Questions tagged [packet-capture]
Packet capture is the act of capturing data packets crossing a computer network. Packet capture can be: Deep packet capture (headers & payload), or partial packet capture (headers only).
47
questions with no upvoted or accepted answers
3
votes
1
answer
334
views
Suggestions on how to capture network connections/traffic for determining browser/SSL versions?
Note that I posted this Q to the StackExchange InfoSec site, but its not as populated as ServerFault and this is more on the technical side of network collection for web services.
I've started ...
1
vote
0
answers
59
views
Ifconfig result on the server running PF_RING with zerocopy
I have an application which uses PF_Ring zero copy as a part of its packet sniffing capability. When this application is running would it be possible to find out the amount of RX/TX traffic using ...
1
vote
0
answers
367
views
Disabled all TCP Offloading and still get 65Kb packets
I'm capturing packets in a Tensorflow two-node training. I want to capture the packet sizes over the wire (< MTU) from the hosts. Because of that, I turned off all of the offloading with ethtool. ...
1
vote
0
answers
117
views
How to see contents of output queue of NIC in Linux and introspect frame delay
I am experimenting with tc tool to implement prioritization of specific data coming from my computer and would like to see exatly how the frames are scheduled and how much time they spend in the qdisc ...
1
vote
0
answers
300
views
Drawbacks of having pruned and collapsed packets
I am a newbie in networking field, I come across a note that we should not have pruned packets and collapsed packets, if we have, we should have to optimize the system.
But the note (neither the ...
1
vote
0
answers
210
views
How can I capture traffic for a daemon listening on a cloned loopback IP address?
I have a daemon listening on a virtual IP address attached to a cloned loopback interface (lo1) on FreeBSD 11.x.
Inbound traffic for that daemon could arrive on several different physical interfaces, ...
1
vote
1
answer
240
views
how to man-in-the-middle blocking/intercepting/editing all network traffic going to a single cabled device and a server
I need to completely block and intercept and alter all packets going between two devices. possibly i need to isolate one device and block/intercept/edit ALL traffic going to and from it if i cannot ...
1
vote
0
answers
3k
views
Can I capture full TCP packet content with haproxy without knowing length of the packet?
I know I can capture 6 bytes length packet using this config:
global
log /dev/log local0 debug
log /dev/log local1 notice
chroot /var/lib/haproxy
stats socket /...
1
vote
1
answer
593
views
rpcapd behind a firewall
I have a remote server with rpcapd installed that follows strict security policy rules. Any client can access to the server only via firewall that follows same security policy (please, don't blame me, ...
1
vote
0
answers
451
views
Netsh trace vs PEF trace cmdlets vs NetEvent cmdlets
I am playing with capturing my network traffic and came across two different MS commandline tools that allow doing this:
a well-known netsh tool, recently equipped with powerful capture switch
a ...
1
vote
2
answers
2k
views
Block DNS query using pfctl
I am trying to create rule to allow DNS queries (port 53) to only 8.8.8.8 server (Google DNS). DNS queries to all other servers should not succeed.
I added the following lines to /etc/pf.conf file
...
1
vote
1
answer
2k
views
server is not responding on SYN packets
On the attached tcp dump, the first two SYN packets (#21800 and 21801) came to the server, however SYN ACK was sent for the second SYN. Is that correct behaviour? My understanding is that the client ...
1
vote
0
answers
181
views
Redirect Default Gateway Traffic in Linux to File
I am trying to troubleshoot one of my linux servers (ubuntu server). Therefore I want to intercept all traffic that is sent to the default gateway and then write it to a file: preferably some kind of ...
1
vote
1
answer
826
views
"tshark: There are no interfaces on which a capture can be done" in Amazon Linux AMI
My goal is to capture packets with tshark in Amazon Linux AMI. While typing tshark in the command line there's an error:
"tshark: There are no interfaces on which a capture can be done"
How to ...
1
vote
1
answer
277
views
Capturing packets via l7filter
As a part of my Ph. D study, I compile linux-2.6.28 kernel to support in-kernel l7filtering capabilities.
I'm adding a single rule to iptables with the following:
iptables -t mangle -A PREROUTING -m ...
