Questions tagged [packet-capture]
Packet capture is the act of capturing data packets crossing a computer network. Packet capture can be: Deep packet capture (headers & payload), or partial packet capture (headers only).
173
questions
4
votes
1
answer
599
views
tcpdump -vvv is not verbose enough
For tcpdump, I use this command to see the packet details:
tcpdump -vvv -i interface
and to save the packets into a pcap file:
tcpdump -i interface -w output
The details from the first command are ...
18
votes
2
answers
64k
views
How can I search the info column in Wireshark?
Wireshark | Windows
I want to search a packet capture of SMTP traffic for specific addresses/messages. Normally, I just sort the info column and browse but it would be nice if I could just run a ...
3
votes
1
answer
7k
views
Wireshark - Capturing Packets on Multiple IP Address (FIlter)
I'm looking for the syntax to do a capture filter on Wireshark, by capturing the traffic on several (specific) IP addresses. I understand how to capture a range, and an individual IP address. However, ...
0
votes
0
answers
27
views
How to capture GOAWAY from a Linux VM (Centos)
Objective:
I'm troubleshooting integration between two service fleets proxied by Envoy (AWS AppMesh) using GRPC.
My GRPC clients never send traffic to the new GRPC servers (after scale-out).
Context:
...
0
votes
1
answer
292
views
Understanding TCP RST Network Capture
I only really need help understand the following image, but I will give the background for context.
We have an app that is configured to use a proxy on port 8080 and requires Internet access. At ...
0
votes
0
answers
105
views
Method of streaming a packet capture from a Windows machine
I have a Windows 10 VM on Hyper-V. It is a production system (yeah I know) that is running multiple critical services that I need to analyse so I can migrate it off to something better. I need to ...
0
votes
0
answers
59
views
[Send mail with attachment]: TCP Retransmission, Duplicate ACK => TCP Reset
So, we have a linux box with postfix running on LAN site A which sends emails to an Microsoft exchange server sitting on site B. This runs perfectly when there is no attachment to the mail. But as ...
0
votes
1
answer
2k
views
Capturing network traffic (rtmp) between VMs or using loopback in the same VM using wireshark
I need to to capture RTMP traffic between two virtual machines (server and client) or atleast have the server and client on the same machine and capture the traffic. I am able to capture the traffic ...
1
vote
2
answers
2k
views
Block DNS query using pfctl
I am trying to create rule to allow DNS queries (port 53) to only 8.8.8.8 server (Google DNS). DNS queries to all other servers should not succeed.
I added the following lines to /etc/pf.conf file
...
1
vote
1
answer
2k
views
server is not responding on SYN packets
On the attached tcp dump, the first two SYN packets (#21800 and 21801) came to the server, however SYN ACK was sent for the second SYN. Is that correct behaviour? My understanding is that the client ...
7
votes
2
answers
13k
views
Linux NFLOG - documentation, configuration from C
Several different places (e.g. http://wiki.wireshark.org/CaptureSetup/NFLOG) recommend using Linux's "NFLOG" firewall module to capture packets generated by a particular UID, like this:
# iptables -A ...
1
vote
0
answers
59
views
Ifconfig result on the server running PF_RING with zerocopy
I have an application which uses PF_Ring zero copy as a part of its packet sniffing capability. When this application is running would it be possible to find out the amount of RX/TX traffic using ...
0
votes
2
answers
2k
views
Why do some VLAN Wireshark captures include data after the IPv4 payload?
Data
Some Cloudshark captures show a "Trailer" for the vLAN and some do not.
Captures
With extra 4 bytes.
Without extra 4 bytes.
Question
Why do some and not all VLAN Wireshark captures include ...
0
votes
0
answers
272
views
Traffic capture at boot
I'm trying to figure out what packets a linux host sends at boot in order to debug it.
Is there a way to start packet capture during boot time to not miss any packets?
What is your way of going about ...
1
vote
0
answers
367
views
Disabled all TCP Offloading and still get 65Kb packets
I'm capturing packets in a Tensorflow two-node training. I want to capture the packet sizes over the wire (< MTU) from the hosts. Because of that, I turned off all of the offloading with ethtool. ...
0
votes
1
answer
2k
views
OpenVPN log connections per user
I'm trying to set up a VPN solution where I can log packet captures of individual connections. I've been focusing on using OpenVPN but I am amenable to other solutions. It is important to note that I ...
