Questions tagged [pcap]
PCAP stands for Packet CAPture.
81
questions
0
votes
0
answers
60
views
Getting duplicated packets when replaying pcap files
The issue at hand is I have pcap files that I want to replay over a network. I used to use playcap to do this with no issue, however recently I noticed that playcap is sending each packet from the ...
- 1
0
votes
0
answers
57
views
What is the fastest way to isolate when VLAN tagging in enabled when it should not be?
I have run into this issue several times over the years:
a Linux server is not configured for VLAN tagging
It is connected to a switch that has 802.1q VLAN tagging on traffic going into the server.
...
- 124
0
votes
1
answer
1k
views
Linux: bridge vs. vlan vs. tcpdump
I have a Proxmox host with kernel 5.15.19-2-pve.
It has a bond0 interface made from eth2 and eth3, which receives vlan tagged traffic.
I created a vmbr666 bridge that shows looks like this:
# /etc/...
- 651
2
votes
1
answer
1k
views
Extracting TCP application data from pcap file
Given a .pcap (or similar) file, I'd like to select one TCP connection and dump both application data streams (the one from the other peer and the one two the other peer) into two separate files on ...
- 193
0
votes
1
answer
132
views
Can I determine a EWOULDBLOCK/EAGAIN situation from a pcap/tcpdump
Is there a way I can determine if a certain message resulted in an EWOULDBLOCK/EAGAIN return code to the server which sent the packet?
The server was sending messages to the client
At time 10,the ...
- 133
1
vote
1
answer
135
views
How to split pcap per IRC channels
I wonder if there is a way how to split a pcap that contains (only) IRC per channels. I'm trying to compare accuracy of botnet detection in channels using existing IDS (suricata, snort). The only way ...
- 113
0
votes
1
answer
489
views
Pcap (tcpdump) filter to match against local port
I'm trying to write a libpcap (tcpdump, iftop) filter that would match packets having a specific local port.
That is, I'm interested in traffic that either goes out of port 12345 on the local machine ...
- 134
-1
votes
1
answer
626
views
SSH connection not established, but standard TCP/IP connection works
I'm working on a custom yocto Linux for a Raspberry PI 3 and try to get the WIFI connection working with SSH. However when trying to connect from my PC (Ubuntu 19.10, SSH OpenSSH_8.0p1 Ubuntu-6build1, ...
- 1
1
vote
0
answers
122
views
How can I capture traffic for a daemon listening on a cloned loopback IP address?
I have a daemon listening on a virtual IP address attached to a cloned loopback interface (lo1) on FreeBSD 11.x.
Inbound traffic for that daemon could arrive on several different physical interfaces, ...
- 21.1k
1
vote
0
answers
3k
views
How do i convert text capture files back to pcap files?
I have opened Wireshark, selected the a.pcap file, and then went to File->Export and chose (K12 text file) to convert to text. Result is a.txt file.
How can I convert back a.txt file to original pcap ...
- 111
0
votes
1
answer
757
views
Retrieve data from wireshark (PCAPNG)
I have a PCAPNG file and I need to retrieve two files from it, one is a TXT and the other one is a PNG. The provided file does not have FTP-DATA, it only have ARP, DHCP, DNS, FTP, HTTP, IGMPv3, OCSP, ...
0
votes
1
answer
377
views
Are TCP RTO value and RTT value influenced by the packet size?
I am doing troubleshooting in my network.
I found some re-transmission by using wireshark.
The segment 1400 bytes are well transmitted but
The segment 800 bytes are lost and re-transmitted.
I know ...
- 29
1
vote
2
answers
768
views
I have a loopback traffic in linux involving port 631 and I have no idea what is causing it
So I did some packet capturing in my networking and everything else is actually fine except for this weird communication where source and destination is literally 127.0.0.1, source port is 631, and ...
- 13
2
votes
0
answers
194
views
disabling ethernet loopback packets
I have a linux machine with a few network interfaces which I use to run communication tests. In some of the tests I get a lot of packets with ether type 0x9000 (ethernet configuration testing protocol)...
- 141
0
votes
1
answer
630
views
Capture packets on loopback
I'm running web service on my windows 10 machine. I decided to look at the packets between my service and client running on the same machine by using Wireshark. I know that it is not possible to get ...
