Questions tagged [packet-capture]

Packet capture is the act of capturing data packets crossing a computer network. Packet capture can be: Deep packet capture (headers & payload), or partial packet capture (headers only).

47 questions with no upvoted or accepted answers
Filter by
Sorted by
Tagged with
3 votes
1 answer
334 views

Suggestions on how to capture network connections/traffic for determining browser/SSL versions?

Note that I posted this Q to the StackExchange InfoSec site, but its not as populated as ServerFault and this is more on the technical side of network collection for web services. I've started ...
dubmojo's user avatar
  • 203
1 vote
0 answers
59 views

Ifconfig result on the server running PF_RING with zerocopy

I have an application which uses PF_Ring zero copy as a part of its packet sniffing capability. When this application is running would it be possible to find out the amount of RX/TX traffic using ...
user2714795's user avatar
1 vote
0 answers
367 views

Disabled all TCP Offloading and still get 65Kb packets

I'm capturing packets in a Tensorflow two-node training. I want to capture the packet sizes over the wire (< MTU) from the hosts. Because of that, I turned off all of the offloading with ethtool. ...
morteza hosseini's user avatar
1 vote
0 answers
117 views

How to see contents of output queue of NIC in Linux and introspect frame delay

I am experimenting with tc tool to implement prioritization of specific data coming from my computer and would like to see exatly how the frames are scheduled and how much time they spend in the qdisc ...
Hadarelv's user avatar
1 vote
0 answers
300 views

Drawbacks of having pruned and collapsed packets

I am a newbie in networking field, I come across a note that we should not have pruned packets and collapsed packets, if we have, we should have to optimize the system. But the note (neither the ...
smc's user avatar
  • 133
1 vote
0 answers
210 views

How can I capture traffic for a daemon listening on a cloned loopback IP address?

I have a daemon listening on a virtual IP address attached to a cloned loopback interface (lo1) on FreeBSD 11.x. Inbound traffic for that daemon could arrive on several different physical interfaces, ...
Alnitak's user avatar
  • 21.3k
1 vote
1 answer
240 views

how to man-in-the-middle blocking/intercepting/editing all network traffic going to a single cabled device and a server

I need to completely block and intercept and alter all packets going between two devices. possibly i need to isolate one device and block/intercept/edit ALL traffic going to and from it if i cannot ...
Ya Guy Godzilla's user avatar
1 vote
0 answers
3k views

Can I capture full TCP packet content with haproxy without knowing length of the packet?

I know I can capture 6 bytes length packet using this config: global log /dev/log local0 debug log /dev/log local1 notice chroot /var/lib/haproxy stats socket /...
Defozo's user avatar
  • 153
1 vote
1 answer
593 views

rpcapd behind a firewall

I have a remote server with rpcapd installed that follows strict security policy rules. Any client can access to the server only via firewall that follows same security policy (please, don't blame me, ...
enzo's user avatar
  • 11
1 vote
0 answers
451 views

Netsh trace vs PEF trace cmdlets vs NetEvent cmdlets

I am playing with capturing my network traffic and came across two different MS commandline tools that allow doing this: a well-known netsh tool, recently equipped with powerful capture switch a ...
Suncatcher's user avatar
1 vote
2 answers
2k views

Block DNS query using pfctl

I am trying to create rule to allow DNS queries (port 53) to only 8.8.8.8 server (Google DNS). DNS queries to all other servers should not succeed. I added the following lines to /etc/pf.conf file ...
sam's user avatar
  • 11
1 vote
1 answer
2k views

server is not responding on SYN packets

On the attached tcp dump, the first two SYN packets (#21800 and 21801) came to the server, however SYN ACK was sent for the second SYN. Is that correct behaviour? My understanding is that the client ...
sidorvm's user avatar
  • 11
1 vote
0 answers
181 views

Redirect Default Gateway Traffic in Linux to File

I am trying to troubleshoot one of my linux servers (ubuntu server). Therefore I want to intercept all traffic that is sent to the default gateway and then write it to a file: preferably some kind of ...
user1252280's user avatar
1 vote
1 answer
826 views

"tshark: There are no interfaces on which a capture can be done" in Amazon Linux AMI

My goal is to capture packets with tshark in Amazon Linux AMI. While typing tshark in the command line there's an error: "tshark: There are no interfaces on which a capture can be done" How to ...
rokpoto.com's user avatar
1 vote
1 answer
277 views

Capturing packets via l7filter

As a part of my Ph. D study, I compile linux-2.6.28 kernel to support in-kernel l7filtering capabilities. I'm adding a single rule to iptables with the following: iptables -t mangle -A PREROUTING -m ...
Abdullah's user avatar
1 vote
0 answers
247 views

Is there a tool to do packet mirroring in CentOS 5.9?

