The Stack Overflow podcast is back! Listen to an interview with our new CEO.

Questions tagged [packet-capture]

Packet capture is the act of capturing data packets crossing a computer network. Packet capture can be: Deep packet capture (headers & payload), or partial packet capture (headers only).

Filter by
Sorted by
Tagged with
1
vote
2answers
52 views

What are the numbers preceeding a DNS packets flags for?

What does the Flags: 0x0500 section of this DNS query packet mean? Domain Name System (query) Transaction ID: 0x4242 Flags: 0x0500 Standard query 0... .... .... .... = Response: ...
0
votes
1answer
23 views

Tips for working with very large pcaps?

What is the best approach for working with very large collections of network traffic (500GB+)? Specifically, I'd like to be able to filter packets which match various payload and protocol criteria (...
0
votes
1answer
22 views

Network sniffer that work as windows service

We need to log the traffic of incoming traffic for some application on our server. The first instinct is to use Wireshark and of course, as soon our remote session end Wireshark also shutdown. Since ...
0
votes
1answer
29 views

Are TCP RTO value and RTT value influenced by the packet size?

I am doing troubleshooting in my network. I found some re-transmission by using wireshark. The segment 1400 bytes are well transmitted but The segment 800 bytes are lost and re-transmitted. I know ...
1
vote
2answers
138 views

What should be the next sequence number after a packet with the FIN containing payload?

I was capturing some HTTP traffics and I observed a packet with the FIN flag set and also containing payload data. I searched for this topic and I found some similar questions but none of them ...
2
votes
2answers
61 views

Get network data transfer rate / throughput for use in Wireshark

I'm trying to get the ethernet NIC throughput rate / data transfer rate on a VPS in order to start a capture on Wireshark during DOS/DDOS attacks so I can analyze the nature of the packets. I'm ...
1
vote
1answer
44 views

How does LDAP Authentication Work at the TCP Layer?

Specifically, how does an LDAP server distinguish a TCP packet containing a SearchRequestOp from an authenticated user, from a TCP packet containing a SearchRequestOp from an unauthenticated user? I ...
0
votes
0answers
42 views

Java socket can not receive UDP Fragmentation Packet

The network layer is suppose to join fragmentated packets and for what I am seeing at wireshark it is everything fine (More fragments flags, offset...). In Java if the buffer sizeof socket and ...
1
vote
1answer
40 views

Can user credentials from HTTP session be seen through Wireshark? [duplicate]

Can we get that info the same way we do for FTP since HTTP is a plain text protocol?
1
vote
1answer
54 views

Can I verify failure of port forwarding using wireshark / packet capture

I've recently configured a Debian 9 server (Debian 4.9.130-2) to run as a lightweight server, running a series of Docker containers (nextcloud, sync, etc.) alongside basic services like ssh. Services ...
0
votes
0answers
487 views

Can I capture full TCP packet content with haproxy without knowing length of the packet?

I know I can capture 6 bytes length packet using this config: global log /dev/log local0 debug log /dev/log local1 notice chroot /var/lib/haproxy stats socket /...
0
votes
1answer
225 views

How to turn an ethernet port into a passive listener?

I want to capture ethernet packets with my raspberry pi's ethernet port. I know I could create an ethernet bridge between two ethernet ports on the raspberry and analyze the packets internally with ...
0
votes
1answer
200 views

rpcapd behind a firewall

I have a remote server with rpcapd installed that follows strict security policy rules. Any client can access to the server only via firewall that follows same security policy (please, don't blame me, ...
0
votes
2answers
93 views

Port forwarding for 100K+ IP's

I need to do port forwarding on my Linux (Debian 8) to intercept packets going through the machine. It needs to be based on source IP, so different ports for different IPs. I've though of using ...
0
votes
2answers
156 views

Who can issue a RST?

I have a client connecting to a server via a VPN tunnel. The connectivity is in place, I can ping the server and requests some other services (a curl request on an API for instance) through that ...
-5
votes
1answer
54 views

How packet is transmitted over the network? [closed]

I am writing discrete event-driven simulator to measure time between sending datasets over network. If multiple processes sends n packets through network they (packets) will go one after one through ...
0
votes
1answer
34 views

Cisco 877 doesn't respond to IP determined through ARP

I have just obtained an old Cisco 877. I made sure to first push the reset button in the back. I then plugged into one of the LAN ports. The device gave me an IPv4 address (169.254.14.65/16) and an ...
7
votes
2answers
2k views

How can I decrypt STARTTLS communication over SMTP in a packet capture (if I have the private key)?

