to use the proxy on the Windows 7 PC. So far, I've tried Squid, but ...
Daddy's user avatar
  • 237
0 votes
2 answers
109 views

How Packets are absorbed in a ring connection?

In a bus topology you have a terminator which absorbs unused packet(noise).What happens in the case of a ring topology?
user avatar
0 votes
2 answers
5k views

Track IP Messenger's chatting by wireshark

We have Linux server ( RHEL 5 ), and some client machines ( Windows XP ) in local area network. We using server as proxy server. I am using squid proxy. My windows machines using internet by proxy. ...
Kumar's user avatar
  • 823
0 votes
1 answer
293 views

Understanding TCP RST Network Capture

I only really need help understand the following image, but I will give the background for context. We have an app that is configured to use a proxy on port 8080 and requires Internet access. At ...
Mucker's user avatar
  • 367
0 votes
1 answer
929 views

Where is the ACK to the packet in frame 76? [closed]

I am working through Kurose's book as part of a class and this particular exercise involves submitting a .txt file to the server and capturing this transfer and the server's response. In one exercise ...
Segmentation fault's user avatar
0 votes
1 answer
994 views

Send duplicate UDP packets to another computer

We have a production server where we receive a continuous stream of UDP packets (~ 15 Mbps). We have a small research team which wants to process this same exact stream for some research purposes on ...
Azeem Khan's user avatar
0 votes
1 answer
2k views

How can I gathering Network Traffic on AWS?

I am building packet mirroring using the Linux type's iptables tee module. In the case of instances(EC2), we confirmed that promiscuous mode can be set on AWS console configuration. than, I wonder if ...
scott's user avatar
  • 9
0 votes
1 answer
1k views

How to turn an ethernet port into a passive listener?

I want to capture ethernet packets with my raspberry pi's ethernet port. I know I could create an ethernet bridge between two ethernet ports on the raspberry and analyze the packets internally with ...
guerlando's user avatar
0 votes
1 answer
217 views

packet colorization in Wireshark

is there anyone who could sum up the packet colorization system in wireshark? My capture list is looking quite colourful, but I don't quite understand how the colorization scheme work. Thank you
m.rossi's user avatar
  • 103
0 votes
1 answer
689 views

How to perform Wiresharks File->Extract Objects->HTTP through Tshark commandline interface?

Using TShark, I want to be able to extract the payload in HTTP response from packets data captured through tshark in a .pcap file. In the Wireshark GUI, I was able to do that by File > Extract ...
Jesss's user avatar
  • 23
0 votes
1 answer
444 views

PCAP traffic frame length short

I'm trying to make traffic and capture it using pcap file. I get pcap file from CAIDA(caida.org) site. This pcap file too big and doesn't have ethernet header. So i splitted pcap file to small size(40 ...
whitehat's user avatar
0 votes
1 answer
639 views

How to ping a host with different MTU size to simulate icmpv6 packet too big scenario?

As the Title states,I want to check whether my host will actually send a ICMPv6 packet too big if i send a packet with beyond the defined MTU size.I don't have a cisco router(extended ping) to try out ...
Renold's user avatar
  • 33
0 votes
3 answers
13k views

user agent in http or https request

Is there any way that I can differentiate, the HTTP or HTTPS packets are coming from browser or not ? specially for https request.There is User-Agent field in packet in Http,but I could not found ...
user95711's user avatar
  • 211
0 votes
1 answer
908 views

Meraki VPN Traffic Capture

We have multiple offices interconnected via VPN using Meraki switches. I've been looking around and can't seem to find a way, but was thinking it's possible. Is it possible for me to put my desktop on ...
Joseph's user avatar
  • 293
0 votes
1 answer
206 views

Possible causes of high download activity on network [closed]

We had an issue where we noticed approximately 170GB of data downloaded as http traffic over a one week period on our network. After locking down many services and running a hub as an in between ...
dasko's user avatar
  • 1,244
0 votes
2 answers
803 views

capture nimbuzz traffic

I need to capture all the traffic, specially during login, between nimbuzz pc client and nimbuzz server. The reason is that i need to debug outgoing packets at login that mark the user visibility ...
lurscher's user avatar
  • 172
0 votes
1 answer
399 views

How can I read a packet capture file from a Cisco RV 120W?

