Packet capture is the act of capturing data packets crossing a computer network. Packet capture can be: Deep packet capture (headers & payload), or partial packet capture (headers only).

learn more… | top users | synonyms

7
votes
1answer
355 views

Why is the “don't fragment” flag set in https and ssh protocols?

I've found a lot of information specifying that this is the case, however, I am really looking for the reason behind this. Why is it necessary? Is it necessary?
6
votes
4answers
4k views

Monitor number of bytes transferred to/from IP address on port

Can anyone recommend a linux command line tool to monitor the number of bytes transferred between the local server and a specified IP address/port. The equivalent tcpdump command would be: tcpdump ...
5
votes
2answers
5k views

Can 3G networks be packet sniffed / analyzed?

Just wondering if 3G networks can be sniffed like public wifi networks, via wireshark for example (I'm almost sure this is not possible due to encryption, but I just want to make sure?)
5
votes
4answers
3k views

Copying packets from an interface to another

I have a Linux system (let it be A) with 2 ethernet cards, namely eth0 and eth1 which are attached to two totally unrelated LANs. Basically eth0 is used for normal application traffic and eth1 is ...
5
votes
2answers
8k views

How can I search the info column in WireShark?

WireShark | Windows I want to search a packet capture of SMTP traffic for specific addresses/messages. Normally, I just sort the info column and browse but it would be nice if I could just run a ...
5
votes
1answer
3k views

tcpdump: capture one of several vlans

I want tcpdump to capture VLAN 1000 or VLAN 501. man pcap-filter says: The vlan [vlan_id] expression may be used more than once, to filter on VLAN hierarchies. Each use of that expression ...
5
votes
0answers
134 views

Why does our Windows 7 Desktop keep continually making SMB requests to our SBS2003 server? [duplicate]

Possible Duplicate: How do I deal with a compromised server? One of our desktop machines (Win 7 64 bit) has recently been complaining of slow down, particularly when accessing resources on ...
4
votes
5answers
2k views

Using a router to intercept HTTP data. Sniffing?

This is my first serverfault post. I've been a member of Stack Overflow for a while and doubt that this question would fly over there. I have my PS3 and XBOX 360 hard wired to a Linksys Wireless N ...
4
votes
1answer
139 views

Script to find the address udp packets are being sent to?

Here is the scenario. I have an IP address 1.2.3.4 port 2000 sending udp packets to one unknown IP. I would like to find the unknown IP so I can block it with iptables. Is there a way to do it with ...
4
votes
3answers
237 views

Windows Server 2008/2003 - determine all “used” local network ports

I have been tasked with enabling the local firewall on 100+ servers. The systems are running many different applications using many different ports. I began with an nmap scan, but without going to ...
3
votes
4answers
5k views

Wireshark filter to only capture Incoming Packets?

I am trying to setup a Filter (so my log files aren't massive) that will capture only incoming traffic. I have looked on http://wiki.wireshark.org/CaptureFilters but so far have been unable to find a ...
3
votes
2answers
203 views

What are cables/boxes called for listening in on a RJ45 cable?

I would like to capture the traffic from a router, so I assume there must exist a cable or hardware box with 3 RJ45 socks, where two of them are IN and OUT, and the third is for capturing device (a ...
3
votes
1answer
211 views

How Wireshark could read data from other ips

When I open wireshark I could see the packets send by machines other than mine. How could its possible? Example 8252 99.150192 somoeneip 239.255.255.250 SSDP NOTIFY * HTTP/1.1 8253 ...
3
votes
1answer
466 views

SSL Packet inspection on Linux

I'm trying to build a web client for an HTTPS website. I think I've done everything right, yet obviously I get a different result in the browser than with my crawler. As far as I understand, there is ...
3
votes
2answers
10k views

With wireshark how can I filter by packet size?

I can filter for packet lengths using a display filter containing data.len >= XXX, but I'd really like to use a capture filter for this for efficiency... is there a way to do it?
3
votes
2answers
490 views

How to separate PCAP by unique IP address

I have an hour long PCAP file which has about 60 individual network attacks done on our test network here at work. Each attack comes from a unique IP address which was not used elsewhere during the ...
3
votes
1answer
283 views

What are capture interfaces in Wireshark?