1
vote
0
answers
247
views
Is there a tool to do packet mirroring in CentOS 5.9?
I know iptables + xtables can do it in more recent versions using the TEE target supplied by the xtables-addon package for iptables. However, the kernel in CentOS 5.9 is 2.6.18 and this version is not ...
1
vote
0
answers
214
views
Is Snort able to efficiently demux and log large HTTP POST requests?
I'm trying to debug some failed HTTP POST requests containing large file uploads (~500 MB). The end-user is receiving strange HTTP responses that are not being logged in either varnish's varnishncsa ...
1
vote
1
answer
769
views
What is the best way/tool to analyze raw data(network stats) from Simulation?
After running a simulation(using a simulator(QualNet)) of a simulated network I end up with ip stats stored in a database, I then extract the data to a csv file
So now I have 750mb of raw network ...
1
vote
0
answers
272
views
How to add TDS support to tshark?
How to add TDS (knowledge about MS SQL Server packets' structure) support for tshark?
Currently, the situation is this:
root@DEV:/# tshark -d . 2>&1| grep -i tds
root@DEV:/#
I.e: tshark does not ...
0
votes
0
answers
27
views
How to capture GOAWAY from a Linux VM (Centos)
Objective:
I'm troubleshooting integration between two service fleets proxied by Envoy (AWS AppMesh) using GRPC.
My GRPC clients never send traffic to the new GRPC servers (after scale-out).
Context:
...
0
votes
0
answers
105
views
Method of streaming a packet capture from a Windows machine
I have a Windows 10 VM on Hyper-V. It is a production system (yeah I know) that is running multiple critical services that I need to analyse so I can migrate it off to something better. I need to ...
0
votes
0
answers
59
views
[Send mail with attachment]: TCP Retransmission, Duplicate ACK => TCP Reset
So, we have a linux box with postfix running on LAN site A which sends emails to an Microsoft exchange server sitting on site B. This runs perfectly when there is no attachment to the mail. But as ...
0
votes
0
answers
272
views
Traffic capture at boot
I'm trying to figure out what packets a linux host sends at boot in order to debug it.
Is there a way to start packet capture during boot time to not miss any packets?
What is your way of going about ...
0
votes
1
answer
829
views
Capture filter filter with tcpdump/tshark
I'd like to filter ip messages which are constructed as follow (see picture below):
GRE on top of IP
GRE contains IP with UDP on port 1234 (in the picture below port 80).
How can I filter such ...
0
votes
0
answers
237
views
How to identify source, destination ip using STUN and DTLS protocols?
enter image description here
Given image i'm not able to identify which is source and destination ip address ( client or server). From STUN protocol 1st packet it's user request so i thought 131.202....
0
votes
1
answer
789
views
Pcap (tcpdump) filter to match against local port
I'm trying to write a libpcap (tcpdump, iftop) filter that would match packets having a specific local port.
That is, I'm interested in traffic that either goes out of port 12345 on the local machine ...
0
votes
1
answer
2k
views
OpenVPN log connections per user
I'm trying to set up a VPN solution where I can log packet captures of individual connections. I've been focusing on using OpenVPN but I am amenable to other solutions. It is important to note that I ...
0
votes
0
answers
510
views
Loopback interfaces is not pinging on both pcs for packet tracer
I am trying to ping my isp ip address (aka loopback 1) and loopback 10 to PC1 and PC2. Whenever I ping both ip addresses and default gateway from pc1 to pc2 it works. However, when I'm trying to ping ...
0
votes
1
answer
120
views
Tips for working with very large pcaps?
What is the best approach for working with very large collections of network traffic (500GB+)?
Specifically, I'd like to be able to filter packets which match various payload and protocol criteria (...
0
votes
1
answer
292
views
Network sniffer that work as windows service
We need to log the traffic of incoming traffic for some application on our server.
The first instinct is to use Wireshark and of course, as soon our remote session end Wireshark also shutdown.
Since ...
0
votes
1
answer
956
views
How can I identify the cause of packet loss in DNS?
We have upgraded some of our routers to Ubuntu 16.04 and are now getting some performance problems with DNS. It seems that packets are sometimes truncated, but I have no clue what else I can do:
This ...
0
votes
1
answer
682
views
How do I generate a source of netflow data for nfcapd?