- 99
5
votes
4
answers
8k
views
How can i see packets while capturing with tcpdump
How can I see traffic while I am capturing it with tcpdump.
When I use -w, it doesn't show the packets during the capture.
sudo tcpdump -i enp2s0 -w test.pcap
tcpdump: listening on enp2s0, link-type ...
- 261
-5
votes
1
answer
74
views
Serializing pcap file into 4B chunks [closed]
Given a previously generated pcap file, how do I serialize the data into 4B (or N byte) chunks. The format/protocol of the pcap data is not relevant here.
2
votes
1
answer
2k
views
Wireshark under Windows: Any way to capture packets before dropped by special filter drivers?
I've got some GigabitEthernet Vision cameras, which use Ethernet to communicate. The protocol is simple UDP, but for performance reasons (high packet throughput causing CPU load) the manufacturer uses ...
- 385
3
votes
1
answer
4k
views
How can I export more than 1000 http request bodies from a large pcap file?
I have a pcap file (~2.3G) containing HTTP requests. I need to extract the body of each request in some way that I can further process it. Each request in its own file would work well, but I can be ...
- 810
1
vote
3
answers
4k
views
(internal) Packet capture in a google cloud VPC network?
I have a VPC network set up in google cloud with a few instances running. One of these instances serves as a VPN machine, allowing me to interact with the instances from the internet.
I want to ...
google-cloud-platform
1
vote
0
answers
76
views
Slow VPN performance - TCP Issue?
I am having issues with the performance of a VPN, it is just one VPN in particular and I have captured the following PCAP from the server in question.
My understanding is that the "Ack" field should ...
- 149
1
vote
1
answer
2k
views
Replaying pcap file for Snort
I currently have the following, presumably standard, setup:
I have a physical server with Snort running. Snort logs into its log files as it should. Those files are tracked by barnyard2 which writes ...
- 121
0
votes
1
answer
193
views
Filter pcap by subsecond detail?
I'm trying to export a subset of a pcap file given a start and an end message, this start and end message identification is currently done using ngrep on the raw data(because we have no dissector for ...
- 113
2
votes
0
answers
529
views
Modify ip addresses in a socks capture pcap
I have a pcap capture of socks traffic. The traffic goes like -
client_ip <-> 127.0.0.1:9050 <-> destination_ip
Looking at pcap in wireshark, thus, shows:
src_ip = 127.0.0.1
dst_ip = ...
- 121
0
votes
2
answers
930
views
Packet fragmentation confusion
I was playing around with dpkt in Python, trying to decode PPPoE - and the program was working just fine, till I noticed that the Offset in the encapsulation IP packets was always 0, even with clearly ...
- 103
0
votes
1
answer
490
views
ngrep output format clarification
I am trying to debug a connection that has been appearing in my environment from an unknown server.
I want to find a PID if it is associated with one. Tried "netstat -anp" but it doesn't find ...
- 2,578
0
votes
1
answer
334
views
how can i export sflow data to be saved in pcap on other server in realtime?
I have a pfsense server, all of attacks will come to its WAN interface. i have setup another packet analysis tool on private network behind pfsense. i want to send realtime WAN traffic from pfsense ...
- 4,279
0
votes
0
answers
161
views
http timing stats from tcp trace
I am trying to find a tool to extract HTTP timing stats from network traces; namely time to connect, time to first byte, total time to serve.I am talking about very large traces with millions of ...
- 1
1
vote
1
answer
783
views
Possible to dump sflow data to pcap format?
I want to get the packet capture from fortiet/fortigate device, to capture all traffic from it on one of its interface. For it i have enabled sflow and sent it to another ntopng server. but on ntopng ,...
- 4,279
2
votes
1
answer
774
views
Allowing node.js applications to run libpcap without sudo ("Symlink" issue )
I want to use the following command to allow usage of the libpcap package without to sudo (on a debian system):
sudo setcap 'CAP_NET_RAW+eip CAP_NET_ADMIN+eip' /usr/bin/nodejs
I'm getting this error:...
- 121
0
votes
1
answer
3k
views
Mirror traffic to tcpdump server and automatically save pcaps
Looking to port mirror a network firewall interface, connect that interface to a Linux server, and have that Linux server constantly run a tcpdump and storing the output in files.
