Questions tagged [packet-sniffer]

Sniffer is another word for packet analyzer

Filter by
Sorted by
Tagged with
0 votes
0 answers
27 views

How to capture GOAWAY from a Linux VM (Centos)

Objective: I'm troubleshooting integration between two service fleets proxied by Envoy (AWS AppMesh) using GRPC. My GRPC clients never send traffic to the new GRPC servers (after scale-out). Context: ...
Alcaneo's user avatar
1 vote
0 answers
308 views

What is the key file for ssldump?

I search google for a tool to decode https traffic and get the ssldump with examples like: ssldump -k xxx.pem -i eth0 -d host example.com I wonder what the key file xxx.pem is. On the server hosting ...
peter's user avatar
  • 113
1 vote
0 answers
59 views

Ifconfig result on the server running PF_RING with zerocopy

I have an application which uses PF_Ring zero copy as a part of its packet sniffing capability. When this application is running would it be possible to find out the amount of RX/TX traffic using ...
user2714795's user avatar
0 votes
0 answers
272 views

Traffic capture at boot

I'm trying to figure out what packets a linux host sends at boot in order to debug it. Is there a way to start packet capture during boot time to not miss any packets? What is your way of going about ...
lolz's user avatar
  • 11
0 votes
0 answers
710 views

How to identify application that is generating ICMP echo requests on Windows 10?

My company security team has informed me that my workstation is pinging some "blacklisted" IP addresses. The enterprise security tool reporting this information sits in place of the usual ...
Gordon Mckeown's user avatar
0 votes
0 answers
43 views

Can't track applications network communication under same machine

I have a network application environment of 7 applications communicating with eachother through UDP and TCP. All of them using either the machine's local network IP or 127.0.0.1 (localhost) to listen ...
underthevoid's user avatar
3 votes
2 answers
14k views

How to decrypt TLS traffic with Wireshark using RSA asynchronous encryption?

I want to be able to capture and decrypt TLS traffic that one off my internal application (that I don't have access) makes to the internet. (For testing I am using Postman to create a request to a ...
mavi's user avatar
  • 151
0 votes
0 answers
404 views

Error during execution of Packet Sniffing command

Step1: I have shifted my mode to Monitor and also checked by executing the following command in terminal iwconfig I got the result as lo no wireless extensions. ethos no wireless extensions. ...
akhil's user avatar
  • 101
1 vote
1 answer
611 views

Can user credentials from HTTP session be seen through Wireshark? [duplicate]

Can we get that info the same way we do for FTP since HTTP is a plain text protocol?
Yoane Maior's user avatar
2 votes
1 answer
2k views

Analyzing traffic by tcpdump between HAProxy server and mariadb

I was testing tcpdump too see the traffic between HAProxy server and mariadb server. These are the results: 23:07:22.328958 00:0c:29:a9:28:a8 > 00:50:56:b0:e0:ea, ethertype IPv4 (0x0800), length ...
user3637971's user avatar
1 vote
0 answers
3k views

Can I capture full TCP packet content with haproxy without knowing length of the packet?

I know I can capture 6 bytes length packet using this config: global log /dev/log local0 debug log /dev/log local1 notice chroot /var/lib/haproxy stats socket /...
Defozo's user avatar
  • 153
1 vote
1 answer
562 views

Is a two-way communication possible over a mirror port?

I have a network like this: Server -- Router -- PCs I'd like to add a Raspberry to it so that it receives all packets sent from the Server to any PC, analyzes them, and sometimes it also sends some ...
tom's user avatar
  • 121
0 votes
1 answer
657 views

Can GCP do port mirroring at the subnet level?

Can I define a custom network in Google Cloud Platform in such a way so that I can get the equivalent behavior of Port Mirroring in my VPC as one would configure on a hardware switch? The goal is to ...
Jev Björsell's user avatar
0 votes
1 answer
743 views

Is it possible to sniff packets on KVM guest loopback interface from host?

I am trying to debug network communication which happens inside CentOS 7 KVM guest. This communication goes from localhost to localhost. I suppose, that all this traffic happens on local lo interface. ...
honza-kasik's user avatar
2 votes
2 answers
3k views

Monitor where an application is connecting to on MacOSX

I just downloaded wireshark for mac as I am trying to find out exactly where an app is connecting. I need to see the URL and the protocol whether it is https or http. I am very new to Wireshark and ...
JamesG's user avatar
  • 121
0 votes
0 answers
463 views

Taking tcpdump of data transmitting through tunnel

I have a service provider, who provides connection to his SMPP server only through a VPN. We setup a tunnel to connect to his VPN. Now there are some issues with the connectivity and I need to check ...
kadamb's user avatar
  • 111
0 votes
2 answers
84 views

Analyzing HTTP traffic [closed]

I am trying to solve the problem for a while and i couldn't find a proper answer online. I have a file with mobile traffic (from an Android device) and I am trying to check whether an http request is ...
kobibo's user avatar
  • 101
1 vote
0 answers
451 views

