Questions tagged [packet-capture]

Packet capture is the act of capturing data packets crossing a computer network. Packet capture can be: Deep packet capture (headers & payload), or partial packet capture (headers only).

Filter by
Sorted by
Tagged with
-1
votes
0answers
9 views

Capture Traffic Virtual Machine High Speed Network SPAN port

I need to capture traffic from a span port to a virtual machine sitting on our cloud. The span port however transmits over 1TB in a single day, with peaks at 500mbps but averages 100mbps overall. I ...
-1
votes
0answers
28 views

monitor network traffic of an app on iOS or android [closed]

I have an application installed on my iPhone and I want to know what is the API URL address it calls to receive data from its server. I have already tried to run a man in the middle (MITM) proxy on my ...
0
votes
0answers
9 views

Transparently proxying vmware workstation windows guests on linux host

I am doing malware research and would like to simplify packet capture and packet manipulation. On current setup. Windows guest (on which malware is executed) has one network interface, which is part ...
0
votes
0answers
17 views

WDS Stuck Capturing Image - 75/76%

So I captured a software image Windows 10 2004 a month or so ago to WDS 2012 with no hitches. Over the last two days I have been trying to capture another image using the same method but yesterday it ...
0
votes
0answers
17 views

Complex (nested, etc.) packet filtering from .pcap files using tshark or other tools

A few notes in advance The task is to read from a captured .pcap file than a live stream. It shall be performed via the command line than the GUI for potential automation. I understand that such ...
0
votes
1answer
72 views

Pcap (tcpdump) filter to match against local port

I'm trying to write a libpcap (tcpdump, iftop) filter that would match packets having a specific local port. That is, I'm interested in traffic that either goes out of port 12345 on the local machine ...
1
vote
1answer
118 views

Forwarded Packets are received by namespace's veth0 but not received by application

I use libtins (It uses Pcap) to capture link layer packets and forward to a network namespace where the actual application runs on. Client(Browser) -> Server -> Pcap -> Pcap Send -> br0 (...
0
votes
0answers
43 views

Drawbacks of having pruned and collapsed packets

I am a newbie in networking field, I come across a note that we should not have pruned packets and collapsed packets, if we have, we should have to optimize the system. But the note (neither the ...
0
votes
0answers
15 views

How to block the client confirmation of server's response?

Suppose I make a request to a server and when I receive the response, the server sets some flag to true. But I don't want the server to set that flag. Is there a way to manipulate the TCP ...
3
votes
1answer
283 views

TCP Duplicate Ack without Packet Loss

edit: there were actually 2 problems, a buggy TCP implementation on the device running the RTOS and an issue causing the Linux network stack to receive the TCP fragments out of order when more than 1 ...
0
votes
0answers
23 views

Can't start capture files in GNS3 (Wireshark error)

What's wrong with wireshark in GNS3? I've reinstalled wireshark and GNS3, but it doesn't solve my problem. Wireshark Error: My packet capture preferences:
0
votes
0answers
66 views

Bandwidth Calculation using Pcap

Can Pcap be used to accurately calculate the speed or bandwidth of any user using only their IP in both uploading and downloading by checking the src/dst IPs of the packets?? If so, assuming that ...
1
vote
0answers
38 views

How can I capture traffic for a daemon listening on a cloned loopback IP address?

I have a daemon listening on a virtual IP address attached to a cloned loopback interface (lo1) on FreeBSD 11.x. Inbound traffic for that daemon could arrive on several different physical interfaces, ...
0
votes
1answer
93 views

Send duplicate UDP packets to another computer

We have a production server where we receive a continuous stream of UDP packets (~ 15 Mbps). We have a small research team which wants to process this same exact stream for some research purposes on ...
0
votes
1answer
40 views

How do I capture packets on a Linux VM in a VMware environment?

I've got a Linux server that is a VM running on ESXi 6.7. We're running into some network trouble with it, and I'm trying to use tcpdump to capture traffic on the VM itself, but I'm getting only the ...
0
votes
1answer
611 views

OpenVPN log connections per user

I'm trying to set up a VPN solution where I can log packet captures of individual connections. I've been focusing on using OpenVPN but I am amenable to other solutions. It is important to note that I ...
1
vote
1answer
77 views

how to man-in-the-middle blocking/intercepting/editing all network traffic going to a single cabled device and a server

I need to completely block and intercept and alter all packets going between two devices. possibly i need to isolate one device and block/intercept/edit ALL traffic going to and from it if i cannot ...
0
votes
0answers
26 views

How to use Wireshark to decode HTTP stream?

