Questions tagged [pcap]
PCAP stands for Packet CAPture.
82
questions
176
votes
7
answers
753k
views
How can I read pcap files in a friendly format?
a simple cat on the pcap file looks terrible:
$cat tcp_dump.pcap
?ò????YVJ?
JJ
?@@.?E<??@@
?CA??qe?U????иh?
.Ceh?YVJ??
JJ
?@@.?E<??@@
CA??qe?U????еz?...
- 4,253
59
votes
6
answers
129k
views
how to split a pcap file into a set of smaller ones
I have a huge pcap file (generated by tcpdump). When I try to open it in wireshark, the program just gets unresponsive. Is there a way to split a file in set of smaller ones to open them one by one?
...
- 1,398
19
votes
6
answers
23k
views
tool for splitting pcap files by TCP connection? [closed]
Is there tool to split a packet capture file (in pcap format) into separate files for each TCP connection ? (other than a home grown shell script which probably needs to run twice over the capture...)...
- 529
11
votes
2
answers
16k
views
Packet captures: filtering on RX vs TX
I have a network problem where frames with a source MAC which matches with one of my host's source MACs are arriving at the host - an apparent duplicate MAC, or loop, or other L2 problem.
I believe ...
- 1,398
7
votes
1
answer
12k
views
tcpdump filter for tcp zero window messages
Is there a pcap filter for TCPDump that will allow be to filter zero window messages?
I know how to filter these in a wireshark display filter (tcp.analysis.zero_window) but the amount of data I ...
- 84.4k
7
votes
3
answers
4k
views
snort analysis of wireshark capture
I'm trying to identify trouble users on our network. ntop identifies high traffic and high connection users, but malware doesn't always need high bandwidth to really mess things up. So I am trying ...
- 472
6
votes
4
answers
13k
views
How can I see packets while capturing with tcpdump
How can I see traffic while I am capturing it with tcpdump.
When I use -w, it doesn't show the packets during the capture.
sudo tcpdump -i enp2s0 -w test.pcap
tcpdump: listening on enp2s0, link-type ...
- 281
6
votes
3
answers
10k
views
How would a PCAP filter look like to capture all DHCP related traffic?
As I understand it, for IPv4 I would need to capture
UDP port 67 and 68,
ARP,
ICMP echo request and reply,
and for IPv6 I would need
UDP port 546 and 547,
all DHCP-related multicast addresses,
...
- 417
6
votes
1
answer
3k
views
How can I assign multiple IPv6 addresses with DHCPv6 to a single interface?
This seems to be possible based on the spec rfc 3315 page 23:
Excerpt:
The configuration information in an IA consists of one or more IPv6
addresses along with the times T1 and T2 for the IA. See ...
- 272
5
votes
1
answer
5k
views
How to filter ANY dns requests with tshark
Does anyone know how I might be able to filter DNS requests in tshark which ask for the ANY record?
So far I am able to filter DNS queries with:
tshark -r capture.cap -T fields -e ip.src -e ip.dst -e ...
- 455
5
votes
3
answers
18k
views
Extracting SSL certificates from the network or pcap files
I will appreciate if someone can point me to a tool or approach to extract SSL/TLS certificates from live HTTPS connections (directly from the network) or from a network trace file (pcap file). I ...
- 53
5
votes
1
answer
2k
views
Bandwith usage from pcap files
I've got a huge pcap file (many GBs) that I just can't load in wireshark. What I need is extracting bandwidth usage information, both total and per-protocol (in both incoming and outgoing direction), ...
- 51
5
votes
2
answers
4k
views
Compressing the output of tshark when in multiple files mode
I'm running tshark to dump wireless traffic. I am currently running in multiple files mode, splitting output into 50MB chunks. Is there any way to also have these 50MB chunks compressed with something ...
4
votes
2
answers
24k
views
Best way to analyze pcap files from Wireshark?
I've got 50-100MB pcap files captured from Wireshark and need to analyze where most of the traffic is going to/coming from.
What's the best way of doing this? Ideally I'd like to end up with an ...
- 506
4
votes
1
answer
5k
views
Other PCAP network software other than TCPREPLAY?
I would like to find out if there are more other useful softwares with the same functions or more like TCPREPLAY which has the ability to "playback" PCAP files? Thanks for your suggestions!
VMNoob
4
votes
1
answer
9k
views
How to make tshark to output valid pcap file used for other max GUI pcap viewer
sudo tshark -i en0 -x -w icmp_sample.pcap
This command output a pcap file, but the it doesn't seem to be valid, Because CocoaPacket Analyzer can't open it
Any idea?