I am really new to Wireshark, and I am little confused about the term capture interface. I see a list of about 9 to 10 so-called interfaces. What are they? I mean, I have only one Ethernet interface ...
3
votes
1answer
24 views

Linux NFLOG - documentation, configuration from C

Several different places (e.g. http://wiki.wireshark.org/CaptureSetup/NFLOG) recommend using Linux's "NFLOG" firewall module to capture packets generated by a particular UID, like this: # iptables -A ...
3
votes
1answer
2k views

WireShark - Capturing Packets on Multiple IP Address (FIlter)

I'm looking for the syntax to do a capture filter on WireShark, by capturing the traffic on several (specific) IP addresses. I understand how to capture a range, and an individual IP address. However, ...
3
votes
2answers
2k views

unexplainable packet drops with 5 ethernet NICs and low traffic on Ubuntu

I'm stuck on problem where my machine started to drops packets with no sign of ANY system load or high interrupt usage after an upgrade to Ubuntu 12.04. My server is a network monitoring sensor, ...
2
votes
6answers
1k views

Flow of packets in network

I can't visualize in my mind the network traffic flow. eg. If there are 15 pc's in a LAN When packet goes from router to local LAN, do it passes all the computers? Does it go to the ethernet card ...
2
votes
3answers
4k views

Wireshark won't pick up packets sent from localhost to localhost via network [duplicate]

I'm running on Windows and trying to get Wireshark to pick up my network traffic. It picks up all outbound and inbound traffic fine, except for a client/server I'm running on my local system. As it ...
2
votes
7answers
2k views

Anyone know a good self contained packet sniffer?

In the course of my sysadmin/network administration duties, I need to packet sniff for connectivity issues. Unfortunately, this often occurs on machines I don't 'own'. Servers under the purview of ...
2
votes
2answers
2k views

pfSense: Possible to traffic capture the actual WAN port?

The pfSense router seems to have having problems connecting to the internet. My modem, and my ISP, confirm that i have sync, but at the same time pfSense sometimes just will not connect (using PPPoE). ...
2
votes
2answers
83 views

Linux Full Packet Capture

I’m looking to stand up a full packet capture solution on an Ubuntu server. Our maximum bandwidth is < 60Mb/s and the server has 10K hard drives. Ideally, I’d like to be able to log everything ...
2
votes
2answers
1k views

using wireshark/tshark in command line to ignore ssh connections

I'm trying to debug some by looking at the packets and I would like to avoid getting all the SSH traffic to the server. Is there a way to ignore? I tried to do something like tshark -f "port !22" but ...
2
votes
6answers
244 views

Wireshark Capture Between Two Routers

How would one go about capturing OSPF traffic in Wireshark between two routers? I'm looking to do something like this: [RTR A] - - - [LAPTOP] - - - [RTR B]
2
votes
1answer
598 views

Why do some machines respond with many RST packets instead of RST-ACK to refuse a connection?

I have recently been trying to track down a problem with one of our systems and have noticed that it is simply not allowed to connect to a remote machine. However, the remote machine (not controlled ...
2
votes
3answers
2k views

VPN packet capture on ASA5505

Following up from a previous question regarding how to capture packets on the ASA5505 I'm having some difficulty in distinguishing which traffic has come through the VPN and which was generated from ...
2
votes
1answer
129 views

Strange Ethernet II packets in wireshark

Looking at a wireshark capture, I'm seeing something really strange. Ethernet II packets with random data are being sent on the network. The larger packets in the capture seem to contain bits and ...
2
votes
0answers
45 views

Suggestions on how to capture network connections/traffic for determining browser/SSL versions?

Note that I posted this Q to the StackExchange InfoSec site, but its not as populated as ServerFault and this is more on the technical side of network collection for web services. I've started ...
1
vote
1answer
192 views

Capture network traffic simultaneously on three interfaces

I need to capture traffic on a CentOS 5 server which acts as a web proxy with 2 wan interfaces and 1 LAN. In order to troubleshoot a weird proxy problem, I would like to have a capture of a full ...
1
vote
4answers
2k views

Sniffing packets of specific binaries / apps / process id?

Is there a way to associate packets with executing binaries? I would be open to traditional sniffing methods or even dtrace for that matter. I have a specific issue on a system with very high ...
1
vote
6answers
3k views

How to record SIP traffic / calls for future auditing?

