Questions tagged [packet-capture]
Packet capture is the act of capturing data packets crossing a computer network. Packet capture can be: Deep packet capture (headers & payload), or partial packet capture (headers only).
173
questions
0
votes
1
answer
1k
views
How to filter wireshark capture to have only packets with local ip as source or destination
How to filter wireshark capture to have only packets with local ip as source or destination?
The expression should be valid for both ipv4 and ipv6.
I am obviously asking for an other solution than ...
1
vote
2
answers
2k
views
Block DNS query using pfctl
I am trying to create rule to allow DNS queries (port 53) to only 8.8.8.8 server (Google DNS). DNS queries to all other servers should not succeed.
I added the following lines to /etc/pf.conf file
...
- 11
0
votes
1
answer
377
views
how can i export sflow data to be saved in pcap on other server in realtime?
I have a pfsense server, all of attacks will come to its WAN interface. i have setup another packet analysis tool on private network behind pfsense. i want to send realtime WAN traffic from pfsense ...
- 4,309
1
vote
1
answer
858
views
Possible to dump sflow data to pcap format?
I want to get the packet capture from fortiet/fortigate device, to capture all traffic from it on one of its interface. For it i have enabled sflow and sent it to another ntopng server. but on ntopng ,...
- 4,309
1
vote
1
answer
4k
views
How to capture network packets that use SS7 protocol using Wireshark?
Since SS7 protocol stack is used in GSM mobile telephony network, we can't get the packets of SS7 protocols using Wireshark in Windows Computer and browsing in a web browser like Google chrome.
So ...
- 23
0
votes
0
answers
200
views
In the output of Chaosreader, where are the source and destination port numbers and IP addresses for each packet?
I used this tutorial to use Chaosreader on an output file of WinDump. My purpose was to get the HTTP payload, which I got. But I'd also like to extract other information, like source IP and ...
- 23
0
votes
1
answer
224
views
packet colorization in Wireshark
is there anyone who could sum up the packet colorization system in wireshark? My capture list is looking quite colourful, but I don't quite understand how the colorization scheme work.
Thank you
- 103
0
votes
1
answer
706
views
How to perform Wiresharks File->Extract Objects->HTTP through Tshark commandline interface?
Using TShark, I want to be able to extract the payload in HTTP response from packets data captured through tshark in a .pcap file.
In the Wireshark GUI, I was able to do that by File > Extract ...
- 23
0
votes
2
answers
2k
views
Why do some VLAN Wireshark captures include data after the IPv4 payload?
Data
Some Cloudshark captures show a "Trailer" for the vLAN and some do not.
Captures
With extra 4 bytes.
Without extra 4 bytes.
Question
Why do some and not all VLAN Wireshark captures include ...
- 101
6
votes
2
answers
5k
views
Can I use HAProxy's new 'capture' feature to save the remote address in a TCP frontend, and use it as the `X-Forwarded-For` header in an HTTP backend?
Using HAProxy 1.6 and a clever hack, I now have an HAProxy tcp mode frontend, that detects if the browser is capable of SNI, and based on that, routes to a strongly ciphered SSL termination backend, ...
- 402
4
votes
1
answer
425
views
Is there a way to "replay" a packet capture of a smtp session for the purpose of debugging?
I'm troubleshooting a smtp issue involving character-set encoding and it's extremely difficult to involve the end user. I have a packet capture of an incoming smtp session that results in problematic ...
- 12k
1
vote
1
answer
541
views
Figuring out the most efficient use of an ip range
I am working with Packet Tracer atm and have 3 subnet plans :
assigned(management(104users)
staff(43 users)
admin(35 users)).
I have an ip address range of:38.191.0.0 and subnet mask of 255.255....
- 35
1
vote
1
answer
790
views
Is there a quick way to determine what applications are present within a Wireshark capture? If so how
Is there a quick way to determine what applications are present within a Wireshark capture? If so how
As most captures contain over 10 thousand lines, I can't expect people would by hand check which ...
- 11
-2
votes
2
answers
124
views
Why do different packet analyzers sometimes produce different results?
I ran wireshark and windump at the same time. Both packet analyzers use the same winpcap library.
However after doing a row by row comparison of the results I noticed both every column between the 2 ...
- 1
0
votes
1
answer
900
views
Is it possible to specify tcpdump that I want it to interpret packet differently before printing it to STDOUT?
I am using iperf to pinpoint packet reordering issue. Unfortunately, tcpdump does not know how to parse iperf's UDP payload that I could use to pinpoint the issue. I know that iperf stores packet ...
- 113
0
votes
1
answer
6k
views
Why are ICMP packets not captured on the target interface?
