Questions tagged [packet-sniffer]
Sniffer is another word for packet analyzer
97
questions
1
vote
0
answers
191
views
What is the key file for ssldump?
I search google for a tool to decode https traffic and get the ssldump with examples like:
ssldump -k xxx.pem -i eth0 -d host example.com
I wonder what the key file xxx.pem is. On the server hosting ...
1
vote
0
answers
47
views
Ifconfig result on the server running PF_RING with zerocopy
I have an application which uses PF_Ring zero copy as a part of its packet sniffing capability. When this application is running would it be possible to find out the amount of RX/TX traffic using ...
0
votes
0
answers
136
views
Traffic capture at boot
I'm trying to figure out what packets a linux host sends at boot in order to debug it.
Is there a way to start packet capture during boot time to not miss any packets?
What is your way of going about ...
0
votes
0
answers
362
views
How to identify application that is generating ICMP echo requests on Windows 10?
My company security team has informed me that my workstation is pinging some "blacklisted" IP addresses. The enterprise security tool reporting this information sits in place of the usual ...
0
votes
0
answers
39
views
Can't track applications network communication under same machine
I have a network application environment of 7 applications communicating with eachother through UDP and TCP. All of them using either the machine's local network IP or 127.0.0.1 (localhost) to listen ...
1
vote
2
answers
9k
views
How to decrypt TLS traffic with Wireshark using RSA asynchronous encryption?
I want to be able to capture and decrypt TLS traffic that one off my internal application (that I don't have access) makes to the internet. (For testing I am using Postman to create a request to a ...
0
votes
0
answers
379
views
Error during execution of Packet Sniffing command
Step1:
I have shifted my mode to Monitor and also checked by executing the following command in terminal
iwconfig
I got the result as
lo no wireless extensions.
ethos no wireless extensions.
...
1
vote
1
answer
319
views
Can user credentials from HTTP session be seen through Wireshark? [duplicate]
Can we get that info the same way we do for FTP since HTTP is a plain text protocol?
2
votes
1
answer
1k
views
Analyzing traffic by tcpdump between HAProxy server and mariadb
I was testing tcpdump too see the traffic between HAProxy server and mariadb server. These are the results:
23:07:22.328958 00:0c:29:a9:28:a8 > 00:50:56:b0:e0:ea, ethertype IPv4 (0x0800), length ...
1
vote
0
answers
3k
views
Can I capture full TCP packet content with haproxy without knowing length of the packet?
I know I can capture 6 bytes length packet using this config:
global
log /dev/log local0 debug
log /dev/log local1 notice
chroot /var/lib/haproxy
stats socket /...
1
vote
1
answer
417
views
Is a two-way communication possible over a mirror port?
I have a network like this:
Server -- Router -- PCs
I'd like to add a Raspberry to it so that it receives all packets sent from the Server to any PC, analyzes them, and sometimes it also sends some ...
0
votes
1
answer
628
views
Can GCP do port mirroring at the subnet level?
Can I define a custom network in Google Cloud Platform in such a way so that I can get the equivalent behavior of Port Mirroring in my VPC as one would configure on a hardware switch?
The goal is to ...
0
votes
1
answer
681
views
Is it possible to sniff packets on KVM guest loopback interface from host?
I am trying to debug network communication which happens inside CentOS 7 KVM guest. This communication goes from localhost to localhost. I suppose, that all this traffic happens on local lo interface. ...
2
votes
2
answers
2k
views
Monitor where an application is connecting to on MacOSX
I just downloaded wireshark for mac as I am trying to find out exactly where an app is connecting. I need to see the URL and the protocol whether it is https or http.
I am very new to Wireshark and ...
0
votes
0
answers
423
views
Taking tcpdump of data transmitting through tunnel
I have a service provider, who provides connection to his SMPP server only through a VPN. We setup a tunnel to connect to his VPN.
Now there are some issues with the connectivity and I need to check ...
0
votes
2
answers
79
views
Analyzing HTTP traffic [closed]
I am trying to solve the problem for a while and i couldn't find a proper answer online. I have a file with mobile traffic (from an Android device) and I am trying to check whether an http request is ...
1
vote
0
answers
436
views
Netsh trace vs PEF trace cmdlets vs NetEvent cmdlets
I am playing with capturing my network traffic and came across two different MS commandline tools that allow doing this:
a well-known netsh tool, recently equipped with powerful capture switch
a ...