- 141
3
votes
2
answers
14k
views
CLI tool for analyzing pcap captures [closed]
I am looking for a command line tool that will look at a capture file, tcpdump -w output, and give output equivalent to the information you get in the Wireshark conversations, and endpoint statistics.
...
- 132k
3
votes
3
answers
1k
views
Recording network traffic on one linux box, transferring it to another in real time
I have a situation where I want to capture all of the network traffic on one Linux box (currently using tcpdump) but have that data transferred in real time to another Linux on a separate (but ...
- 133
3
votes
3
answers
5k
views
How to separate PCAP by unique IP address
I have an hour long PCAP file which has about 60 individual network attacks done on our test network here at work. Each attack comes from a unique IP address which was not used elsewhere during the ...
- 177
3
votes
1
answer
2k
views
HTTP dissector that reads from pcap
I have some pcap data from a local interface which I'd like to analyze. Specifically, I'd like the content of HTTP sessions. I'm aware of many HTTP header statistics tools, but I would specifically ...
- 201
3
votes
1
answer
4k
views
How can I export more than 1000 http request bodies from a large pcap file?
I have a pcap file (~2.3G) containing HTTP requests. I need to extract the body of each request in some way that I can further process it. Each request in its own file would work well, but I can be ...
- 810
3
votes
2
answers
1k
views
Reducing a pcap file down to all operations on a specific NFS file
I have an 80GB packet capture (libpcap) and I want to filter it down to everything involving all operations on a particular NFS file/filehandle.
How can I accomplish this?
I know the following facts ...
- 39.7k
3
votes
0
answers
586
views
Modify ip addresses in a socks capture pcap
I have a pcap capture of socks traffic. The traffic goes like -
client_ip <-> 127.0.0.1:9050 <-> destination_ip
Looking at pcap in wireshark, thus, shows:
src_ip = 127.0.0.1
dst_ip = ...
- 131
3
votes
0
answers
2k
views
Can I use tshark to write SSL-decrypted packets to a file?
I have a PCAP file containing SSL-encrypted HTTP traffic and the private key from the relevant web server. I'd like a PCAP file that contains the decrypted HTTP traffic to feed into a different tool. ...
- 375
3
votes
1
answer
2k
views
Kill FINished sockets (using libpcap - tcpdump/tcpkill)
I'm trying to create a small service that monitors and kills sockets which have the FIN flag. I can get them with tcpdump (I also tried tcp[13] & 1):
tcpdump "tcp[tcpflags] & tcp-fin != 0"
...
- 133
2
votes
3
answers
2k
views
Good (free / open source) tools for analyzing TCP capture files?
I use wireshark and microsoft network monitor extensively, but I'm curious if there are other good (hopefully free / open source) software packages for analyzing TCP/IP traffic?
I'm especially ...
- 413
2
votes
3
answers
4k
views
How to capture contents of the first packet of TCP connections using tcpdump
I'm tasked with monitoring and debugging a SOAP web service, on network level. I can use tcpdump to capture the whole traffic coming from customers on port 80, but I can't limit the capture for every ...
- 161
2
votes
2
answers
7k
views
How to use tshark or tcpdump to calculate bytes transmitted
I am using this command with tshark:
tshark -r pcapfile "tcp and ip.src==192.168.1.1" -T text -V -x | grep 'Total Length'
This essentially parses the pcap for only connections from the source ip and ...
- 649
2
votes
2
answers
4k
views
Getting interface MTU under Linux with PCAP
I am interested in storing packets I sniff using PCAP.
As I preallocate the memory I need - i.e. a multiple of the MTU of the interface I am sniffing from, I would like to discover how much memory I ...
- 173
2
votes
2
answers
1k
views
pcap stream rotation and pruning
Some of my servers collect a lot of packet data. Is there a utility (or patch to tcpdump(1)) to log a pcap stream to disk which:
Rotates based on size of data written
Prunes written files, keeping ...
- 459
2
votes
2
answers
10k
views
Counting number of connections in a pcap file
What tool can I used to get a count of the number of TCP and UDP connections inside of a pcap file?
- 33
2
votes
1
answer
2k
views
Extracting TCP application data from pcap file
Given a .pcap (or similar) file, I'd like to select one TCP connection and dump both application data streams (the one from the other peer and the one two the other peer) into two separate files on ...
- 193
2
votes
1
answer
2k
views
Wireshark under Windows: Any way to capture packets before dropped by special filter drivers?
I've got some GigabitEthernet Vision cameras, which use Ethernet to communicate. The protocol is simple UDP, but for performance reasons (high packet throughput causing CPU load) the manufacturer uses ...