I have a network setup as in the picture:
The central box is a gateway (Ubuntu 15.10) which relays the packets betwen the various networks (only one is shown on the picture - lan0) and Internet.
...
- 3,657
0
votes
1
answer
883
views
PCAP filter for first few packets, and packets related to disconnection, TCP-only
I'd like to use tcpdump with a filter for some long-running debugging. Specifically, I only want to capture packets with the following conditions:
First 10 packets or so of a new TCP connection (...
- 1,427
1
vote
1
answer
476
views
udp broadcast on port 25860
I used wireshark on my local network (to test it), and i noticed that there is a lot of udp packets send one broadcast, and the majority is coming from only one host. Theses udp packets are send on ...
- 141
0
votes
1
answer
451
views
PCAP traffic frame length short
I'm trying to make traffic and capture it using pcap file. I get pcap file from CAIDA(caida.org) site. This pcap file too big and doesn't have ethernet header. So i splitted pcap file to small size(40 ...
- 1
0
votes
0
answers
90
views
ICMP Packet Flood a local device over Wireless AP to figure out packet loss?
I'm using a utility to create an ICMP packet flood/attack called Hyanea since windows doesn't have native support like linux does.
I want to be able to test a new AP to see if any packet loss occurs....
- 113
1
vote
2
answers
19k
views
How to log all inbound connections on Windows server
I need to log a summary of all inbound TCP connections on a Windows 2008R2 server, but only including the Source IP, Source Port, Destination IP and Destination Port.
I do not want to log the payload ...
- 578
2
votes
1
answer
3k
views
Is it possible to run 2 concurrent tcpdump with different options?
I need to run 2 concurrent tcpdump commands with different arguments/options. Why ? Because we wrote some long long scripts compatible with following options :
tcpdump -ixenbr0 -s 400 -n -A 'port sip ...
0
votes
0
answers
2k
views
Capture all mysql requests/responses and caculate the response time using tcpdump
I need to capture all mysql requests/responses using tcpdump and after that need to find out which response related to which request in order to caculate the response time of each request.
I used the ...
1
vote
1
answer
2k
views
centos doesn't reply to icmp request
I have the following situation:
Centos7, 2 NIC with following setup:
em2(NIC2) :
82.79.24.74/29
82.79.24.75/29
em3(NIC3) :
192.168.0.240/24
192.168.133.240/24
...
4
votes
1
answer
4k
views
tcpdump freezes and not capturing properly without internet connection
When I don't have any internet conncetion and I want to capture network between local computers, tcpdump acts like this:
1.I start tcpdump using following command:
tcpdump -ixenbr0
2.After I run it,...
0
votes
1
answer
642
views
How to ping a host with different MTU size to simulate icmpv6 packet too big scenario?
As the Title states,I want to check whether my host will actually send a ICMPv6 packet too big if i send a packet with beyond the defined MTU size.I don't have a cisco router(extended ping) to try out ...
- 33
1
vote
1
answer
2k
views
server is not responding on SYN packets
On the attached tcp dump, the first two SYN packets (#21800 and 21801) came to the server, however SYN ACK was sent for the second SYN. Is that correct behaviour? My understanding is that the client ...
- 11
2
votes
1
answer
837
views
Suspicious IP packets on port 53
I have discovered a strange issue, and I hope someone can help me to fix it. If I'm capturing the ip packets on em1 network interface on port 53 with the "tcpdump -i em1 -vvv -s 0 -l -n port 53" ...
0
votes
3
answers
13k
views
user agent in http or https request
Is there any way that I can differentiate,
the HTTP or HTTPS packets are coming from browser or not ?
specially for https request.There is User-Agent field in packet in Http,but I could not found ...
- 211
1
vote
0
answers
182
views
Redirect Default Gateway Traffic in Linux to File
I am trying to troubleshoot one of my linux servers (ubuntu server). Therefore I want to intercept all traffic that is sent to the default gateway and then write it to a file: preferably some kind of ...
- 119
-1
votes
1
answer
854
views
Is it Possible to Capture All HTTP Packets to a Target IP on a subnet?
I've been trying to use tcpdump to capture packets to a target IP on my subnet, but am unable to do so successfully. I've tried:
tcpdump -i eth0 net network-ip-address/27 -A and tcp port 80
But it ...
- 1
0
votes
0
answers
361
views
Early tear down of communication
I have an application which performs an LDAP search which works in one domain but not in the other, when analyzing the packets sent between the application server and the domain controller being ...
- 147
0
votes
1
answer
3k
views
Analyzing twitter packets [closed]
Thanks for your time. I'd like to find a way if a client has made a 'GET' or a 'POST' request for twitter.