Netsh trace vs PEF trace cmdlets vs NetEvent cmdlets

I am playing with capturing my network traffic and came across two different MS commandline tools that allow doing this: a well-known netsh tool, recently equipped with powerful capture switch a ...
Suncatcher's user avatar
2 votes
2 answers
2k views

Process names in MS Message Analyzer

I am trying to set up the Message Analyzer viewer exactly like it is explained in this reference, but instead of steady process names I got some weird numbers, both in ProcessName and ProcessID ...
Suncatcher's user avatar
0 votes
1 answer
434 views

Packet Sniffer to dynamically create iptables rules

On a router running unix I wish to make monitor all outgoing packets, of these packets I want to temporarily white list IP addresses I am connecting to, to both send and receive. Basically to create ...
user avatar
0 votes
0 answers
200 views

In the output of Chaosreader, where are the source and destination port numbers and IP addresses for each packet?

I used this tutorial to use Chaosreader on an output file of WinDump. My purpose was to get the HTTP payload, which I got. But I'd also like to extract other information, like source IP and ...
Jesss's user avatar
  • 23
1 vote
1 answer
114 views

Protecting wired LAN from packet sniffers

How one encrypts traffic in wired LAN segment? Can IPv6 in combination with IPSec be configured for IKE/ISAKMP authentication? OR Will I drown in configuring appropriate IKE host-to-host rules for ...
P. D's user avatar
  • 11
1 vote
1 answer
728 views

Is there a quick way to determine what applications are present within a Wireshark capture? If so how

Is there a quick way to determine what applications are present within a Wireshark capture? If so how As most captures contain over 10 thousand lines, I can't expect people would by hand check which ...
Usage's user avatar
  • 11
-2 votes
2 answers
124 views

Why do different packet analyzers sometimes produce different results?

I ran wireshark and windump at the same time. Both packet analyzers use the same winpcap library. However after doing a row by row comparison of the results I noticed both every column between the 2 ...
DAT BOI's user avatar
0 votes
1 answer
868 views

PCAP filter for first few packets, and packets related to disconnection, TCP-only

I'd like to use tcpdump with a filter for some long-running debugging. Specifically, I only want to capture packets with the following conditions: First 10 packets or so of a new TCP connection (...
Brad's user avatar
  • 1,427
5 votes
1 answer
16k views

How to check if promiscuous mode is enabled on network interface in windows server 2012 R2

I'm working with basic windump commands. After I close the windump, my pc is slowly and cpu range is high. How to check if promiscuous mode is enabled on network interface in windows server 2012 R2.
A.Kemal's user avatar
  • 68
1 vote
0 answers
111 views

Microsoft Message Analyzer and Windows Advanced Firewall ipsec tunnel packet sniffing

I am trying to view connections or attempted connections in windows advanced firewall. I have tried using the Windows Firewall Service provider however the trace does not return anything. Any ideas?
Wize's user avatar
  • 91
1 vote
0 answers
139 views

Corrupted files when downloading with HTTP

With my UMTS connection most archives > 50 MB are corrupted when downloading them via HTTP. If I switch to HTTPS the problem is gone. The problem should not reside in my network, because I have an ...
Wotim's user avatar
  • 121
2 votes
1 answer
23k views

How i can dump raw packets from an existing tcp socket using tcpdump on Mac and Linux? [closed]

Once I know the IP address and port number combo, I can run this to see some of the packets: tcpdump | grep [IPADDRESS] Anybody know how I can now see the raw packets too? Thanks!
Tomachi's user avatar
  • 141
0 votes
0 answers
3k views

Port Mirroring on Wireless router

I will be going on site to help hotel manager to identify who is using P2P (torrents) in hotel and abusing network usage for other guests. Easy option would be 1. Port Mirroring on wireless router ...
Matas Vaitkevicius's user avatar
0 votes
1 answer
841 views

How to monitor if someone is using wireshark in my corporate network

I would like to know if it's possible to monitor if any users are using a network sniffer like Wireshark in my corporate network?.
Jonas's user avatar
  • 101
0 votes
1 answer
3k views

Analyzing twitter packets [closed]

Thanks for your time. I'd like to find a way if a client has made a 'GET' or a 'POST' request for twitter. We are currently doing an educational project and we wanted to understand how we can achieve ...
Dark Knight's user avatar
0 votes
3 answers
240 views

Is there some free remote sniffer (aka sniffer on free remote server)? [closed]

I have this setup: ________Company LAN_______ _________ . '| _________ | | .| BUNCH OF | ...
Pithikos's user avatar
  • 139
0 votes
1 answer
1k views

Port Mirroring to Mac Thunderbolt Ethernet [closed]

I have a switch with port mirroring enabled. So one port is the source port, and the other is the mirror port. In the source port, I have a wifi router plugged in. The mirror port is connected to ...
Steve's user avatar
  • 225
5 votes
3 answers
9k views