2
votes
2
answers
2k
views
Process names in MS Message Analyzer
I am trying to set up the Message Analyzer viewer exactly like it is explained in this reference, but instead of steady process names I got some weird numbers, both in ProcessName and ProcessID ...
0
votes
1
answer
411
views
Packet Sniffer to dynamically create iptables rules
On a router running unix I wish to make monitor all outgoing packets, of these packets I want to temporarily white list IP addresses I am connecting to, to both send and receive.
Basically to create ...
0
votes
0
answers
184
views
In the output of Chaosreader, where are the source and destination port numbers and IP addresses for each packet?
I used this tutorial to use Chaosreader on an output file of WinDump. My purpose was to get the HTTP payload, which I got. But I'd also like to extract other information, like source IP and ...
1
vote
1
answer
106
views
Protecting wired LAN from packet sniffers
How one encrypts traffic in wired LAN segment?
Can IPv6 in combination with IPSec be configured for IKE/ISAKMP authentication?
OR
Will I drown in configuring appropriate IKE host-to-host rules for ...
1
vote
1
answer
184
views
Is there a quick way to determine what applications are present within a Wireshark capture? If so how
Is there a quick way to determine what applications are present within a Wireshark capture? If so how
As most captures contain over 10 thousand lines, I can't expect people would by hand check which ...
-2
votes
2
answers
114
views
Why do different packet analyzers sometimes produce different results?
I ran wireshark and windump at the same time. Both packet analyzers use the same winpcap library.
However after doing a row by row comparison of the results I noticed both every column between the 2 ...
0
votes
1
answer
787
views
PCAP filter for first few packets, and packets related to disconnection, TCP-only
I'd like to use tcpdump with a filter for some long-running debugging. Specifically, I only want to capture packets with the following conditions:
First 10 packets or so of a new TCP connection (...
5
votes
1
answer
15k
views
How to check if promiscuous mode is enabled on network interface in windows server 2012 R2
I'm working with basic windump commands. After I close the windump, my pc is slowly and cpu range is high. How to check if promiscuous mode is enabled on network interface in windows server 2012 R2.
1
vote
0
answers
108
views
Microsoft Message Analyzer and Windows Advanced Firewall ipsec tunnel packet sniffing
I am trying to view connections or attempted connections in windows advanced firewall. I have tried using the Windows Firewall Service provider however the trace does not return anything. Any ideas?
1
vote
0
answers
119
views
Corrupted files when downloading with HTTP
With my UMTS connection most archives > 50 MB are corrupted when downloading them via HTTP. If I switch to HTTPS the problem is gone. The problem should not reside in my network, because I have an ...
1
vote
1
answer
21k
views
How i can dump raw packets from an existing tcp socket using tcpdump on Mac and Linux? [closed]
Once I know the IP address and port number combo, I can run this to see some of the packets:
tcpdump | grep [IPADDRESS]
Anybody know how I can now see the raw packets too?
Thanks!
0
votes
0
answers
3k
views
Port Mirroring on Wireless router
I will be going on site to help hotel manager to identify who is using P2P (torrents) in hotel and abusing network usage for other guests.
Easy option would be
1. Port Mirroring on wireless router ...
0
votes
1
answer
806
views
How to monitor if someone is using wireshark in my corporate network
I would like to know if it's possible to monitor if any users are using a network sniffer like Wireshark in my corporate network?.
0
votes
1
answer
3k
views
Analyzing twitter packets [closed]
Thanks for your time. I'd like to find a way if a client has made a 'GET' or a 'POST' request for twitter.
We are currently doing an educational project and we wanted to understand how we can achieve ...
0
votes
3
answers
237
views
Is there some free remote sniffer (aka sniffer on free remote server)? [closed]
I have this setup:
________Company LAN_______
_________ . '| _________
| | .| BUNCH OF | ...
0
votes
1
answer
1k
views
Port Mirroring to Mac Thunderbolt Ethernet [closed]
I have a switch with port mirroring enabled. So one port is the source port, and the other is the mirror port.
In the source port, I have a wifi router plugged in.
The mirror port is connected to ...
5
votes
3
answers
8k
views
Tcpdump on ec2 not seeing all packets
I'm running tcpdump on an Amazon EC2 instance to monitor HTTP traffic going to Nginx (this is just a test box, the only resource is the example test page).