We have a VOIP (SIP?) phone system and have to record all calls for specific phones in the company. It may be required at a future date to listen to these calls for auditing. These phones happen to ...
1
vote
2answers
103 views

Hardware for Capturing Packets

One of my clients is a small school district in Texas. Like any school, they often have problems with network'd peripherals such as printers, et al. It would be nice to be able to simply "listen" to ...
1
vote
2answers
1k views

CLI tool for analyzing pcap captures

I am looking for a command line tool that will look at a capture file, tcpdump -w output, and give output equivalent to the information you get in the Wireshark conversations, and endpoint statistics. ...
1
vote
2answers
357 views

Method to drop 50% packets of the total

On my machine I want that only 50% packets will receive. I am working on centOS 5.5. For that I searched on net. I got IPtables. I used random patch of IPtables. Command sudo iptables -A INPUT -p ...
1
vote
4answers
920 views

How to block packets after capturing?

I use tcpdump to capture output packets for one server, but I also need to block these packets. If I use iptables to block them, then I also can not capture anything. Can I block packets with ...
1
vote
1answer
1k views

tshark (wireshark) to pinpoint connect reset / retransmitted issue

Windows server 2003. I have the latest WireShark installed on the server and need to capture packets on the server to pinpoint a randomly happened connection reset /retransmitted issue. When the ...
1
vote
2answers
1k views

interrupt coalescing for high bandwidth packet capture?

I have an application which does packet capture from an ethernet card. Once in a while we see packets dropped (we suspect due to the buffer in the network card or kernel being overrun). I am trying ...
1
vote
3answers
1k views

Ntop monitoring - Hosts visible with no SPAN/mirroring

I am attempting to use ntop to monitor traffic over a Cisco Catalyst switch. I was assuming that in order to see any of the traffic, I'd have to use monitor, as described here: ...
1
vote
1answer
1k views

Configuring Wireshark for Rolling Captures during DDoS Attack

We have been getting hit with DDoS Attacks on various machines for months. The datacenter either null routes or sets up an ACL for us. However, it just came to my attention there's a tool floating ...
1
vote
1answer
331 views

What's a good proxy/tool to dynamically change the content of packets(TCP/UDP)

I am not sure if such tool exists, but I want to dynamically modify certain packets sent using my wireless network. More specifically, I want to modify packets sent from multiple machines (including ...
1
vote
0answers
50 views

Simple tcp capture tool - output results like chat session? [closed]

I seek a tool which will capture TCP traffic with the resulting output looking almost like an iPhone SMS conversation. Something like: timestamps client stuff is left justified / green server stuff ...
1
vote
2answers
105 views

Can I capture ISP SNMP information with Wireshark?

I am trying to do some heavy digging into SNMP, BPI+, ISP networks. Since wireshark can be used to capture network data, would I be able to use it to remotely capture my ISP SNMP agent information and ...
1
vote
0answers
230 views

USB packet sniffing on Mac OS? [closed]

I want to sniff USB packets being sent from my Mac to a device. For various reasons I cannot use Linux or Windows, and I'm stuck with Mac OS. Can anyone recommend a packet sniffing method? I've tried ...
1
vote
1answer
80 views

“tshark: There are no interfaces on which a capture can be done” in Amazon Linux AMI

My goal is to capture packets with tshark in Amazon Linux AMI. While typing tshark in the command line there's an error: "tshark: There are no interfaces on which a capture can be done" How to ...
1
vote
1answer
84 views

tcpdump on a capture card

I have a server with a NT20E Capture Card (2x10Gb Packet Capture Card over PCI Express). I want to be able to dump the output to a pcap format but because this isn't listed as an ethX-interface ...
1
vote
1answer
142 views

Capturing packets via l7filter

As a part of my Ph. D study, I compile linux-2.6.28 kernel to support in-kernel l7filtering capabilities. I'm adding a single rule to iptables with the following: iptables -t mangle -A PREROUTING -m ...
1
vote
0answers
165 views

Is there a tool to do packet mirroring in CentOS 5.9?

I know iptables + xtables can do it in more recent versions using the TEE target supplied by the xtables-addon package for iptables. However, the kernel in CentOS 5.9 is 2.6.18 and this version is not ...