- 385
2
votes
2
answers
3k
views
How to efficiently re-order packets in PCAP files based on timestamp?
I have a PCAP file which contains many packets. They are however out of order based on the timestamp (it is actually randomized). What is the best way to efficiently sort the PCAP packets based on ...
- 165
2
votes
1
answer
2k
views
How can I reconstruct session from pcap file?
I am trying to extract session level (flow level) information from my pcap trace file.
I want to generate the following data for each line of session (flow):
Flow_num, IP_Src, IP_Dst, ...
2
votes
2
answers
2k
views
wireshark captures different on two computers from the same port
I Have a Windows XP Machine Running wireshark, connected to a Mirror port on a network. I'm capturing with no filtering, and it can only see half of some two way TCP conversations. I had thought it ...
- 768
2
votes
0
answers
240
views
disabling ethernet loopback packets
I have a linux machine with a few network interfaces which I use to run communication tests. In some of the tests I get a lot of packets with ether type 0x9000 (ethernet configuration testing protocol)...
- 151
2
votes
1
answer
857
views
Allowing node.js applications to run libpcap without sudo ("Symlink" issue )
I want to use the following command to allow usage of the libpcap package without to sudo (on a debian system):
sudo setcap 'CAP_NET_RAW+eip CAP_NET_ADMIN+eip' /usr/bin/nodejs
I'm getting this error:...
- 121
2
votes
0
answers
632
views
replay decrypted ssl traffic with tcpreplay
I have an pcap format from some https traffic from one of my web-servers.
So I can use the key from my webserver to decrypt the traffic in wireshark. The problem I'm now facing is that I can't get an ...
- 968
2
votes
1
answer
2k
views
Freeradius server is not accepting accounting packets through tcpreplay
I am running a free radius server on system A. I am sending test accounting requests using radclient radclient -x systemA acct testing123 from system B. I can see that the radius server recieved these ...
- 131
1
vote
2
answers
2k
views
Is it possible to split PCAPS into multiple files bases on simple criteria
Is it possible to split PCAPS into multiple files bases on simple criteria
Origional.pcap
{split on port 80} which generates the 2 following files
all_port_80.pcap
everything_else.pcap
Or would it ...
- 300
1
vote
3
answers
4k
views
(internal) Packet capture in a google cloud VPC network?
I have a VPC network set up in google cloud with a few instances running. One of these instances serves as a VPN machine, allowing me to interact with the instances from the internet.
I want to ...
google-cloud-platform
1
vote
1
answer
780
views
Search all pcap files in a folder and sub-folders for a certain condition
I have a folder (containing many sub-folders) full of pcap files and I'd like to get all pcap files containing packets that match a certain condition, for example "have source IP 1.1.1.1". Do you know ...
1
vote
1
answer
222
views
How to split pcap per IRC channels
I wonder if there is a way how to split a pcap that contains (only) IRC per channels. I'm trying to compare accuracy of botnet detection in channels using existing IDS (suricata, snort). The only way ...
- 113
1
vote
2
answers
941
views
I have a loopback traffic in linux involving port 631 and I have no idea what is causing it
So I did some packet capturing in my networking and everything else is actually fine except for this weird communication where source and destination is literally 127.0.0.1, source port is 631, and ...
- 13
1
vote
1
answer
2k
views
Replaying pcap file for Snort
I currently have the following, presumably standard, setup:
I have a physical server with Snort running. Snort logs into its log files as it should. Those files are tracked by barnyard2 which writes ...
- 121
1
vote
1
answer
157
views
email server delivers one message, but not another. no errors
i have sent two messages, one from the local server, one from the production environment. the message from the local server goes through, but the production message does not. both messages are ...
- 111
1
vote
0
answers
66
views
Why does snort can not alert this pcap?
the rule is
alert tcp any any <> any any (sid:11111;content:"GET";)
a file named http.pcap,in which has content
GET /s?wd=%E7%99%BE%E5%BA%A6 HTTP/1.0
a config file named 1.conf
...
- 11
1
vote
0
answers
215
views
How can I capture traffic for a daemon listening on a cloned loopback IP address?
I have a daemon listening on a virtual IP address attached to a cloned loopback interface (lo1) on FreeBSD 11.x.
Inbound traffic for that daemon could arrive on several different physical interfaces, ...
- 21.4k
1
vote
0
answers
4k
views
How do i convert text capture files back to pcap files?
I have opened Wireshark, selected the a.pcap file, and then went to File->Export and chose (K12 text file) to convert to text. Result is a.txt file.
How can I convert back a.txt file to original pcap ...
- 111