Questions tagged [packet-analyzer]

The tag has no usage guidance.

Filter by
Sorted by
Tagged with
11 votes
11 answers
18k views

Is there an easy command line tool for packet sniffing a single command on linux?

I'd love if there was a single command line tool for packet sniffing a single command in Linux. something like sniff dumpfile command so that you could just run the command you want to packet sniff in ...
18 votes
2 answers
64k views

How can I search the info column in Wireshark?

Wireshark | Windows I want to search a packet capture of SMTP traffic for specific addresses/messages. Normally, I just sort the info column and browse but it would be nice if I could just run a ...
0 votes
2 answers
107 views

Can a server determine if the client is on LAN or WLAN?

I’d like to restrict the access to my server to clients who connect to their home router by LAN rather than WLAN. Is this at all possible, e.g. by examining packets? Further information: I’m concerned ...
11 votes
5 answers
45k views

How to list all requests to udp sockets?

I'm operating a couple of server daemons that use udp to communicate with large number of clients. How do I find and list out all the active udp "connections" that are talking to the servers in order ...
5 votes
5 answers
6k views

Is it safe to run Wireshark on a production IIS7 server? Is there a good alternative?

We host a bunch of ASP.NET sites on an IIS7 server. Occasionally, we'd like to be able to log HTTP POST data to troubleshoot problems. IIS lets us log the query string, but not the POST data - at ...
1 vote
3 answers
2k views

Ntop monitoring - Hosts visible with no SPAN/mirroring

I am attempting to use ntop to monitor traffic over a Cisco Catalyst switch. I was assuming that in order to see any of the traffic, I'd have to use monitor, as described here: http://www.cisco.com/en/...
25 votes
4 answers
19k views

Change protocol associated with port in wireshark

I'm trying to monitor some web traffic using wireshark. Our web proxy is on port 9191. How can I get the wireshark view to treat port 9191 just like port 80 - ie as HTTP. Just using Decode_As on the ...
3 votes
3 answers
4k views

What's the best way to track Jitter and Packetloss

I need to track Jitter and Packet Loss over a MPLS line. What's the most accurate way to capture this information without interfering with the data being sent back and forth? Is SmokePing the best ...
0 votes
2 answers
4k views

iperf udp sequence number wireshark

I'm using iperf for generating udp traffic and my objective is to measure paquet loss. I wanted to know if the first 4 Bytes of Iperf Data are currently the sequence number.
0 votes
2 answers
85 views

Analyzing HTTP traffic [closed]

I am trying to solve the problem for a while and i couldn't find a proper answer online. I have a file with mobile traffic (from an Android device) and I am trying to check whether an http request is ...
4 votes
11 answers
744 views

Windows packet sniffer

What packet sniffer would you recommend using, especially in a 50+ workstation environment? I am a fan of Wireshark but it's got quite a bit of security history. Is there something better?
-1 votes
1 answer
357 views

Tell me which ports have been used during a period of time

I've been struggling with a server provider while trying to mount a few services for my company, this because they have an strict Firewall policy which denies all non-allowed IN/OUT internet access, ...
1 vote
1 answer
4k views

How to capture network packets that use SS7 protocol using Wireshark?

Since SS7 protocol stack is used in GSM mobile telephony network, we can't get the packets of SS7 protocols using Wireshark in Windows Computer and browsing in a web browser like Google chrome. So ...
0 votes
0 answers
200 views

In the output of Chaosreader, where are the source and destination port numbers and IP addresses for each packet?

I used this tutorial to use Chaosreader on an output file of WinDump. My purpose was to get the HTTP payload, which I got. But I'd also like to extract other information, like source IP and ...
55 votes
6 answers
32k views

Debugger for Iptables

I'm looking for an easy way to follow a packet through the iptables rules. This is not so much about logging, because I don't want to log all traffic (and I only want to have LOG targets for very few ...
1 vote
1 answer
231 views

Need help in understanding the packet analysis(wireshark) [closed]

The snapshot capture below contains a single HTTP request to a web server, in which the client web browser requests some files from server, and the server returns an HTTP/1.1 200 (OK) response which ...
2 votes
3 answers
15k views

Can Wireshark capture an entire Ethernet frame including preamble, CRC and Interframe spacing?

I am examining an Ethernet frame in Wireshark. According to the "Ethernet frame" Wikipedia article and accompanying diagrams, "A frame starts with a 7-octet preamble and 1-octet start frame delimiter (...
1 vote
1 answer
751 views

Is there a quick way to determine what applications are present within a Wireshark capture? If so how

Is there a quick way to determine what applications are present within a Wireshark capture? If so how As most captures contain over 10 thousand lines, I can't expect people would by hand check which ...
0 votes
0 answers
45 views

l7-filter does not set markers

I install l7-filter userspace on ubuntu 12.04 and run it by this command: sudo l7-filter -f /etc/l7.conf -q 1 but l7-filter does not set any markers. I set iptables to send forwarding packet to ...
0 votes
0 answers
359 views

Early tear down of communication

I have an application which performs an LDAP search which works in one domain but not in the other, when analyzing the packets sent between the application server and the domain controller being ...
0 votes
1 answer
3k views

Analyzing twitter packets [closed]

Thanks for your time. I'd like to find a way if a client has made a 'GET' or a 'POST' request for twitter. We are currently doing an educational project and we wanted to understand how we can achieve ...
-2 votes
1 answer
2k views

How do I get statistics on HTTP traffic from Wireshark? [closed]

I have captured traffic with dumpcap and filtered http only with Wireshark. I want to see statistics about that http traffic. For example: requests grouped by method and URL, ordered by number of ...
0 votes
0 answers
128 views

Hadoop - On the Wire Performance Monitoring?