6
votes
2
answers
8k
views
How to determine which process is sending UDP packets once per hour?
I was doing a packet capture as part of a development project and saw some odd traffic coming from my machine in the capture file.
About every 3600 seconds, a NAT-PMP request is being sent to the IP "...
2
votes
3
answers
7k
views
VPN packet capture on ASA5505
Following up from a previous question regarding how to capture packets on the ASA5505 I'm having some difficulty in distinguishing which traffic has come through the VPN and which was generated from ...
1
vote
0
answers
117
views
How to see contents of output queue of NIC in Linux and introspect frame delay
I am experimenting with tc tool to implement prioritization of specific data coming from my computer and would like to see exatly how the frames are scheduled and how much time they spend in the qdisc ...
0
votes
1
answer
829
views
Capture filter filter with tcpdump/tshark
I'd like to filter ip messages which are constructed as follow (see picture below):
GRE on top of IP
GRE contains IP with UDP on port 1234 (in the picture below port 80).
How can I filter such ...
0
votes
0
answers
237
views
How to identify source, destination ip using STUN and DTLS protocols?
enter image description here
Given image i'm not able to identify which is source and destination ip address ( client or server). From STUN protocol 1st packet it's user request so i thought 131.202....
0
votes
1
answer
928
views
Where is the ACK to the packet in frame 76? [closed]
I am working through Kurose's book as part of a class and this particular exercise involves submitting a .txt file to the server and capturing this transfer and the server's response.
In one exercise ...
0
votes
1
answer
1k
views
Is there a way to disable TCP segmentation offloading to prevent packets greater than the MTU from being captured from the loopback interface?
I'm trying to create some captures on my linux box. The problem I have is that any captures I take from the loopback interface will contain massive packets that are much larger than the MTU. This ...
6
votes
2
answers
13k
views
Capture network traffic simultaneously on three interfaces
I need to capture traffic on a CentOS 5 server which acts as a web proxy with 2 wan interfaces and 1 LAN. In order to troubleshoot a weird proxy problem, I would like to have a capture of a full ...
3
votes
1
answer
3k
views
TCP Duplicate Ack without Packet Loss
edit: there were actually 2 problems, a buggy TCP implementation on the device running the RTOS and an issue causing the Linux network stack to receive the TCP fragments out of order when more than 1 ...
0
votes
1
answer
789
views
Pcap (tcpdump) filter to match against local port
I'm trying to write a libpcap (tcpdump, iftop) filter that would match packets having a specific local port.
That is, I'm interested in traffic that either goes out of port 12345 on the local machine ...
1
vote
1
answer
1k
views
Forwarded Packets are received by namespace's veth0 but not received by application
I use libtins (It uses Pcap) to capture link layer packets and forward to a network namespace where the actual application runs on.
Client(Browser) -> Server -> Pcap -> Pcap Send -> br0 (...
1
vote
0
answers
300
views
Drawbacks of having pruned and collapsed packets
I am a newbie in networking field, I come across a note that we should not have pruned packets and collapsed packets, if we have, we should have to optimize the system.
But the note (neither the ...
80
votes
4
answers
213k
views
How to make wireshark filter POST-requests only?
How to make wireshark filter POST-requests only?
0
votes
1
answer
78
views
Cisco 877 doesn't respond to IP determined through ARP
I have just obtained an old Cisco 877. I made sure to first push the reset button in the back. I then plugged into one of the LAN ports. The device gave me an IPv4 address (169.254.14.65/16) and an ...
1
vote
0
answers
210
views
How can I capture traffic for a daemon listening on a cloned loopback IP address?
I have a daemon listening on a virtual IP address attached to a cloned loopback interface (lo1) on FreeBSD 11.x.
Inbound traffic for that daemon could arrive on several different physical interfaces, ...
0
votes
1
answer
994
views
Send duplicate UDP packets to another computer
We have a production server where we receive a continuous stream of UDP packets (~ 15 Mbps). We have a small research team which wants to process this same exact stream for some research purposes on ...
0
votes
1
answer
1k
views
How do I capture packets on a Linux VM in a VMware environment?
I've got a Linux server that is a VM running on ESXi 6.7. We're running into some network trouble with it, and I'm trying to use tcpdump to capture traffic on the VM itself, but I'm getting only the ...
2
votes
1
answer
16k
views
Client sends RST after FIN,ACK
While doing a file transfer using secure file transfer protocol, I am seeing the behaviour as given in the below image.