We are currently doing an educational project and we wanted to understand how we can achieve ...
- 111
-1
votes
1
answer
1k
views
Why is my chunked request removing the trailing CRLF?
I've just spent the past 10 hours trying to figure out why my http request was failing when I did a
request.Content.ReadAsMultipartAsync().Result.Contents
It kept returning the error:
Unexpected ...
- 169
-2
votes
1
answer
112
views
How many data packets does it take to log in to facebook? [closed]
I want to find out how many packets are sent when visiting a site on the web. What's a good program that would help me get this kind of data?
- 475
5
votes
3
answers
9k
views
Tcpdump on ec2 not seeing all packets
I'm running tcpdump on an Amazon EC2 instance to monitor HTTP traffic going to Nginx (this is just a test box, the only resource is the example test page).
Running tcpdump with the command
# ...
- 51
5
votes
2
answers
4k
views
Compressing the output of tshark when in multiple files mode
I'm running tshark to dump wireless traffic. I am currently running in multiple files mode, splitting output into 50MB chunks. Is there any way to also have these 50MB chunks compressed with something ...
7
votes
2
answers
13k
views
Linux NFLOG - documentation, configuration from C
Several different places (e.g. http://wiki.wireshark.org/CaptureSetup/NFLOG) recommend using Linux's "NFLOG" firewall module to capture packets generated by a particular UID, like this:
# iptables -A ...
- 1,365
0
votes
2
answers
4k
views
iperf udp sequence number wireshark
I'm using iperf for generating udp traffic and my objective is to measure paquet loss. I wanted to know if the first 4 Bytes of Iperf Data are currently the sequence number.
-1
votes
2
answers
2k
views
block all packets in windows 7 (so nothing appears in wireshark)? Can anything locally installed do it?
is it possible to block all packets in windows 7, so that nothing appears in wireshark?
I have tried choosing Block all for incoming.
for outgoing, I see it has no block all option, just a block ...
- 111
2
votes
1
answer
8k
views
TCP Sequence & Acknowledgment numbers
I have looked through other questions on here involving the relevant topics, but I am still not clear on this.
I have just been reading this explanation of TCP sequence & acknowledgment numbers.
...
- 145
1
vote
2
answers
2k
views
Wireshark seems to ignore my filters
I'm trying to make use of Wireshark 1.10.6 for Windows and I want to only capture the traffic to port 443 (to diagnose some weird HTTPS problems I'm having). So I open Capture -> Capture Filters... ...
- 2,739
1
vote
2
answers
1k
views
Can I capture ISP SNMP information with Wireshark?
I am trying to do some heavy digging into SNMP, BPI+, ISP networks. Since wireshark can be used to capture network data, would I be able to use it to remotely capture my ISP SNMP agent information and ...
- 113
5
votes
3
answers
7k
views
How can I create a packet capture file on a headless server for a single process?
I'm writing a python script on a headless server, and I'd like to see the packet capture output for the script.
I can't run ettercap or Wireshark on the server as there is too much other noise (...
- 389
2
votes
1
answer
4k
views
Strange Ethernet II packets in wireshark
Looking at a wireshark capture, I'm seeing something really strange. Ethernet II packets with random data are being sent on the network. The larger packets in the capture seem to contain bits and ...
- 23
3
votes
1
answer
336
views
Suggestions on how to capture network connections/traffic for determining browser/SSL versions?
Note that I posted this Q to the StackExchange InfoSec site, but its not as populated as ServerFault and this is more on the technical side of network collection for web services.
I've started ...
- 203
3
votes
2
answers
682
views
Linux Full Packet Capture
I’m looking to stand up a full packet capture solution on an Ubuntu server. Our maximum bandwidth is < 60Mb/s and the server has 10K hard drives.
Ideally, I’d like to be able to log everything ...
- 200
15
votes
1
answer
27k
views
Why is the "don't fragment" flag set in https and ssh protocols?
I've found a lot of information specifying that this is the case, however, I am really looking for the reason behind this. Why is it necessary? Is it necessary?
- 253
0
votes
1
answer
397
views
Network card capable of capturing a tonne of packets and not dropping them?
Edit:
Our server is trying to capture packets at between 500-600Mb/s, but is dropping packets 'due to kernel'.
Data is being written to SSDs, and isn't bottleneck there.
What things should I look ...
- 9
1
vote
1
answer
829
views
"tshark: There are no interfaces on which a capture can be done" in Amazon Linux AMI
My goal is to capture packets with tshark in Amazon Linux AMI. While typing tshark in the command line there's an error:
"tshark: There are no interfaces on which a capture can be done"
How to ...
- 157