I have been tasked with implementing an 'on the wire' monitoring solution for a large Hadoop installation. The source of data will be a combination of taps and SPANs throughout the environment. My ...
15 votes
1 answer
26k views

Why is the "don't fragment" flag set in https and ssh protocols?

I've found a lot of information specifying that this is the case, however, I am really looking for the reason behind this. Why is it necessary? Is it necessary?
1 vote
1 answer
2k views

Transparent Bridge on Windows XP

Bascially i need to set up a configuration like the following: http://wiki.wireshark.org/CaptureSetup/Ethernet#Capture_using_a_machine-in-the-middle I have a computer with windows XP and 2 nics. I ...
1 vote
0 answers
272 views

How to add TDS support to tshark?

How to add TDS (knowledge about MS SQL Server packets' structure) support for tshark? Currently, the situation is this: root@DEV:/# tshark -d . 2>&1| grep -i tds root@DEV:/# I.e: tshark does not ...
5 votes
2 answers
7k views

GUI tool for packet replay [closed]

Is there a freeware Windows/Linux GUI packet replay tool that has the advanced features of tcpreplay (http://tcpreplay.synfin.net/) or bittwist (http://bittwist.sourceforge.net)? I'm particularly ...
2 votes
1 answer
3k views

What's a good proxy/tool to dynamically change the content of packets(TCP/UDP)

I am not sure if such tool exists, but I want to dynamically modify certain packets sent using my wireless network. More specifically, I want to modify packets sent from multiple machines (including ...
1 vote
1 answer
772 views

What is the best way/tool to analyze raw data(network stats) from Simulation?

After running a simulation(using a simulator(QualNet)) of a simulated network I end up with ip stats stored in a database, I then extract the data to a csv file So now I have 750mb of raw network ...
4 votes
5 answers
6k views

How to detect an iPhone connecting a network?

I've noticed through watching Wireshark that when an iPhone connects to a wifi network, it sends out a few IGMP/MDNS packets to 224.0.0.251 (LAN broadcast, I think). Is there any easy way to watch ...
0 votes
2 answers
328 views

Identifying VoIP Users

I'm looking for a way to identify as many consumer VoIP users on my ISP network as possible using packet analysis. My setup is like this: On my core switch, all traffic going in and out of gigabit1 ...
23 votes
4 answers
40k views

Monitor number of bytes transferred to/from IP address on port

Can anyone recommend a linux command line tool to monitor the number of bytes transferred between the local server and a specified IP address/port. The equivalent tcpdump command would be: tcpdump -...
0 votes
1 answer
700 views

Using tshark to generate traffic logs every X seconds

I'm trying to use tshark to maintain a running history of all the packets that are going through an interface, for say 30 seconds. I want it to be human readable. This is a linux machine, and without ...
5 votes
2 answers
10k views

Can 3G networks be packet sniffed / analyzed?

Just wondering if 3G networks can be sniffed like public wifi networks, via wireshark for example (I'm almost sure this is not possible due to encryption, but I just want to make sure?)
5 votes
2 answers
7k views

Silently start Wireshark

I have a computer in our office that always gets infected by viruses. Because of this, I would like to use Wireshark (or at least something) to monitor internet traffic for a while on this machine. ...
0 votes
1 answer
399 views

How can I read a packet capture file from a Cisco RV 120W?

What program should I use? (the file is generated on RV 120W under Diagnostics section)
3 votes
1 answer
1k views

Confusion about TCP packet analysis terms

I'm analyzing our network and have some confusion about the terms: this is the 2-packet output from source to destination. from these i have to get some features as describe, pls make me clear... ...
3 votes
1 answer
784 views

Tool for graphing packet size distribution on Linux? [closed]

Is there a tool for Linux to easily produce graphs (histograms) of the packet sizes (e.g. TCP) of network traffic ? (before I start putting together something using e.g. matplotlib and python ...
1 vote
2 answers
1k views

few questions on packet sniffer/analyzer

I have few questions about packet sniffer. I'm using a zyxel p-600 series modem and a hub to distribute the internet connection. Can I use a packet sniffer here to determine if the user is ...
0 votes
2 answers
314 views

Identify Executable Creating Network Traffic

I've got some application on my Windows XP machine that is generating an HTTP request to aaronsw.com every half hour. We've trapped the packets in wireshark, but wireshark doesn't tell what ...
3 votes
3 answers
1k views

Sniff packets which have source address other than my machine

I tried sniffing network traffic between 2 ip addresses. One is a HTTP server and other is the client accessing that site. My aim is to sniff POST method form data. How do i do that? When i tried ...
4 votes
3 answers
3k views

Why to use a commercial packet/protocol analyzer vs. WireShark?

I have never worked in an "enterprise" infrastructure group but have been responsible for small networks. WireShark (Ethereal back in the day) always worked for me in those situations. Where is the ...