I'm using an application that outputs each HTTP stream as two files: connection.out and connection.in. The .out file contains everything the client sends to the server (i.e. requests), and the .in ...
0
votes
0answers
90 views

Loopback interfaces is not pinging on both pcs for packet tracer

I am trying to ping my isp ip address (aka loopback 1) and loopback 10 to PC1 and PC2. Whenever I ping both ip addresses and default gateway from pc1 to pc2 it works. However, when I'm trying to ping ...
0
votes
1answer
277 views

How can I gathering Network Traffic on AWS?

I am building packet mirroring using the Linux type's iptables tee module. In the case of instances(EC2), we confirmed that promiscuous mode can be set on AWS console configuration. than, I wonder if ...
0
votes
1answer
60 views

CentOS 6 - Find KVM VM with HW addr

We are running KVM VM's (Linux & Windows) on our CentOS 6 & 7 hypervisors. Sometimes we are noticing a lot of packets going in or out. Now I want to see which IP address or network adapter ...
0
votes
0answers
462 views

iperf test shows large number of TCP: duplicate ACK / retransmission & out-of-order

I carried out a network throughput test using iperf and captured packets at both ends. I see a almost 10% packets highlighted in tcp.analysis.flag with following characteristic: “TCP duplicate ack” ...
1
vote
2answers
425 views

What are the numbers preceeding a DNS packets flags for?

What does the Flags: 0x0500 section of this DNS query packet mean? Domain Name System (query) Transaction ID: 0x4242 Flags: 0x0500 Standard query 0... .... .... .... = Response: ...
0
votes
1answer
35 views

Tips for working with very large pcaps?

What is the best approach for working with very large collections of network traffic (500GB+)? Specifically, I'd like to be able to filter packets which match various payload and protocol criteria (...
0
votes
1answer
28 views

Network sniffer that work as windows service

We need to log the traffic of incoming traffic for some application on our server. The first instinct is to use Wireshark and of course, as soon our remote session end Wireshark also shutdown. Since ...
0
votes
1answer
129 views

Are TCP RTO value and RTT value influenced by the packet size?

I am doing troubleshooting in my network. I found some re-transmission by using wireshark. The segment 1400 bytes are well transmitted but The segment 800 bytes are lost and re-transmitted. I know ...
1
vote
2answers
307 views

What should be the next sequence number after a packet with the FIN containing payload?

I was capturing some HTTP traffics and I observed a packet with the FIN flag set and also containing payload data. I searched for this topic and I found some similar questions but none of them ...
2
votes
2answers
288 views

Get network data transfer rate / throughput for use in Wireshark

I'm trying to get the ethernet NIC throughput rate / data transfer rate on a VPS in order to start a capture on Wireshark during DOS/DDOS attacks so I can analyze the nature of the packets. I'm ...
1
vote
1answer
73 views

How does LDAP Authentication Work at the TCP Layer?

Specifically, how does an LDAP server distinguish a TCP packet containing a SearchRequestOp from an authenticated user, from a TCP packet containing a SearchRequestOp from an unauthenticated user? I ...
1
vote
1answer
44 views

Can user credentials from HTTP session be seen through Wireshark? [duplicate]

Can we get that info the same way we do for FTP since HTTP is a plain text protocol?
1
vote
1answer
280 views

Can I verify failure of port forwarding using wireshark / packet capture

I've recently configured a Debian 9 server (Debian 4.9.130-2) to run as a lightweight server, running a series of Docker containers (nextcloud, sync, etc.) alongside basic services like ssh. Services ...
0
votes
0answers
1k views

Can I capture full TCP packet content with haproxy without knowing length of the packet?

I know I can capture 6 bytes length packet using this config: global log /dev/log local0 debug log /dev/log local1 notice chroot /var/lib/haproxy stats socket /...
0
votes
1answer
478 views

How to turn an ethernet port into a passive listener?

