Questions tagged [packet-sniffer]

Sniffer is another word for packet analyzer

1
vote
1answer
40 views

Can user credentials from HTTP session be seen through Wireshark? [duplicate]

Can we get that info the same way we do for FTP since HTTP is a plain text protocol?
1
vote
1answer
89 views

Analyzing traffic by tcpdump between HAProxy server and mariadb

I was testing tcpdump too see the traffic between HAProxy server and mariadb server. These are the results: 23:07:22.328958 00:0c:29:a9:28:a8 > 00:50:56:b0:e0:ea, ethertype IPv4 (0x0800), length ...
0
votes
0answers
233 views

Can I capture full TCP packet content with haproxy without knowing length of the packet?

I know I can capture 6 bytes length packet using this config: global log /dev/log local0 debug log /dev/log local1 notice chroot /var/lib/haproxy stats socket /...
1
vote
1answer
65 views

Is a two-way communication possible over a mirror port?

I have a network like this: Server -- Router -- PCs I'd like to add a Raspberry to it so that it receives all packets sent from the Server to any PC, analyzes them, and sometimes it also sends some ...
0
votes
1answer
203 views

Can GCP do port mirroring at the subnet level?

Can I define a custom network in Google Cloud Platform in such a way so that I can get the equivalent behavior of Port Mirroring in my VPC as one would configure on a hardware switch? The goal is to ...
0
votes
1answer
190 views

Is it possible to sniff packets on KVM guest loopback interface from host?

I am trying to debug network communication which happens inside CentOS 7 KVM guest. This communication goes from localhost to localhost. I suppose, that all this traffic happens on local lo interface. ...
2
votes
2answers
195 views

Monitor where an application is connecting to on MacOSX

I just downloaded wireshark for mac as I am trying to find out exactly where an app is connecting. I need to see the URL and the protocol whether it is https or http. I am very new to Wireshark and ...
0
votes
0answers
150 views

Taking tcpdump of data transmitting through tunnel

I have a service provider, who provides connection to his SMPP server only through a VPN. We setup a tunnel to connect to his VPN. Now there are some issues with the connectivity and I need to check ...
0
votes
2answers
69 views

Analyzing HTTP traffic [closed]

I am trying to solve the problem for a while and i couldn't find a proper answer online. I have a file with mobile traffic (from an Android device) and I am trying to check whether an http request is ...
1
vote
0answers
329 views

Netsh trace vs PEF trace cmdlets vs NetEvent cmdlets

I am playing with capturing my network traffic and came across two different MS commandline tools that allow doing this: a well-known netsh tool, recently equipped with powerful capture switch a ...
2
votes
2answers
973 views

Process names in MS Message Analyzer

I am trying to set up the Message Analyzer viewer exactly like it is explained in this reference, but instead of steady process names I got some weird numbers, both in ProcessName and ProcessID ...
0
votes
1answer
260 views

Packet Sniffer to dynamically create iptables rules

On a router running unix I wish to make monitor all outgoing packets, of these packets I want to temporarily white list IP addresses I am connecting to, to both send and receive. Basically to create ...
0
votes
0answers
124 views

In the output of Chaosreader, where are the source and destination port numbers and IP addresses for each packet?

I used this tutorial to use Chaosreader on an output file of WinDump. My purpose was to get the HTTP payload, which I got. But I'd also like to extract other information, like source IP and ...
1
vote
1answer
76 views

Protecting wired LAN from packet sniffers

How one encrypts traffic in wired LAN segment? Can IPv6 in combination with IPSec be configured for IKE/ISAKMP authentication? OR Will I drown in configuring appropriate IKE host-to-host rules for ...
1
vote
1answer
45 views

Is there a quick way to determine what applications are present within a Wireshark capture? If so how

Is there a quick way to determine what applications are present within a Wireshark capture? If so how As most captures contain over 10 thousand lines, I can't expect people would by hand check which ...
-2
votes
2answers
102 views

Why do different packet analyzers sometimes produce different results?