Running tcpdump with the command
# ...
-4
votes
1
answer
1k
views
how to sniff from a remote machine? [closed]
I have a PC and a tablet that connected to a TP-Link ADSL modem.
PROBLEM:
I want to see the packets that send and receive from my modem not my PC( to see both wire and wireless packets)
I search ...
0
votes
2
answers
309
views
Firewall/Packet Sniffer - forward HTTP requests to a different address
I have a particularly "hacky" question/solution and looking for some honest feedback.
In an enterprise system there are a number of requests that are destined for www.sometargeturl.com. These need ...
0
votes
0
answers
147
views
View historical data per IP with PRTG packet sniffer
I have recently set up PRTG's packet sniffer sensor for bandwidth monitoring. I am able to pull up historical data in 15 minute increments and see who was the highest user but I would like to see ...
2
votes
1
answer
607
views
How easy is it to sniff the SMTP port of webserver to capture mails
I've got a very basic question that I don't know the answer for.
Our company owns a webserver that runs multiple websites and works as a mail server for these websites as well (e.g. to send contact ...
1
vote
5
answers
240
views
how to identify IP address on eth0 when console isn’t available
I need help about the following
I have very old Linux server with one IP address, unfortunately I can’t to access to Linux machine VIA console and I not remember the IP address
So I now thinking ...
1
vote
0
answers
1k
views
why do I lose ping to a machine when using port mirroring / monitoring (sniffing)?
I am using port mirroring / monitoring in my 3COM layer 3 switches to look at network traffic (using wireshark).
Sometimes, I have found that I loose connectivity with the remote monitor machine (...
2
votes
1
answer
3k
views
Mirror network packets from WiFi to Ethernet in an ASUS Router RT N53
I have an ASUS RT N53 router, running the default firmware (Linux 2.6.22 with busybox and uclibc). I need to capture data packets from some Wi-Fi devices I have connected to that router (iPad and some ...
0
votes
3
answers
4k
views
How to sniff all HTTP packets on a wifi network? [closed]
I need to sniff all HTTP packets that pass through my wifi network (in particular HTTP requests by my smartphone). I've tried with wireshark, but I can sniff only packets to and from my pc. What am I ...
0
votes
1
answer
789
views
Meraki VPN Traffic Capture
We have multiple offices interconnected via VPN using Meraki switches. I've been looking around and can't seem to find a way, but was thinking it's possible. Is it possible for me to put my desktop on ...
3
votes
3
answers
878
views
What are cables/boxes called for listening in on a RJ45 cable?
I would like to capture the traffic from a router, so I assume there must exist a cable or hardware box with 3 RJ45 socks, where two of them are IN and OUT, and the third is for capturing device (a ...
2
votes
3
answers
13k
views
How can I log OpenVPN packet contents?
I'm designing a developer tool that would analyse and debug arbitrary network connections, but I want to provide it as a service rather than software to be installed locally.
Ideally I would like to ...
2
votes
2
answers
394
views
What to use to get meaningful network statistics
A customer has a rack with some 1U servers and Dell™ PowerConnect™ 2716 switch at ISP's server room. One port is uplink to the ISP. Some servers run ESX5 while one 1U server is a plain Windows 2008 R2 ...
0
votes
1
answer
701
views
Log http data in unique files using tcpick
I'm trying to use tcpick to log http data in unique files (client and server mixed together). This is one of the examples from tcpick's man page:
$ tcpick -i eth0 "port 80" -wRub
I expected this to ...
4
votes
3
answers
3k
views
Can our firewall detect traffic sniffing inside the network?
We use Cisco ASA's firewall and NAT functions in our network (200 computers).
Is there any possibility to configure Cisco ASA to detect traffic sniffering (for example wireshark) and network ...
4
votes
2
answers
2k
views
tcpdump file size == traffic size?
I created a tcpdump file:
tcpdump -i eth0 host xxx.208.xxx.59 -n -s 0 -vvv -w /tmp/dump.dmp
duration was about 3 hours.
This file now has 450 MB. Can I say now that the IP xxx.208.xxx.59 generated ...
8
votes
2
answers
9k
views
Sniff SSL handshake using tshark
How do I get a dump of a SSL handshake in a human readable format using tshark? I need to provide this to a vendor for debugging a failed SSL handshake problem.
This needs to be done in tshark, not ...