11 votes

How to display interface in tcpdump output flow?

Just a note, tcpdump 4.99 now displays the interface name/direction in the output: [vagrant@localhost]$sudo tcpdump -i any arp tcpdump: data link type LINUX_SLL2 tcpdump: verbose output suppressed, ...
otherwiseguy's user avatar
4 votes

Can user credentials from HTTP session be seen through Wireshark?

If the client passes the user credentials as plain text then yes, it will be possible to see them in the http packets.
user9517's user avatar
  • 116k
4 votes

Monitor where an application is connecting to on MacOSX

Using wireshark Wireshark doesn't support isolating traffic for a specific app. You would have to close every other app running on your OSX to reduce the noise. Once you find the tcp stream created ...
Luca Gibelli's user avatar
  • 2,771
4 votes
Accepted

How to check if promiscuous mode is enabled on network interface in windows server 2012 R2

Powershell. Get-NetAdapter | Format-List -Property PromiscuousMode That'll give you true or false.
vigilem's user avatar
  • 579
4 votes
Accepted

Why do different packet analyzers sometimes produce different results?

The protocol field is the application's best guess at the nature of the protocol. It is not part of the actual capture.
EEAA's user avatar
  • 110k
3 votes

Protecting wired LAN from packet sniffers

You can go all-IPSec, no need for IPv6 necessarily. Obviously there will be some management required, all hosts need to have the IPSec rules. In a pure Windows/AD environment, it's almost easy; the ...
mfinni's user avatar
  • 36.2k
3 votes

Is there a quick way to determine what applications are present within a Wireshark capture? If so how

WireShark sits too low in the network stack to have any information on which processes sent or received traffic. The trick is to know something about what you're looking for - it shouldn't take that ...
Dan's user avatar
  • 15.5k
3 votes

How to display interface in tcpdump output flow?

To add to Sebastian Haas's great bash script. I had to simplify his script since it failed in this line tcpdump -l $@ | sed 's/^/[Interface:'"${BASH_REMATCH[0]:2}"'] /' &. While it is not as ...
Brian's user avatar
  • 131
3 votes

How to display interface in tcpdump output flow?

If you are running on Mac, there is a -k option to tcpdump if you are using pktap interface, which dumps interface name among other useful metadata. -k Control the display of packet metadata ...
Wei Shen's user avatar
  • 131
3 votes

How to decrypt TLS traffic with Wireshark using RSA asynchronous encryption?

TLS 1.2 with ECDHE-RSA-AES256-GCM-SHA384 has forward secrecy. Notice its presence on the intermediate level of Mozilla's cipher lists. Inability to decrypt with only the server key is a feature. ...
John Mahowald's user avatar
2 votes
Accepted

How to decrypt TLS traffic with Wireshark using RSA asynchronous encryption?

As I was guessing the issue was in the ciphers that the server and the client agreed. We can only decrypt TLS/SSL packet data if RSA keys are used to encrypt the data. If a Diffie-Hellman Ephemeral (...
mavi's user avatar
  • 151
2 votes
Accepted

Process names in MS Message Analyzer

It seems to require Windows_Kernel_Trace messages to provide process names. I had the same problem that you did where I applied a session filter before the session start including an IP Address filter....
Sam Johnson's user avatar
1 vote
Accepted

Is a two-way communication possible over a mirror port?

This depends on the switch firmware. For example on an HP 1910 (and its 3Com hardware brothers) monitor port can send and receive frames just as usual, while Cisco switches generally disable all ...
Peter Zhabin's user avatar
  • 2,871
1 vote

Can GCP do port mirroring at the subnet level?

No, not a mirrored port. For visibility, you can bring your own security appliance VMs such as firewalls or virtual switches. Or consume their flow logs. Security vendors with a public cloud story ...
John Mahowald's user avatar
1 vote

Is it possible to sniff packets on KVM guest loopback interface from host?

No it's not. From my perspective, both (the host and the guest) should be looked at as separate hosts. All traffic is inside the KVM guest and the only way how to monitor it is sniffing inside the ...
honza-kasik's user avatar
1 vote

Analyzing HTTP traffic

There is really no way to definitively determine the type of device network traffic comes from. User agents can be trivially changed.
EEAA's user avatar
  • 110k
1 vote
Accepted

Packet Sniffer to dynamically create iptables rules

This already exists in the form of the Connection Tracking module in iptables. This Digital Ocean tutorial describes this and contemporary distributions often implement this by default. Before ...
Jason Martin's user avatar
  • 5,093
1 vote

Tcpdump on ec2 not seeing all packets

A technology that was released after this question was asked is VPC Flow Logs. This lets you look at network traffic in your VPC, filtered as you like. VPC Flow Logs won't show you full packet ...
Tim's user avatar
  • 32.7k

Only top scored, non community-wiki answers of a minimum length are eligible