The tag has no wiki summary.

learn more… | top users | synonyms

1
vote
0answers
18 views

Can I use tshark to write SSL-decrypted packets to a file?

I have a PCAP file containing SSL-encrypted HTTP traffic and the private key from the relevant web server. I'd like a PCAP file that contains the decrypted HTTP traffic to feed into a different tool. ...
0
votes
0answers
22 views

How to write Snort rules for GET requests coming from pcap files with specific string pattern

I would appreciate if the community help me with the snort rules for HTTP get requests. For example, lets say you notice in the attack GET requests, they all have "...destroy=True&..." but NONE of ...
2
votes
1answer
138 views

How to assign multiple IPv6 addresses with DHCPv6 to a single interface?

This seems to be possible based on the spec rfc 3315 page 23: Excerpt: The configuration information in an IA consists of one or more IPv6 addresses along with the times T1 and T2 for the IA. See ...
2
votes
0answers
50 views

replay decrypted ssl traffic with tcpreplay

I have an pcap format from some https traffic from one of my web-servers. So I can use the key from my webserver to decrypt the traffic in wireshark. The problem I'm now facing is that I can't get an ...
1
vote
3answers
363 views

How to capture contents of the first packet of TCP connections using tcpdump

I'm tasked with monitoring and debugging a SOAP web service, on network level. I can use tcpdump to capture the whole traffic coming from customers on port 80, but I can't limit the capture for every ...
0
votes
0answers
73 views

How can I replay a TCP stream to my client

I need to do some validation testing of a new feed handler I have made. I have some pcap data that I captured from the production network and I would like to have my development feed handler connect ...
0
votes
2answers
65 views

How do I set Securityonion/snort to not capture certain packets?

After looking through my pcaps from Security onion I'd like to filter out a host (let's call it 192.168.4.4) and filter out some traffic (ports 80 & 443), current project is to look at other ...
0
votes
1answer
23 views

Is it possible to split PCAPS into multiple files bases on simple criteria

Is it possible to split PCAPS into multiple files bases on simple criteria Origional.pcap {split on port 80} which generates the 2 following files all_port_80.pcap everything_else.pcap Or would ...
3
votes
3answers
135 views

Recording network traffic on one linux box, transferring it to another in real time

I have a situation where I want to capture all of the network traffic on one Linux box (currently using tcpdump) but have that data transferred in real time to another Linux on a separate (but ...
0
votes
1answer
217 views

Freeradius server is not accepting accounting packets through tcpreplay

I am running a free radius server on system A. I am sending test accounting requests using radclient radclient -x systemA acct testing123 from system B. I can see that the radius server recieved these ...
3
votes
2answers
215 views

Reducing a pcap file down to all operations on a specific NFS file

I have an 80GB packet capture (libpcap) and I want to filter it down to everything involving all operations on a particular NFS file/filehandle. How can I accomplish this? I know the following facts ...
2
votes
1answer
322 views

How can I reconstruct session from pcap file?

I am trying to extract session level (flow level) information from my pcap trace file. I want to generate the following data for each line of session (flow): Flow_num, IP_Src, IP_Dst, ...
0
votes
1answer
131 views

tshark/pcap and web-server response time

How can I get response time difference between GET and HTTP/1.0 200 OK (i mean time latency of web-server) with using of tshark&shell or something else for each hostname from pcap file? What can ...
2
votes
1answer
253 views

How to make tshark to output valid pcap file used for other max GUI pcap viewer

sudo tshark -i en0 -x -w icmp_sample.pcap This command output a pcap file, but the it doesn't seem to be valid, Because CocoaPacket Analyzer can't open it Any idea?
3
votes
2answers
490 views

How to separate PCAP by unique IP address

I have an hour long PCAP file which has about 60 individual network attacks done on our test network here at work. Each attack comes from a unique IP address which was not used elsewhere during the ...
2
votes
2answers
741 views

Getting interface MTU under Linux with PCAP

I am interested in storing packets I sniff using PCAP. As I preallocate the memory I need - i.e. a multiple of the MTU of the interface I am sniffing from, I would like to discover how much memory I ...
4
votes
1answer
508 views

Bandwith usage from pcap files

I've got a huge pcap file (many GBs) that I just can't load in wireshark. What I need is extracting bandwidth usage information, both total and per-protocol (in both incoming and outgoing direction), ...
0
votes
1answer
328 views

Tcp retransmission tcp session reconstruction

Im trying to write a program that reconstructs tcp sessions. I have a pcap file which have packets. The problem is i dont know which packets i should use to construct sessions when there is a ...
1
vote
1answer
95 views

How to leave promiscuous mode in dnscap?