Tcpdump on ec2 not seeing all packets

I'm running tcpdump on an Amazon EC2 instance to monitor HTTP traffic going to Nginx (this is just a test box, the only resource is the example test page). Running tcpdump with the command # ...
Jordan's user avatar
  • 51
-4 votes
1 answer
1k views

how to sniff from a remote machine? [closed]

I have a PC and a tablet that connected to a TP-Link ADSL modem. PROBLEM: I want to see the packets that send and receive from my modem not my PC( to see both wire and wireless packets) I search ...
goodman's user avatar
  • 11
0 votes
2 answers
343 views

Firewall/Packet Sniffer - forward HTTP requests to a different address

I have a particularly "hacky" question/solution and looking for some honest feedback. In an enterprise system there are a number of requests that are destined for www.sometargeturl.com. These need ...
Duncan's user avatar
  • 325
0 votes
0 answers
150 views

View historical data per IP with PRTG packet sniffer

I have recently set up PRTG's packet sniffer sensor for bandwidth monitoring. I am able to pull up historical data in 15 minute increments and see who was the highest user but I would like to see ...
Jason's user avatar
  • 317
2 votes
1 answer
673 views

How easy is it to sniff the SMTP port of webserver to capture mails

I've got a very basic question that I don't know the answer for. Our company owns a webserver that runs multiple websites and works as a mail server for these websites as well (e.g. to send contact ...
Zeep's user avatar
  • 107
1 vote
5 answers
285 views

how to identify IP address on eth0 when console isn’t available

I need help about the following I have very old Linux server with one IP address, unfortunately I can’t to access to Linux machine VIA console and I not remember the IP address So I now thinking ...
yael's user avatar
  • 23
1 vote
0 answers
2k views

why do I lose ping to a machine when using port mirroring / monitoring (sniffing)?

I am using port mirroring / monitoring in my 3COM layer 3 switches to look at network traffic (using wireshark). Sometimes, I have found that I loose connectivity with the remote monitor machine (...
Scott Szretter's user avatar
2 votes
1 answer
3k views

Mirror network packets from WiFi to Ethernet in an ASUS Router RT N53

I have an ASUS RT N53 router, running the default firmware (Linux 2.6.22 with busybox and uclibc). I need to capture data packets from some Wi-Fi devices I have connected to that router (iPad and some ...
fazineroso's user avatar
0 votes
3 answers
4k views

How to sniff all HTTP packets on a wifi network? [closed]

I need to sniff all HTTP packets that pass through my wifi network (in particular HTTP requests by my smartphone). I've tried with wireshark, but I can sniff only packets to and from my pc. What am I ...
giozh's user avatar
  • 101
0 votes
1 answer
908 views

Meraki VPN Traffic Capture

We have multiple offices interconnected via VPN using Meraki switches. I've been looking around and can't seem to find a way, but was thinking it's possible. Is it possible for me to put my desktop on ...
Joseph's user avatar
  • 293
3 votes
3 answers
897 views

What are cables/boxes called for listening in on a RJ45 cable?

I would like to capture the traffic from a router, so I assume there must exist a cable or hardware box with 3 RJ45 socks, where two of them are IN and OUT, and the third is for capturing device (a ...
Sandra's user avatar
  • 10.5k
2 votes
3 answers
14k views

How can I log OpenVPN packet contents?

I'm designing a developer tool that would analyse and debug arbitrary network connections, but I want to provide it as a service rather than software to be installed locally. Ideally I would like to ...
Jim's user avatar
  • 88
2 votes
2 answers
395 views

What to use to get meaningful network statistics

A customer has a rack with some 1U servers and Dell™ PowerConnect™ 2716 switch at ISP's server room. One port is uplink to the ISP. Some servers run ESX5 while one 1U server is a plain Windows 2008 R2 ...
Henno's user avatar
  • 1,056
0 votes
1 answer
740 views

Log http data in unique files using tcpick

I'm trying to use tcpick to log http data in unique files (client and server mixed together). This is one of the examples from tcpick's man page: $ tcpick -i eth0 "port 80" -wRub I expected this to ...
otto.poellath's user avatar
4 votes
3 answers
3k views

Can our firewall detect traffic sniffing inside the network?

We use Cisco ASA's firewall and NAT functions in our network (200 computers). Is there any possibility to configure Cisco ASA to detect traffic sniffering (for example wireshark) and network ...
Arthur Elimhanov's user avatar
4 votes
2 answers
2k views

tcpdump file size == traffic size?

I created a tcpdump file: tcpdump -i eth0 host xxx.208.xxx.59 -n -s 0 -vvv -w /tmp/dump.dmp duration was about 3 hours. This file now has 450 MB. Can I say now that the IP xxx.208.xxx.59 generated ...
Danzzz's user avatar
  • 165