Instead accepting packets from server, it simply sends a RST. Found a similar ...
1
vote
1
answer
240
views
how to man-in-the-middle blocking/intercepting/editing all network traffic going to a single cabled device and a server
I need to completely block and intercept and alter all packets going between two devices. possibly i need to isolate one device and block/intercept/edit ALL traffic going to and from it if i cannot ...
0
votes
0
answers
510
views
Loopback interfaces is not pinging on both pcs for packet tracer
I am trying to ping my isp ip address (aka loopback 1) and loopback 10 to PC1 and PC2. Whenever I ping both ip addresses and default gateway from pc1 to pc2 it works. However, when I'm trying to ping ...
0
votes
1
answer
68
views
CentOS 6 - Find KVM VM with HW addr
We are running KVM VM's (Linux & Windows) on our CentOS 6 & 7 hypervisors.
Sometimes we are noticing a lot of packets going in or out.
Now I want to see which IP address or network adapter ...
0
votes
1
answer
2k
views
How can I gathering Network Traffic on AWS?
I am building packet mirroring using the Linux type's iptables tee module. In the case of instances(EC2), we confirmed that promiscuous mode can be set on AWS console configuration. than, I wonder if ...
1
vote
3
answers
2k
views
Ntop monitoring - Hosts visible with no SPAN/mirroring
I am attempting to use ntop to monitor traffic over a Cisco Catalyst switch.
I was assuming that in order to see any of the traffic, I'd have to use monitor, as described here: http://www.cisco.com/en/...
1
vote
2
answers
4k
views
What are the numbers preceeding a DNS packets flags for?
What does the Flags: 0x0500 section of this DNS query packet mean?
Domain Name System (query)
Transaction ID: 0x4242
Flags: 0x0500 Standard query
0... .... .... .... = Response: ...
0
votes
1
answer
120
views
Tips for working with very large pcaps?
What is the best approach for working with very large collections of network traffic (500GB+)?
Specifically, I'd like to be able to filter packets which match various payload and protocol criteria (...
0
votes
1
answer
292
views
Network sniffer that work as windows service
We need to log the traffic of incoming traffic for some application on our server.
The first instinct is to use Wireshark and of course, as soon our remote session end Wireshark also shutdown.
Since ...
10
votes
6
answers
20k
views
Copying packets from an interface to another
I have a Linux system (let it be A) with 2 ethernet cards, namely eth0 and eth1 which are attached to two totally unrelated LANs.
Basically eth0 is used for normal application traffic and eth1 is ...
1
vote
2
answers
1k
views
What should be the next sequence number after a packet with the FIN containing payload?
I was capturing some HTTP traffics and I observed a packet with the FIN flag set and also containing payload data.
I searched for this topic and I found some similar questions but none of them ...
0
votes
1
answer
560
views
Are TCP RTO value and RTT value influenced by the packet size?
I am doing troubleshooting in my network.
I found some re-transmission by using wireshark.
The segment 1400 bytes are well transmitted but
The segment 800 bytes are lost and re-transmitted.
I know ...
2
votes
2
answers
3k
views
Get network data transfer rate / throughput for use in Wireshark
I'm trying to get the ethernet NIC throughput rate / data transfer rate on a VPS in order to start a capture on Wireshark during DOS/DDOS attacks so I can analyze the nature of the packets.
I'm ...
1
vote
1
answer
289
views
How does LDAP Authentication Work at the TCP Layer?
Specifically, how does an LDAP server distinguish a TCP packet containing a SearchRequestOp from an authenticated user, from a TCP packet containing a SearchRequestOp from an unauthenticated user?
I ...
1
vote
1
answer
611
views
Can user credentials from HTTP session be seen through Wireshark? [duplicate]
Can we get that info the same way we do for FTP since HTTP is a plain text protocol?
2
votes
1
answer
2k
views
Can I verify failure of port forwarding using wireshark / packet capture
I've recently configured a Debian 9 server (Debian 4.9.130-2) to run as a lightweight server, running a series of Docker containers (nextcloud, sync, etc.) alongside basic services like ssh. Services ...
1
vote
3
answers
13k
views
tcpdump syntax for only capturing traffic coming to a specific virtual interface / local IP
CentOS 5.x
I need to collect a packet capture of https requests going to a specific IP address / virtual interface. Is there a specific switch/parameter for tcpdump that will allow that? The other ...