I am trying to use nfcapd to save netflow files for use by a network analysis tool.
How do I capture network traffic on my host and send it into nfcapd? Can I use wireshark/tshark or something ...
0
votes
1
answer
989
views
How to filter wireshark capture to have only packets with local ip as source or destination
How to filter wireshark capture to have only packets with local ip as source or destination?
The expression should be valid for both ipv4 and ipv6.
I am obviously asking for an other solution than ...
0
votes
1
answer
372
views
how can i export sflow data to be saved in pcap on other server in realtime?
I have a pfsense server, all of attacks will come to its WAN interface. i have setup another packet analysis tool on private network behind pfsense. i want to send realtime WAN traffic from pfsense ...
0
votes
0
answers
200
views
In the output of Chaosreader, where are the source and destination port numbers and IP addresses for each packet?
I used this tutorial to use Chaosreader on an output file of WinDump. My purpose was to get the HTTP payload, which I got. But I'd also like to extract other information, like source IP and ...
0
votes
2
answers
2k
views
Why do some VLAN Wireshark captures include data after the IPv4 payload?
Data
Some Cloudshark captures show a "Trailer" for the vLAN and some do not.
Captures
With extra 4 bytes.
Without extra 4 bytes.
Question
Why do some and not all VLAN Wireshark captures include ...
0
votes
0
answers
90
views
ICMP Packet Flood a local device over Wireless AP to figure out packet loss?
I'm using a utility to create an ICMP packet flood/attack called Hyanea since windows doesn't have native support like linux does.
I want to be able to test a new AP to see if any packet loss occurs....
0
votes
0
answers
2k
views
Capture all mysql requests/responses and caculate the response time using tcpdump
I need to capture all mysql requests/responses using tcpdump and after that need to find out which response related to which request in order to caculate the response time of each request.
I used the ...
0
votes
0
answers
356
views
Early tear down of communication
I have an application which performs an LDAP search which works in one domain but not in the other, when analyzing the packets sent between the application server and the domain controller being ...
0
votes
1
answer
395
views
Network card capable of capturing a tonne of packets and not dropping them?
Edit:
Our server is trying to capture packets at between 500-600Mb/s, but is dropping packets 'due to kernel'.
Data is being written to SSDs, and isn't bottleneck there.
What things should I look ...
0
votes
2
answers
672
views
monitor network packet rate per IP
my problem is that I've got a report that my IP was used in a DOS attack. Problem is that I do not know which computer is infected and the attack is not active anymore.
Is there simple Linux tool for ...
0
votes
1
answer
847
views
syn flood attack -- packet hits on shared ip
How can I dump the TCP packets to get a better idea to know which website is being attacked?
Here is what I have in my logs:
May 4 23:10:26 host kernel: [2130002.635000] Firewall: *SYNFLOOD ...
0
votes
1
answer
84
views
Filter ip traffic based on certain packet bits
I want to capture ip traffic at a linux machine based on the following bpf filter:
ether[45]=0x11 and ether[68]=0x34
Incoming traffic is around 20Gbps and the filter discards 95% of the traffic. As ...
0
votes
1
answer
595
views
Filtering inbound traffic without knowing the destination subnet
I have a linux machine configured as a router with two interfaces facing LAN A and LAN B. I want to filter traffic passing from LAN A to LAN B (inbound traffic) using tcpdump, but I don't have the ...
0
votes
1
answer
740
views
Log http data in unique files using tcpick
I'm trying to use tcpick to log http data in unique files (client and server mixed together). This is one of the examples from tcpick's man page:
$ tcpick -i eth0 "port 80" -wRub
I expected this to ...
0
votes
1
answer
2k
views
Capturing network traffic (rtmp) between VMs or using loopback in the same VM using wireshark
I need to to capture RTMP traffic between two virtual machines (server and client) or atleast have the server and client on the same machine and capture the traffic. I am able to capture the traffic ...
-1
votes
1
answer
1k
views
Why is my chunked request removing the trailing CRLF?
I've just spent the past 10 hours trying to figure out why my http request was failing when I did a
request.Content.ReadAsMultipartAsync().Result.Contents
It kept returning the error:
Unexpected ...