How to leave promiscuous mode in dnscap? dnscap -a makes no difference.
5
votes
3answers
3k views

Extracting SSL certificates from the network or pcap files

I will appreciate if someone can point me to a tool or approach to extract SSL/TLS certificates from live HTTPS connections (directly from the network) or from a network trace file (pcap file). I ...
1
vote
1answer
864 views

HTTP dissector that reads from pcap

I have some pcap data from a local interface which I'd like to analyze. Specifically, I'd like the content of HTTP sessions. I'm aware of many HTTP header statistics tools, but I would specifically ...
4
votes
2answers
6k views

Best way to analyze pcap files from Wireshark?

I've got 50-100MB pcap files captured from Wireshark and need to analyze where most of the traffic is going to/coming from. What's the best way of doing this? Ideally I'd like to end up with an ...
5
votes
3answers
4k views

tool for splitting pcap files by TCP connection?

Is there tool to split a packet capture file (in pcap format) into separate files for each TCP connection ? (other than a home grown shell script which probably needs to run twice over the ...
5
votes
1answer
1k views

tcpdump filter for tcp zero window messages

Is there a pcap filter for TCPDump that will allow be to filter zero window messages? I know how to filter these in a wireshark display filter (tcp.analysis.zero_window) but the amount of data I ...
7
votes
2answers
2k views

snort analysis of wireshark capture

I'm trying to identify trouble users on our network. ntop identifies high traffic and high connection users, but malware doesn't always need high bandwidth to really mess things up. So I am trying ...
1
vote
2answers
1k views

CLI tool for analyzing pcap captures

I am looking for a command line tool that will look at a capture file, tcpdump -w output, and give output equivalent to the information you get in the Wireshark conversations, and endpoint statistics. ...
2
votes
1answer
1k views

Other PCAP network software other than TCPREPLAY?

I would like to find out if there are more other useful softwares with the same functions or more like TCPREPLAY which has the ability to "playback" PCAP files? Thanks for your suggestions!
1
vote
1answer
115 views

email server delivers one message, but not another. no errors

i have sent two messages, one from the local server, one from the production environment. the message from the local server goes through, but the production message does not. both messages are ...
0
votes
1answer
1k views

Inconsistencies with Linux tc filter u32 matching on packet data payload - can someone explain?

I would just like some heads up on this as I really don't understand -why- this is the case. Further down is the TCPDUMP output (tcpdump -s0 -XXnni eth0 tcp port 80) of the 'HTTP' response a ...
3
votes
1answer
1k views

Kill FINished sockets (using libpcap - tcpdump/tcpkill)

I'm trying to create a small service that monitors and kills sockets which have the FIN flag. I can get them with tcpdump (I also tried tcp[13] & 1): tcpdump "tcp[tcpflags] & tcp-fin != 0" ...
0
votes
2answers
246 views

Identifying VoIP Users

I'm looking for a way to identify as many consumer VoIP users on my ISP network as possible using packet analysis. My setup is like this: On my core switch, all traffic going in and out of gigabit1 ...
1
vote
1answer
333 views

Using L7 to classify pcap data

I've recently become familiar with the Layer 7 Filter project, and it's ability to classify protocols is quite interesting. All of the information about its use, however, concerns using the filters ...
15
votes
3answers
20k views

how to split a pcap file into a set of smaller ones

I have a huge pcap file (generated by tcpdump). When I try to open it in wireshark, the program just gets unresponsive. Is there a way to split a file in set of smaller ones to open them one by one? ...
0
votes
2answers
576 views

pcap stream rotation and pruning

Some of my servers collect a lot of packet data. Is there a utility (or patch to tcpdump(1)) to log a pcap stream to disk which: Rotates based on size of data written Prunes written files, keeping ...
2
votes
3answers
1k views

Good (free / open source) tools for analyzing TCP capture files?

I use wireshark and microsoft network monitor extensively, but I'm curious if there are other good (hopefully free / open source) software packages for analyzing TCP/IP traffic? I'm especially ...
2
votes
2answers
1k views

wireshark captures different on two computers from the same port

I Have a Windows XP Machine Running wireshark, connected to a Mirror port on a network. I'm capturing with no filtering, and it can only see half of some two way TCP conversations. I had thought it ...
34
votes
8answers
123k views

How can I read pcap files in a friendly format?

a simple cat on the pcap file looks terrible: $cat tcp_dump.pcap ?ò????YVJ? JJ ?@@.?E<??@@ ?CA??qe?U????иh? .Ceh?YVJ?? JJ ?@@.?E<??@@ ...