For the purpose of troubleshooting, I need to see what an email looks like when it's sent to my sendmail server via SMTP. The upstream server requires the SMTP connection to use STARTTLS so a packet ...
1
vote
1answer
2k views

How can NETSH be used to sniff and collate network traffic?

I am trying to capture all network traffic and view it in a human-readable way. To begin packet capture with netsh, I am running the following command. netsh trace start scenario=NetConnection ...
1
vote
1answer
4k views

Client sends RST after FIN,ACK

While doing a file transfer using secure file transfer protocol, I am seeing the behaviour as given in the below image. Instead accepting packets from server, it simply sends a RST. Found a similar ...
0
votes
1answer
579 views

How can I identify the cause of packet loss in DNS?

We have upgraded some of our routers to Ubuntu 16.04 and are now getting some performance problems with DNS. It seems that packets are sometimes truncated, but I have no clue what else I can do: This ...
3
votes
2answers
3k views

How to determine which process is sending UDP packets once per hour?

I was doing a packet capture as part of a development project and saw some odd traffic coming from my machine in the capture file. About every 3600 seconds, a NAT-PMP request is being sent to the IP "...
1
vote
1answer
1k views

Packet Captures saved in bin file format

Does anyone know of a tool to open a packet capture saved as a .bin file? That or how to convert it to pcap or something wireshark can open. I took a packet capture from a thin client and when I ...
0
votes
1answer
343 views

How do I generate a source of netflow data for nfcapd?

I am trying to use nfcapd to save netflow files for use by a network analysis tool. How do I capture network traffic on my host and send it into nfcapd? Can I use wireshark/tshark or something ...
1
vote
0answers
353 views

Netsh trace vs PEF trace cmdlets vs NetEvent cmdlets

I am playing with capturing my network traffic and came across two different MS commandline tools that allow doing this: a well-known netsh tool, recently equipped with powerful capture switch a ...
2
votes
2answers
1k views

Process names in MS Message Analyzer

I am trying to set up the Message Analyzer viewer exactly like it is explained in this reference, but instead of steady process names I got some weird numbers, both in ProcessName and ProcessID ...
0
votes
1answer
502 views

How to filter wireshark capture to have only packets with local ip as source or destination

How to filter wireshark capture to have only packets with local ip as source or destination? The expression should be valid for both ipv4 and ipv6. I am obviously asking for an other solution than ...
1
vote
2answers
670 views

Block DNS query using pfctl

I am trying to create rule to allow DNS queries (port 53) to only 8.8.8.8 server (Google DNS). DNS queries to all other servers should not succeed. I added the following lines to /etc/pf.conf file ...
0
votes
1answer
182 views

how can i export sflow data to be saved in pcap on other server in realtime?

I have a pfsense server, all of attacks will come to its WAN interface. i have setup another packet analysis tool on private network behind pfsense. i want to send realtime WAN traffic from pfsense ...
1
vote
1answer
433 views

Possible to dump sflow data to pcap format?

I want to get the packet capture from fortiet/fortigate device, to capture all traffic from it on one of its interface. For it i have enabled sflow and sent it to another ntopng server. but on ntopng ,...
1
vote
1answer
3k views

How to capture network packets that use SS7 protocol using Wireshark?

Since SS7 protocol stack is used in GSM mobile telephony network, we can't get the packets of SS7 protocols using Wireshark in Windows Computer and browsing in a web browser like Google chrome. So ...
0
votes
0answers
130 views

In the output of Chaosreader, where are the source and destination port numbers and IP addresses for each packet?

I used this tutorial to use Chaosreader on an output file of WinDump. My purpose was to get the HTTP payload, which I got. But I'd also like to extract other information, like source IP and ...
0
votes
1answer
120 views

packet colorization in Wireshark

is there anyone who could sum up the packet colorization system in wireshark? My capture list is looking quite colourful, but I don't quite understand how the colorization scheme work. Thank you
0
votes
1answer
272 views

How to perform Wiresharks File->Extract Objects->HTTP through Tshark commandline interface?

Using TShark, I want to be able to extract the payload in HTTP response from packets data captured through tshark in a .pcap file. In the Wireshark GUI, I was able to do that by File > Extract ...
0
votes
2answers
898 views

Why do some VLAN Wireshark captures include data after the IPv4 payload?

