Packet capture is the act of capturing data packets crossing a computer network. Packet capture can be: Deep packet capture (headers & payload), or partial packet capture (headers only).

learn more… | top users | synonyms

0
votes
2answers
855 views

user agent in http or https request

Is there any way that I can differentiate, the HTTP or HTTPS packets are coming from browser or not ? specially for https request.There is User-Agent field in packet in Http,but I could not found ...
0
votes
2answers
492 views

monitor network packet rate per IP

my problem is that I've got a report that my IP was used in a DOS attack. Problem is that I do not know which computer is infected and the attack is not active anymore. Is there simple Linux tool for ...
2
votes
1answer
890 views

Tcpdump on ec2 not seeing all packets

I'm running tcpdump on an Amazon EC2 instance to monitor HTTP traffic going to Nginx (this is just a test box, the only resource is the example test page). Running tcpdump with the command # ...
1
vote
1answer
443 views

“tshark: There are no interfaces on which a capture can be done” in Amazon Linux AMI

My goal is to capture packets with tshark in Amazon Linux AMI. While typing tshark in the command line there's an error: "tshark: There are no interfaces on which a capture can be done" How to ...
1
vote
1answer
234 views

Capturing packets via l7filter

As a part of my Ph. D study, I compile linux-2.6.28 kernel to support in-kernel l7filtering capabilities. I'm adding a single rule to iptables with the following: iptables -t mangle -A PREROUTING -m ...
1
vote
1answer
350 views

What is the best way/tool to analyze raw data(network stats) from Simulation?

After running a simulation(using a simulator(QualNet)) of a simulated network I end up with ip stats stored in a database, I then extract the data to a csv file So now I have 750mb of raw network ...
0
votes
1answer
362 views

server is not responding on SYN packets

On the attached tcp dump, the first two SYN packets (#21800 and 21801) came to the server, however SYN ACK was sent for the second SYN. Is that correct behaviour? My understanding is that the client ...
0
votes
1answer
284 views

Wireshark seems to ignore my filters

I'm trying to make use of Wireshark 1.10.6 for Windows and I want to only capture the traffic to port 443 (to diagnose some weird HTTPS problems I'm having). So I open Capture -> Capture Filters... ...
0
votes
1answer
211 views

Network card capable of capturing a tonne of packets and not dropping them?

Edit: Our server is trying to capture packets at between 500-600Mb/s, but is dropping packets 'due to kernel'. Data is being written to SSDs, and isn't bottleneck there. What things should I look ...
0
votes
1answer
598 views

syn flood attack — packet hits on shared ip

How can I dump the TCP packets to get a better idea to know which website is being attacked? Here is what I have in my logs: May 4 23:10:26 host kernel: [2130002.635000] Firewall: *SYNFLOOD ...
0
votes
1answer
64 views

Filter ip traffic based on certain packet bits

I want to capture ip traffic at a linux machine based on the following bpf filter: ether[45]=0x11 and ether[68]=0x34 Incoming traffic is around 20Gbps and the filter discards 95% of the traffic. As ...
0
votes
1answer
243 views

Filtering inbound traffic without knowing the destination subnet

I have a linux machine configured as a router with two interfaces facing LAN A and LAN B. I want to filter traffic passing from LAN A to LAN B (inbound traffic) using tcpdump, but I don't have the ...
0
votes
1answer
401 views

Log http data in unique files using tcpick

I'm trying to use tcpick to log http data in unique files (client and server mixed together). This is one of the examples from tcpick's man page: $ tcpick -i eth0 "port 80" -wRub I expected this to ...
0
votes
1answer
820 views

Capturing network traffic (rtmp) between VMs or using loopback in the same VM using wireshark

I need to to capture RTMP traffic between two virtual machines (server and client) or atleast have the server and client on the same machine and capture the traffic. I am able to capture the traffic ...
-1
votes
1answer
405 views

Why is my chunked request removing the trailing CRLF?

I've just spent the past 10 hours trying to figure out why my http request was failing when I did a request.Content.ReadAsMultipartAsync().Result.Contents It kept returning the error: Unexpected ...
2
votes
0answers
158 views

Suggestions on how to capture network connections/traffic for determining browser/SSL versions?

Note that I posted this Q to the StackExchange InfoSec site, but its not as populated as ServerFault and this is more on the technical side of network collection for web services. I've started ...
1
vote
0answers
99 views

Redirect Default Gateway Traffic in Linux to File

I am trying to troubleshoot one of my linux servers (ubuntu server). Therefore I want to intercept all traffic that is sent to the default gateway and then write it to a file: preferably some kind of ...
1
vote
0answers
209 views

Is there a tool to do packet mirroring in CentOS 5.9?

I know iptables + xtables can do it in more recent versions using the TEE target supplied by the xtables-addon package for iptables. However, the kernel in CentOS 5.9 is 2.6.18 and this version is not ...
1
vote
0answers
165 views

Is Snort able to efficiently demux and log large HTTP POST requests?

I'm trying to debug some failed HTTP POST requests containing large file uploads (~500 MB). The end-user is receiving strange HTTP responses that are not being logged in either varnish's varnishncsa ...
1
vote
0answers
148 views

How to add TDS support to tshark?

How to add TDS (knowledge about MS SQL Server packets' structure) support for tshark? Currently, the situation is this: root@DEV:/# tshark -d . 2>&1| grep -i tds root@DEV:/# I.e: tshark does not ...
0
votes
0answers
11 views

Trim and filter functions in NFLOG

I have a tricky task to fulfill: I need to reduce the memory-size of my log on the disk space. Due to customer demand, I have work in a Linux environment with NFLOG. Another security restriction I ...
0
votes
0answers
20 views

Which wireshark output format aligns closest with actual SMTP data?

I have a packet capture of a SMTP session (containing an email with international characters). I'd like to extract the message data from that and try reproducing an issue. When I follow the TCP ...
0
votes
0answers
11 views

What filter in Wireshark, can return the ACKs packets employed to complete TCP three-way handshakes instigated by a particular party?

What filter in Wireshark, can return the ACKs packets employed to complete TCP three-way handshakes instigated by a particular party? For instance if machine A requests for a TCP connection to be ...
0
votes
0answers
20 views

ICMP Packet Flood a local device over Wireless AP to figure out packet loss?

I'm using a utility to create an ICMP packet flood/attack called Hyanea since windows doesn't have native support like linux does. I want to be able to test a new AP to see if any packet loss occurs....
0
votes
0answers
60 views

Colasoft Packet Player with Loopback-Adapter - Cannot recieve UDP-Packages

I have some problems with Colasoft Packet Player. I am trying to send the UDP-Packages over a Loopback-Adapter (Windows 7, I want to send and receive them over the same computer) and to read them with ...
0
votes
0answers
97 views

Capture all mysql requests/responses and caculate the response time using tcpdump

I need to capture all mysql requests/responses using tcpdump and after that need to find out which response related to which request in order to caculate the response time of each request. I used the ...
0
votes
0answers
98 views

Filter packets with layer 7 (raw) data with iptables

Let's suppose I've got the following iptables rule: iptables -A INPUT -p tcp -s $IP --sport $PORT -j DROP filtering (and dropping, in this case) packets coming from $IP:$PORT. This filter drop ...
0
votes
0answers
95 views

Early tear down of communication

I have an application which performs an LDAP search which works in one domain but not in the other, when analyzing the packets sent between the application server and the domain controller being ...