The tag has no wiki summary.

learn more… | top users | synonyms

1
vote
3answers
220 views

How to capture contents of the first packet of TCP connections using tcpdump

I'm tasked with monitoring and debugging a SOAP web service, on network level. I can use tcpdump to capture the whole traffic coming from customers on port 80, but I can't limit the capture for every ...
0
votes
0answers
29 views

How can I replay a TCP stream to my client

I need to do some validation testing of a new feed handler I have made. I have some pcap data that I captured from the production network and I would like to have my development feed handler connect ...
0
votes
2answers
39 views

How do I set Securityonion/snort to not capture certain packets?

After looking through my pcaps from Security onion I'd like to filter out a host (let's call it 192.168.4.4) and filter out some traffic (ports 80 & 443), current project is to look at other ...
0
votes
1answer
22 views

Is it possible to split PCAPS into multiple files bases on simple criteria

Is it possible to split PCAPS into multiple files bases on simple criteria Origional.pcap {split on port 80} which generates the 2 following files all_port_80.pcap everything_else.pcap Or would ...
3
votes
3answers
118 views

Recording network traffic on one linux box, transferring it to another in real time

I have a situation where I want to capture all of the network traffic on one Linux box (currently using tcpdump) but have that data transferred in real time to another Linux on a separate (but ...
0
votes
1answer
141 views

Freeradius server is not accepting accounting packets through tcpreplay

I am running a free radius server on system A. I am sending test accounting requests using radclient radclient -x systemA acct testing123 from system B. I can see that the radius server recieved these ...
0
votes
0answers
66 views

Locating OSPF LSA Flooding In Wireshark

How can I identify the OSPF LSA flooding traffic which occurs every 30 minutes from a Wireshark capture? I'm finding it difficult to locate where the start and stop of this flooding process occurs in ...
3
votes
2answers
190 views

Reducing a pcap file down to all operations on a specific NFS file

I have an 80GB packet capture (libpcap) and I want to filter it down to everything involving all operations on a particular NFS file/filehandle. How can I accomplish this? I know the following facts ...
2
votes
1answer
262 views

How can I reconstruct session from pcap file?

I am trying to extract session level (flow level) information from my pcap trace file. I want to generate the following data for each line of session (flow): Flow_num, IP_Src, IP_Dst, ...
0
votes
1answer
117 views

tshark/pcap and web-server response time

How can I get response time difference between GET and HTTP/1.0 200 OK (i mean time latency of web-server) with using of tshark&shell or something else for each hostname from pcap file? What can ...
2
votes
1answer
133 views

How to make tshark to output valid pcap file used for other max GUI pcap viewer

sudo tshark -i en0 -x -w icmp_sample.pcap This command output a pcap file, but the it doesn't seem to be valid, Because CocoaPacket Analyzer can't open it Any idea?
3
votes
2answers
445 views

How to separate PCAP by unique IP address

I have an hour long PCAP file which has about 60 individual network attacks done on our test network here at work. Each attack comes from a unique IP address which was not used elsewhere during the ...
2
votes
2answers
616 views

Getting interface MTU under Linux with PCAP

I am interested in storing packets I sniff using PCAP. As I preallocate the memory I need - i.e. a multiple of the MTU of the interface I am sniffing from, I would like to discover how much memory I ...
4
votes
1answer
462 views

Bandwith usage from pcap files

I've got a huge pcap file (many GBs) that I just can't load in wireshark. What I need is extracting bandwidth usage information, both total and per-protocol (in both incoming and outgoing direction), ...
0
votes
1answer
311 views

Tcp retransmission tcp session reconstruction

Im trying to write a program that reconstructs tcp sessions. I have a pcap file which have packets. The problem is i dont know which packets i should use to construct sessions when there is a ...
1
vote
1answer
91 views

How to leave promiscuous mode in dnscap?

How to leave promiscuous mode in dnscap? dnscap -a makes no difference.
4
votes
3answers
2k views

Extracting SSL certificates from the network or pcap files

I will appreciate if someone can point me to a tool or approach to extract SSL/TLS certificates from live HTTPS connections (directly from the network) or from a network trace file (pcap file). I ...
1
vote
1answer
809 views

HTTP dissector that reads from pcap

I have some pcap data from a local interface which I'd like to analyze. Specifically, I'd like the content of HTTP sessions. I'm aware of many HTTP header statistics tools, but I would specifically ...
4
votes
2answers
6k views

Best way to analyze pcap files from Wireshark?