Data Some Cloudshark captures show a "Trailer" for the vLAN and some do not. Captures With extra 4 bytes. Without extra 4 bytes. Question Why do some and not all VLAN Wireshark captures include ...
6
votes
2answers
3k views

Can I use HAProxy's new 'capture' feature to save the remote address in a TCP frontend, and use it as the `X-Forwarded-For` header in an HTTP backend?

Using HAProxy 1.6 and a clever hack, I now have an HAProxy tcp mode frontend, that detects if the browser is capable of SNI, and based on that, routes to a strongly ciphered SSL termination backend, ...
4
votes
1answer
261 views

Is there a way to “replay” a packet capture of a smtp session for the purpose of debugging?

I'm troubleshooting a smtp issue involving character-set encoding and it's extremely difficult to involve the end user. I have a packet capture of an incoming smtp session that results in problematic ...
1
vote
1answer
173 views

Figuring out the most efficient use of an ip range

I am working with Packet Tracer atm and have 3 subnet plans : assigned(management(104users) staff(43 users) admin(35 users)). I have an ip address range of:38.191.0.0 and subnet mask of 255.255....
1
vote
1answer
47 views

Is there a quick way to determine what applications are present within a Wireshark capture? If so how

Is there a quick way to determine what applications are present within a Wireshark capture? If so how As most captures contain over 10 thousand lines, I can't expect people would by hand check which ...
-2
votes
2answers
102 views

Why do different packet analyzers sometimes produce different results?

I ran wireshark and windump at the same time. Both packet analyzers use the same winpcap library. However after doing a row by row comparison of the results I noticed both every column between the 2 ...
0
votes
1answer
262 views

Is it possible to specify tcpdump that I want it to interpret packet differently before printing it to STDOUT?

I am using iperf to pinpoint packet reordering issue. Unfortunately, tcpdump does not know how to parse iperf's UDP payload that I could use to pinpoint the issue. I know that iperf stores packet ...
0
votes
1answer
2k views

Why are ICMP packets not captured on the target interface?

I have a network setup as in the picture: The central box is a gateway (Ubuntu 15.10) which relays the packets betwen the various networks (only one is shown on the picture - lan0) and Internet. ...
0
votes
1answer
394 views

PCAP filter for first few packets, and packets related to disconnection, TCP-only

I'd like to use tcpdump with a filter for some long-running debugging. Specifically, I only want to capture packets with the following conditions: First 10 packets or so of a new TCP connection (...
1
vote
1answer
272 views

udp broadcast on port 25860

I used wireshark on my local network (to test it), and i noticed that there is a lot of udp packets send one broadcast, and the majority is coming from only one host. Theses udp packets are send on ...
0
votes
1answer
207 views

PCAP traffic frame length short

I'm trying to make traffic and capture it using pcap file. I get pcap file from CAIDA(caida.org) site. This pcap file too big and doesn't have ethernet header. So i splitted pcap file to small size(40 ...
0
votes
0answers
76 views

ICMP Packet Flood a local device over Wireless AP to figure out packet loss?

I'm using a utility to create an ICMP packet flood/attack called Hyanea since windows doesn't have native support like linux does. I want to be able to test a new AP to see if any packet loss occurs....
0
votes
2answers
10k views

How to log all inbound connections on Windows server

I need to log a summary of all inbound TCP connections on a Windows 2008R2 server, but only including the Source IP, Source Port, Destination IP and Destination Port. I do not want to log the payload ...
1
vote
1answer
1k views

Is it possible to run 2 concurrent tcpdump with different options?

I need to run 2 concurrent tcpdump commands with different arguments/options. Why ? Because we wrote some long long scripts compatible with following options : tcpdump -ixenbr0 -s 400 -n -A 'port sip ...
0
votes
0answers
1k views

Capture all mysql requests/responses and caculate the response time using tcpdump

I need to capture all mysql requests/responses using tcpdump and after that need to find out which response related to which request in order to caculate the response time of each request. I used the ...
1
vote
1answer
1k views

centos doesn't reply to icmp request

I have the following situation: Centos7, 2 NIC with following setup: em2(NIC2) : 82.79.24.74/29 82.79.24.75/29 em3(NIC3) : 192.168.0.240/24 192.168.133.240/24 ...