I know iptables + xtables can do it in more recent versions using the TEE target supplied by the xtables-addon package for iptables. However, the kernel in CentOS 5.9 is 2.6.18 and this version is not ...
donatello's user avatar
  • 746
1 vote
0 answers
214 views

Is Snort able to efficiently demux and log large HTTP POST requests?

I'm trying to debug some failed HTTP POST requests containing large file uploads (~500 MB). The end-user is receiving strange HTTP responses that are not being logged in either varnish's varnishncsa ...
Israel Zion Shirk's user avatar
1 vote
1 answer
769 views

What is the best way/tool to analyze raw data(network stats) from Simulation?

After running a simulation(using a simulator(QualNet)) of a simulated network I end up with ip stats stored in a database, I then extract the data to a csv file So now I have 750mb of raw network ...
user90500's user avatar
  • 111
1 vote
0 answers
272 views

How to add TDS support to tshark?

How to add TDS (knowledge about MS SQL Server packets' structure) support for tshark? Currently, the situation is this: root@DEV:/# tshark -d . 2>&1| grep -i tds root@DEV:/# I.e: tshark does not ...
Henno's user avatar
  • 1,056
0 votes
0 answers
27 views

How to capture GOAWAY from a Linux VM (Centos)

Objective: I'm troubleshooting integration between two service fleets proxied by Envoy (AWS AppMesh) using GRPC. My GRPC clients never send traffic to the new GRPC servers (after scale-out). Context: ...
Alcaneo's user avatar
0 votes
0 answers
105 views

Method of streaming a packet capture from a Windows machine

I have a Windows 10 VM on Hyper-V. It is a production system (yeah I know) that is running multiple critical services that I need to analyse so I can migrate it off to something better. I need to ...
RoyT's user avatar
  • 1
0 votes
0 answers
59 views

[Send mail with attachment]: TCP Retransmission, Duplicate ACK => TCP Reset

So, we have a linux box with postfix running on LAN site A which sends emails to an Microsoft exchange server sitting on site B. This runs perfectly when there is no attachment to the mail. But as ...
Michael Muller's user avatar
0 votes
0 answers
272 views

Traffic capture at boot

I'm trying to figure out what packets a linux host sends at boot in order to debug it. Is there a way to start packet capture during boot time to not miss any packets? What is your way of going about ...
lolz's user avatar
  • 11
0 votes
1 answer
829 views

Capture filter filter with tcpdump/tshark

I'd like to filter ip messages which are constructed as follow (see picture below): GRE on top of IP GRE contains IP with UDP on port 1234 (in the picture below port 80). How can I filter such ...
user1977050's user avatar
0 votes
0 answers
237 views

How to identify source, destination ip using STUN and DTLS protocols?

enter image description here Given image i'm not able to identify which is source and destination ip address ( client or server). From STUN protocol 1st packet it's user request so i thought 131.202....
David Roonie's user avatar
0 votes
1 answer
789 views

Pcap (tcpdump) filter to match against local port

I'm trying to write a libpcap (tcpdump, iftop) filter that would match packets having a specific local port. That is, I'm interested in traffic that either goes out of port 12345 on the local machine ...
intelfx's user avatar
  • 144
0 votes
1 answer
2k views

OpenVPN log connections per user

I'm trying to set up a VPN solution where I can log packet captures of individual connections. I've been focusing on using OpenVPN but I am amenable to other solutions. It is important to note that I ...
ahjohnston25's user avatar
0 votes
0 answers
510 views

Loopback interfaces is not pinging on both pcs for packet tracer

I am trying to ping my isp ip address (aka loopback 1) and loopback 10 to PC1 and PC2. Whenever I ping both ip addresses and default gateway from pc1 to pc2 it works. However, when I'm trying to ping ...
Kevin 's user avatar
0 votes
1 answer
120 views

Tips for working with very large pcaps?

What is the best approach for working with very large collections of network traffic (500GB+)? Specifically, I'd like to be able to filter packets which match various payload and protocol criteria (...
pavja2's user avatar
  • 101
0 votes
1 answer
292 views

Network sniffer that work as windows service

We need to log the traffic of incoming traffic for some application on our server. The first instinct is to use Wireshark and of course, as soon our remote session end Wireshark also shutdown. Since ...
Lishi's user avatar
  • 101
0 votes
1 answer
956 views

How can I identify the cause of packet loss in DNS?

We have upgraded some of our routers to Ubuntu 16.04 and are now getting some performance problems with DNS. It seems that packets are sometimes truncated, but I have no clue what else I can do: This ...
Thomas's user avatar
  • 187
0 votes
1 answer
682 views

How do I generate a source of netflow data for nfcapd?