I've got 50-100MB pcap files captured from Wireshark and need to analyze where most of the traffic is going to/coming from. What's the best way of doing this? Ideally I'd like to end up with an ...
5
votes
3answers
4k views

tool for splitting pcap files by TCP connection?

Is there tool to split a packet capture file (in pcap format) into separate files for each TCP connection ? (other than a home grown shell script which probably needs to run twice over the ...
4
votes
1answer
1k views

tcpdump filter for tcp zero window messages

Is there a pcap filter for TCPDump that will allow be to filter zero window messages? I know how to filter these in a wireshark display filter (tcp.analysis.zero_window) but the amount of data I ...
7
votes
2answers
1k views

snort analysis of wireshark capture

I'm trying to identify trouble users on our network. ntop identifies high traffic and high connection users, but malware doesn't always need high bandwidth to really mess things up. So I am trying ...
1
vote
2answers
1k views

CLI tool for analyzing pcap captures

I am looking for a command line tool that will look at a capture file, tcpdump -w output, and give output equivalent to the information you get in the Wireshark conversations, and endpoint statistics. ...
1
vote
1answer
1k views

Other PCAP network software other than TCPREPLAY?

I would like to find out if there are more other useful softwares with the same functions or more like TCPREPLAY which has the ability to "playback" PCAP files? Thanks for your suggestions!
1
vote
1answer
111 views

email server delivers one message, but not another. no errors

i have sent two messages, one from the local server, one from the production environment. the message from the local server goes through, but the production message does not. both messages are ...
0
votes
1answer
1k views

Inconsistencies with Linux tc filter u32 matching on packet data payload - can someone explain?

I would just like some heads up on this as I really don't understand -why- this is the case. Further down is the TCPDUMP output (tcpdump -s0 -XXnni eth0 tcp port 80) of the 'HTTP' response a ...
3
votes
1answer
1k views

Kill FINished sockets (using libpcap - tcpdump/tcpkill)

I'm trying to create a small service that monitors and kills sockets which have the FIN flag. I can get them with tcpdump (I also tried tcp[13] & 1): tcpdump "tcp[tcpflags] & tcp-fin != 0" ...
0
votes
2answers
244 views

Identifying VoIP Users

I'm looking for a way to identify as many consumer VoIP users on my ISP network as possible using packet analysis. My setup is like this: On my core switch, all traffic going in and out of gigabit1 ...
1
vote
1answer
313 views

Using L7 to classify pcap data

I've recently become familiar with the Layer 7 Filter project, and it's ability to classify protocols is quite interesting. All of the information about its use, however, concerns using the filters ...
13
votes
3answers
18k views

how to split a pcap file into a set of smaller ones

I have a huge pcap file (generated by tcpdump). When I try to open it in wireshark, the program just gets unresponsive. Is there a way to split a file in set of smaller ones to open them one by one? ...
0
votes
2answers
546 views

pcap stream rotation and pruning

Some of my servers collect a lot of packet data. Is there a utility (or patch to tcpdump(1)) to log a pcap stream to disk which: Rotates based on size of data written Prunes written files, keeping ...
2
votes
3answers
1k views

Good (free / open source) tools for analyzing TCP capture files?

I use wireshark and microsoft network monitor extensively, but I'm curious if there are other good (hopefully free / open source) software packages for analyzing TCP/IP traffic? I'm especially ...
2
votes
2answers
1k views

wireshark captures different on two computers from the same port

I Have a Windows XP Machine Running wireshark, connected to a Mirror port on a network. I'm capturing with no filtering, and it can only see half of some two way TCP conversations. I had thought it ...
31
votes
8answers
113k views

How can I read pcap files in a friendly format?

a simple cat on the pcap file looks terrible: $cat tcp_dump.pcap ?ò????YVJ? JJ ?@@.?E<??@@ ?CA??qe?U????иh? .Ceh?YVJ?? JJ ?@@.?E<??@@ ...