I want to capture ethernet packets with my raspberry pi's ethernet port. I know I could create an ethernet bridge between two ethernet ports on the raspberry and analyze the packets internally with ...
0
votes
1answer
281 views

rpcapd behind a firewall

I have a remote server with rpcapd installed that follows strict security policy rules. Any client can access to the server only via firewall that follows same security policy (please, don't blame me, ...
0
votes
2answers
99 views

Port forwarding for 100K+ IP's

I need to do port forwarding on my Linux (Debian 8) to intercept packets going through the machine. It needs to be based on source IP, so different ports for different IPs. I've though of using ...
0
votes
2answers
517 views

Who can issue a RST?

I have a client connecting to a server via a VPN tunnel. The connectivity is in place, I can ping the server and requests some other services (a curl request on an API for instance) through that ...
-5
votes
1answer
56 views

How packet is transmitted over the network? [closed]

I am writing discrete event-driven simulator to measure time between sending datasets over network. If multiple processes sends n packets through network they (packets) will go one after one through ...
0
votes
1answer
48 views

Cisco 877 doesn't respond to IP determined through ARP

I have just obtained an old Cisco 877. I made sure to first push the reset button in the back. I then plugged into one of the LAN ports. The device gave me an IPv4 address (169.254.14.65/16) and an ...
7
votes
2answers
3k views

How can I decrypt STARTTLS communication over SMTP in a packet capture (if I have the private key)?

For the purpose of troubleshooting, I need to see what an email looks like when it's sent to my sendmail server via SMTP. The upstream server requires the SMTP connection to use STARTTLS so a packet ...
1
vote
1answer
3k views

How can NETSH be used to sniff and collate network traffic?

I am trying to capture all network traffic and view it in a human-readable way. To begin packet capture with netsh, I am running the following command. netsh trace start scenario=NetConnection ...
1
vote
1answer
7k views

Client sends RST after FIN,ACK

While doing a file transfer using secure file transfer protocol, I am seeing the behaviour as given in the below image. Instead accepting packets from server, it simply sends a RST. Found a similar ...
0
votes
1answer
680 views

How can I identify the cause of packet loss in DNS?

We have upgraded some of our routers to Ubuntu 16.04 and are now getting some performance problems with DNS. It seems that packets are sometimes truncated, but I have no clue what else I can do: This ...
3
votes
2answers
4k views

How to determine which process is sending UDP packets once per hour?

I was doing a packet capture as part of a development project and saw some odd traffic coming from my machine in the capture file. About every 3600 seconds, a NAT-PMP request is being sent to the IP "...
1
vote
1answer
2k views

Packet Captures saved in bin file format

Does anyone know of a tool to open a packet capture saved as a .bin file? That or how to convert it to pcap or something wireshark can open. I took a packet capture from a thin client and when I ...
0
votes
1answer
366 views

How do I generate a source of netflow data for nfcapd?

I am trying to use nfcapd to save netflow files for use by a network analysis tool. How do I capture network traffic on my host and send it into nfcapd? Can I use wireshark/tshark or something ...
1
vote
0answers
390 views

Netsh trace vs PEF trace cmdlets vs NetEvent cmdlets

I am playing with capturing my network traffic and came across two different MS commandline tools that allow doing this: a well-known netsh tool, recently equipped with powerful capture switch a ...
2
votes
2answers
1k views

Process names in MS Message Analyzer

I am trying to set up the Message Analyzer viewer exactly like it is explained in this reference, but instead of steady process names I got some weird numbers, both in ProcessName and ProcessID ...
0
votes
1answer
593 views

How to filter wireshark capture to have only packets with local ip as source or destination

How to filter wireshark capture to have only packets with local ip as source or destination? The expression should be valid for both ipv4 and ipv6. I am obviously asking for an other solution than ...
1
vote
2answers
1k views

Block DNS query using pfctl

I am trying to create rule to allow DNS queries (port 53) to only 8.8.8.8 server (Google DNS). DNS queries to all other servers should not succeed. I added the following lines to /etc/pf.conf file ...
0
votes
1answer
234 views

how can i export sflow data to be saved in pcap on other server in realtime?

I have a pfsense server, all of attacks will come to its WAN interface. i have setup another packet analysis tool on private network behind pfsense. i want to send realtime WAN traffic from pfsense ...