What program should I use? (the file is generated on RV 120W under Diagnostics section)
700 Software's user avatar
  • 2,273
0 votes
1 answer
627 views

Linux TCP stack and network cards performance: packets per minute before drop?

how much TCP packets should come at 100/1000mbit network card (not an embedded Realtek's home solution) before the Linux kernel will become unable to process the NIC's buffer resulting in packet drop? ...
kagali-san's user avatar
  • 2,011
0 votes
0 answers
27 views

How to capture GOAWAY from a Linux VM (Centos)

Objective: I'm troubleshooting integration between two service fleets proxied by Envoy (AWS AppMesh) using GRPC. My GRPC clients never send traffic to the new GRPC servers (after scale-out). Context: ...
Alcaneo's user avatar
0 votes
0 answers
105 views

Method of streaming a packet capture from a Windows machine

I have a Windows 10 VM on Hyper-V. It is a production system (yeah I know) that is running multiple critical services that I need to analyse so I can migrate it off to something better. I need to ...
RoyT's user avatar
  • 1
0 votes
0 answers
59 views

[Send mail with attachment]: TCP Retransmission, Duplicate ACK => TCP Reset

So, we have a linux box with postfix running on LAN site A which sends emails to an Microsoft exchange server sitting on site B. This runs perfectly when there is no attachment to the mail. But as ...
Michael Muller's user avatar
0 votes
0 answers
272 views

Traffic capture at boot

I'm trying to figure out what packets a linux host sends at boot in order to debug it. Is there a way to start packet capture during boot time to not miss any packets? What is your way of going about ...
lolz's user avatar
  • 11
0 votes
1 answer
830 views

Capture filter filter with tcpdump/tshark

I'd like to filter ip messages which are constructed as follow (see picture below): GRE on top of IP GRE contains IP with UDP on port 1234 (in the picture below port 80). How can I filter such ...
user1977050's user avatar
0 votes
0 answers
238 views

How to identify source, destination ip using STUN and DTLS protocols?

enter image description here Given image i'm not able to identify which is source and destination ip address ( client or server). From STUN protocol 1st packet it's user request so i thought 131.202....
David Roonie's user avatar
0 votes
1 answer
1k views

Is there a way to disable TCP segmentation offloading to prevent packets greater than the MTU from being captured from the loopback interface?

I'm trying to create some captures on my linux box. The problem I have is that any captures I take from the loopback interface will contain massive packets that are much larger than the MTU. This ...
kansas_bulldog382's user avatar
0 votes
1 answer
789 views

Pcap (tcpdump) filter to match against local port

I'm trying to write a libpcap (tcpdump, iftop) filter that would match packets having a specific local port. That is, I'm interested in traffic that either goes out of port 12345 on the local machine ...
intelfx's user avatar
  • 144
0 votes
1 answer
1k views

How do I capture packets on a Linux VM in a VMware environment?

I've got a Linux server that is a VM running on ESXi 6.7. We're running into some network trouble with it, and I'm trying to use tcpdump to capture traffic on the VM itself, but I'm getting only the ...
le_jawa's user avatar
  • 113
0 votes
1 answer
2k views

OpenVPN log connections per user

I'm trying to set up a VPN solution where I can log packet captures of individual connections. I've been focusing on using OpenVPN but I am amenable to other solutions. It is important to note that I ...
ahjohnston25's user avatar
0 votes
0 answers
510 views

Loopback interfaces is not pinging on both pcs for packet tracer

I am trying to ping my isp ip address (aka loopback 1) and loopback 10 to PC1 and PC2. Whenever I ping both ip addresses and default gateway from pc1 to pc2 it works. However, when I'm trying to ping ...
Kevin 's user avatar
0 votes
1 answer
68 views

CentOS 6 - Find KVM VM with HW addr

We are running KVM VM's (Linux & Windows) on our CentOS 6 & 7 hypervisors. Sometimes we are noticing a lot of packets going in or out. Now I want to see which IP address or network adapter ...
Pinkman's user avatar
0 votes
1 answer
120 views

Tips for working with very large pcaps?

What is the best approach for working with very large collections of network traffic (500GB+)? Specifically, I'd like to be able to filter packets which match various payload and protocol criteria (...
pavja2's user avatar
  • 101
0 votes
1 answer
292 views

Network sniffer that work as windows service

We need to log the traffic of incoming traffic for some application on our server. The first instinct is to use Wireshark and of course, as soon our remote session end Wireshark also shutdown. Since ...
Lishi's user avatar
  • 101
0 votes
1 answer
560 views

Are TCP RTO value and RTT value influenced by the packet size?

I am doing troubleshooting in my network. I found some re-transmission by using wireshark. The segment 1400 bytes are well transmitted but The segment 800 bytes are lost and re-transmitted. I know ...
nimdrak's user avatar
  • 139
0 votes
1 answer
78 views

Cisco 877 doesn't respond to IP determined through ARP

I have just obtained an old Cisco 877. I made sure to first push the reset button in the back. I then plugged into one of the LAN ports. The device gave me an IPv4 address (169.254.14.65/16) and an ...
Stringers's user avatar
0 votes
1 answer
956 views

How can I identify the cause of packet loss in DNS?

We have upgraded some of our routers to Ubuntu 16.04 and are now getting some performance problems with DNS. It seems that packets are sometimes truncated, but I have no clue what else I can do: This ...
Thomas's user avatar
  • 187
0 votes
1 answer
682 views

How do I generate a source of netflow data for nfcapd?

I am trying to use nfcapd to save netflow files for use by a network analysis tool. How do I capture network traffic on my host and send it into nfcapd? Can I use wireshark/tshark or something ...
aaa90210's user avatar
  • 351