I am trying to use nfcapd to save netflow files for use by a network analysis tool. How do I capture network traffic on my host and send it into nfcapd? Can I use wireshark/tshark or something ...
aaa90210's user avatar
  • 351
0 votes
1 answer
989 views

How to filter wireshark capture to have only packets with local ip as source or destination

How to filter wireshark capture to have only packets with local ip as source or destination? The expression should be valid for both ipv4 and ipv6. I am obviously asking for an other solution than ...
user196279's user avatar
0 votes
1 answer
372 views

how can i export sflow data to be saved in pcap on other server in realtime?

I have a pfsense server, all of attacks will come to its WAN interface. i have setup another packet analysis tool on private network behind pfsense. i want to send realtime WAN traffic from pfsense ...
Farhan's user avatar
  • 4,309
0 votes
0 answers
200 views

In the output of Chaosreader, where are the source and destination port numbers and IP addresses for each packet?

I used this tutorial to use Chaosreader on an output file of WinDump. My purpose was to get the HTTP payload, which I got. But I'd also like to extract other information, like source IP and ...
Jesss's user avatar
  • 23
0 votes
2 answers
2k views

Why do some VLAN Wireshark captures include data after the IPv4 payload?

Data Some Cloudshark captures show a "Trailer" for the vLAN and some do not. Captures With extra 4 bytes. Without extra 4 bytes. Question Why do some and not all VLAN Wireshark captures include ...
Klik's user avatar
  • 101
0 votes
0 answers
90 views

ICMP Packet Flood a local device over Wireless AP to figure out packet loss?

I'm using a utility to create an ICMP packet flood/attack called Hyanea since windows doesn't have native support like linux does. I want to be able to test a new AP to see if any packet loss occurs....
Faahmed's user avatar
  • 113
0 votes
0 answers
2k views

Capture all mysql requests/responses and caculate the response time using tcpdump

I need to capture all mysql requests/responses using tcpdump and after that need to find out which response related to which request in order to caculate the response time of each request. I used the ...
Michel Gokan Khan's user avatar
0 votes
0 answers
356 views

Early tear down of communication

I have an application which performs an LDAP search which works in one domain but not in the other, when analyzing the packets sent between the application server and the domain controller being ...
user3129787's user avatar
0 votes
1 answer
395 views

Network card capable of capturing a tonne of packets and not dropping them?

Edit: Our server is trying to capture packets at between 500-600Mb/s, but is dropping packets 'due to kernel'. Data is being written to SSDs, and isn't bottleneck there. What things should I look ...
BIGMOOSE's user avatar
0 votes
2 answers
672 views

monitor network packet rate per IP

my problem is that I've got a report that my IP was used in a DOS attack. Problem is that I do not know which computer is infected and the attack is not active anymore. Is there simple Linux tool for ...
Vit Bernatik's user avatar
0 votes
1 answer
847 views

syn flood attack -- packet hits on shared ip

How can I dump the TCP packets to get a better idea to know which website is being attacked? Here is what I have in my logs: May 4 23:10:26 host kernel: [2130002.635000] Firewall: *SYNFLOOD ...
John Miachels's user avatar
0 votes
1 answer
84 views

Filter ip traffic based on certain packet bits

I want to capture ip traffic at a linux machine based on the following bpf filter: ether[45]=0x11 and ether[68]=0x34 Incoming traffic is around 20Gbps and the filter discards 95% of the traffic. As ...
nkout's user avatar
  • 101
0 votes
1 answer
595 views

Filtering inbound traffic without knowing the destination subnet

I have a linux machine configured as a router with two interfaces facing LAN A and LAN B. I want to filter traffic passing from LAN A to LAN B (inbound traffic) using tcpdump, but I don't have the ...
Yasser's user avatar
  • 101
0 votes
1 answer
740 views

Log http data in unique files using tcpick

I'm trying to use tcpick to log http data in unique files (client and server mixed together). This is one of the examples from tcpick's man page: $ tcpick -i eth0 "port 80" -wRub I expected this to ...
otto.poellath's user avatar
0 votes
1 answer
2k views

Capturing network traffic (rtmp) between VMs or using loopback in the same VM using wireshark

I need to to capture RTMP traffic between two virtual machines (server and client) or atleast have the server and client on the same machine and capture the traffic. I am able to capture the traffic ...
ssn's user avatar
  • 111
-1 votes
1 answer
1k views

Why is my chunked request removing the trailing CRLF?

I've just spent the past 10 hours trying to figure out why my http request was failing when I did a request.Content.ReadAsMultipartAsync().Result.Contents It kept returning the error: Unexpected ...
Scottie's user avatar
  • 169