I ran wireshark and windump at the same time. Both packet analyzers use the same winpcap library. However after doing a row by row comparison of the results I noticed both every column between the 2 ...
0
votes
1answer
377 views

PCAP filter for first few packets, and packets related to disconnection, TCP-only

I'd like to use tcpdump with a filter for some long-running debugging. Specifically, I only want to capture packets with the following conditions: First 10 packets or so of a new TCP connection (...
2
votes
1answer
9k views

How to check if promiscuous mode is enabled on network interface in windows server 2012 R2

I'm working with basic windump commands. After I close the windump, my pc is slowly and cpu range is high. How to check if promiscuous mode is enabled on network interface in windows server 2012 R2.
1
vote
0answers
99 views

Microsoft Message Analyzer and Windows Advanced Firewall ipsec tunnel packet sniffing

I am trying to view connections or attempted connections in windows advanced firewall. I have tried using the Windows Firewall Service provider however the trace does not return anything. Any ideas?
1
vote
0answers
114 views

Corrupted files when downloading with HTTP

With my UMTS connection most archives > 50 MB are corrupted when downloading them via HTTP. If I switch to HTTPS the problem is gone. The problem should not reside in my network, because I have an ...
-1
votes
1answer
9k views

How i can dump raw packets from an existing tcp socket using tcpdump on Mac and Linux? [closed]

Once I know the IP address and port number combo, I can run this to see some of the packets: tcpdump | grep [IPADDRESS] Anybody know how I can now see the raw packets too? Thanks!
0
votes
0answers
2k views

Port Mirroring on Wireless router

I will be going on site to help hotel manager to identify who is using P2P (torrents) in hotel and abusing network usage for other guests. Easy option would be 1. Port Mirroring on wireless router ...
0
votes
1answer
476 views

How to monitor if someone is using wireshark in my corporate network

I would like to know if it's possible to monitor if any users are using a network sniffer like Wireshark in my corporate network?.
-1
votes
1answer
2k views

Analyzing twitter packets [closed]

Thanks for your time. I'd like to find a way if a client has made a 'GET' or a 'POST' request for twitter. We are currently doing an educational project and we wanted to understand how we can achieve ...
0
votes
3answers
111 views

Is there some free remote sniffer (aka sniffer on free remote server)? [closed]

I have this setup: ________Company LAN_______ _________ . '| _________ | | .| BUNCH OF | ...
0
votes
1answer
633 views

Port Mirroring to Mac Thunderbolt Ethernet [closed]

I have a switch with port mirroring enabled. So one port is the source port, and the other is the mirror port. In the source port, I have a wifi router plugged in. The mirror port is connected to ...
5
votes
3answers
3k views

Tcpdump on ec2 not seeing all packets

I'm running tcpdump on an Amazon EC2 instance to monitor HTTP traffic going to Nginx (this is just a test box, the only resource is the example test page). Running tcpdump with the command # ...
-4
votes
1answer
868 views

how to sniff from a remote machine? [closed]

I have a PC and a tablet that connected to a TP-Link ADSL modem. PROBLEM: I want to see the packets that send and receive from my modem not my PC( to see both wire and wireless packets) I search ...
0
votes
2answers
247 views

Firewall/Packet Sniffer - forward HTTP requests to a different address

I have a particularly "hacky" question/solution and looking for some honest feedback. In an enterprise system there are a number of requests that are destined for www.sometargeturl.com. These need ...
0
votes
0answers
141 views

View historical data per IP with PRTG packet sniffer

I have recently set up PRTG's packet sniffer sensor for bandwidth monitoring. I am able to pull up historical data in 15 minute increments and see who was the highest user but I would like to see ...
2
votes
1answer
206 views

How easy is it to sniff the SMTP port of webserver to capture mails

I've got a very basic question that I don't know the answer for. Our company owns a webserver that runs multiple websites and works as a mail server for these websites as well (e.g. to send contact ...
1
vote
5answers
166 views

how to identify IP address on eth0 when console isn’t available

I need help about the following I have very old Linux server with one IP address, unfortunately I can’t to access to Linux machine VIA console and I not remember the IP address So I now thinking ...
1
vote
0answers
1k views

why do I lose ping to a machine when using port mirroring / monitoring (sniffing)?

I am using port mirroring / monitoring in my 3COM layer 3 switches to look at network traffic (using wireshark). Sometimes, I have found that I loose connectivity with the remote monitor machine (...
1
vote
1answer
2k views

Mirror network packets from WiFi to Ethernet in an ASUS Router RT N53

I have an ASUS RT N53 router, running the default firmware (Linux 2.6.22 with busybox and uclibc). I need to capture data packets from some Wi-Fi devices I have connected to that router (iPad and some ...
0
votes
3answers
3k views

How to sniff all HTTP packets on a wifi network? [closed]

I need to sniff all HTTP packets that pass through my wifi network (in particular HTTP requests by my smartphone). I've tried with wireshark, but I can sniff only packets to and from my pc. What am I ...
0
votes
1answer
479 views

Meraki VPN Traffic Capture

We have multiple offices interconnected via VPN using Meraki switches. I've been looking around and can't seem to find a way, but was thinking it's possible. Is it possible for me to put my desktop on ...
3
votes
3answers
804 views

What are cables/boxes called for listening in on a RJ45 cable?

I would like to capture the traffic from a router, so I assume there must exist a cable or hardware box with 3 RJ45 socks, where two of them are IN and OUT, and the third is for capturing device (a ...
2
votes
3answers
7k views

How can I log OpenVPN packet contents?

I'm designing a developer tool that would analyse and debug arbitrary network connections, but I want to provide it as a service rather than software to be installed locally. Ideally I would like to ...
2
votes
2answers
389 views

What to use to get meaningful network statistics

A customer has a rack with some 1U servers and Dell™ PowerConnect™ 2716 switch at ISP's server room. One port is uplink to the ISP. Some servers run ESX5 while one 1U server is a plain Windows 2008 R2 ...
0
votes
1answer
550 views

Log http data in unique files using tcpick

I'm trying to use tcpick to log http data in unique files (client and server mixed together). This is one of the examples from tcpick's man page: $ tcpick -i eth0 "port 80" -wRub I expected this to ...
4
votes
3answers
2k views

Can our firewall detect traffic sniffing inside the network?

We use Cisco ASA's firewall and NAT functions in our network (200 computers). Is there any possibility to configure Cisco ASA to detect traffic sniffering (for example wireshark) and network ...
3
votes
2answers
1k views

tcpdump file size == traffic size?

I created a tcpdump file: tcpdump -i eth0 host xxx.208.xxx.59 -n -s 0 -vvv -w /tmp/dump.dmp duration was about 3 hours. This file now has 450 MB. Can I say now that the IP xxx.208.xxx.59 generated ...
7
votes
2answers
5k views

Sniff SSL handshake using tshark

How do I get a dump of a SSL handshake in a human readable format using tshark? I need to provide this to a vendor for debugging a failed SSL handshake problem. This needs to be done in tshark, not ...
1
vote
4answers
3k views

Sniffing packets of specific binaries / apps / process id?

Is there a way to associate packets with executing binaries? I would be open to traditional sniffing methods or even dtrace for that matter. I have a specific issue on a system with very high ...
-5
votes
1answer
83 views

keystroke logger [closed]

I have just started a networking module in college and am really interested in this area, and would like to continue in this career path. I have tried to get an answer from my lecturer but she cant ...
1
vote
1answer
2k views

OpenVPN client “reboot loop”, but still working slowly

I have a personal OpenVPN server out on "the tubes". Last week, I was able to connect without incident and with very good performance. This week, when I manage to connect, the client seems to enter a "...
0
votes
1answer
619 views

How to sniff udp between two windows applications on the same machine

How do I monitor the duplex udp traffic between two apps on my windows machine.
1
vote
1answer
857 views

PCAP to Syslog utility

I am looking for a tool which sniff all the traffic on an interface and produce a syslog like Cisco log in real time. Example : Feb 16 10:19:05 tcp S.S.S.S(6083) -> D.D.D.D(80), 1 packet Feb 16 10:...
2
votes
2answers
127 views

Capturing wireless packets on my wireless network

Is it possible to capture wireless packets on my wireless network using sniffers (ie. wireshark)? If so, could you give links that can guide me to do this?
4
votes
4answers
713 views

Capture network traffic of a single application?

I am looking for a method / hack / kernel module to capture network traffic of a PID and all it's forks / child processes. I have a firefox applications that opens some web pages and starts to stream ...