Specifically, my ...
- 1,063
1
vote
1
answer
595
views
Search all pcap files in a folder and sub-folders for a certain condition
I have a folder (containing many sub-folders) full of pcap files and I'd like to get all pcap files containing packets that match a certain condition, for example "have source IP 1.1.1.1". Do you know ...
0
votes
2
answers
922
views
Unable to install pcapsipdump
I'm trying to install pcapsipdump but I get the error below when I try to make. libpcab and libpcap-devel are installed, which I did via "yum install libpcap libpcap-devel". I'm currently stuck on how ...
- 173
0
votes
1
answer
786
views
PCAP filter for first few packets, and packets related to disconnection, TCP-only
I'd like to use tcpdump with a filter for some long-running debugging. Specifically, I only want to capture packets with the following conditions:
First 10 packets or so of a new TCP connection (...
- 1,389
0
votes
1
answer
409
views
PCAP traffic frame length short
I'm trying to make traffic and capture it using pcap file. I get pcap file from CAIDA(caida.org) site. This pcap file too big and doesn't have ethernet header. So i splitted pcap file to small size(40 ...
- 1
6
votes
3
answers
9k
views
How would a PCAP filter look like to capture all DHCP related traffic?
As I understand it, for IPv4 I would need to capture
UDP port 67 and 68,
ARP,
ICMP echo request and reply,
and for IPv6 I would need
UDP port 546 and 547,
all DHCP-related multicast addresses,
...
- 417
1
vote
1
answer
3k
views
How to efficiently re-order packets in PCAP files based on timestamp?
I have a PCAP file which contains many packets. They are however out of order based on the timestamp (it is actually randomized). What is the best way to efficiently sort the PCAP packets based on ...
- 155
0
votes
1
answer
104
views
MCU packet capture
I am trying to do a packet capture of a video conference hosted with CISCO [Codian] MCU. The instructions for capturing SIP packets with Wireshark are available. I also configured MCU to accept SIP ...
- 207
0
votes
1
answer
705
views
PCap filter by IP not filtering out 0.0.0.0
I have my PCap filter set to "dst net 10.36.95.0 mask 255.255.255.0". This works in that it filters out most traffic with a destination outside of the 10.36.95.0/24 subnet, the exception being that it ...
- 95
0
votes
1
answer
2k
views
how to determine client side or server side retransmission from a pcap
I am trying to get some clarification on something I read here:
how to calculate packet loss from a binary TCPDUMP file
The first answer says that the sequence number will be the same from client to ...
- 629
2
votes
2
answers
6k
views
How to use tshark or tcpdump to calculate bytes transmitted
I am using this command with tshark:
tshark -r pcapfile "tcp and ip.src==192.168.1.1" -T text -V -x | grep 'Total Length'
This essentially parses the pcap for only connections from the source ip and ...
- 629
0
votes
2
answers
11k
views
Why am I not getting an ARP reply with this request?
Using pcap_sendpacket in C, I'm manually sending the following packet on wlan0 (I've left out some fields, but I think they are correct):
(Ethernet layer)
eth src: <wlan0 MAC address>
eth dest:...
- 136
0
votes
1
answer
249
views
Extract nth Packet From a Pacp File
Is there any command line tool to extract the n th packet from a pcap file?
I am on CentOS 6.5.
Thanks in advance.
- 175
9
votes
2
answers
15k
views
Packet captures: filtering on RX vs TX
I have a network problem where frames with a source MAC which matches with one of my host's source MACs are arriving at the host - an apparent duplicate MAC, or loop, or other L2 problem.
I believe ...
- 1,378
2
votes
2
answers
9k
views
Counting number of connections in a pcap file
What tool can I used to get a count of the number of TCP and UDP connections inside of a pcap file?
- 33
5
votes
1
answer
5k
views
How to filter ANY dns requests with tshark
Does anyone know how I might be able to filter DNS requests in tshark which ask for the ANY record?
So far I am able to filter DNS queries with:
tshark -r capture.cap -T fields -e ip.src -e ip.dst -e ...
- 455
5
votes
2
answers
4k
views
Compressing the output of tshark when in multiple files mode
I'm running tshark to dump wireless traffic. I am currently running in multiple files mode, splitting output into 50MB chunks. Is there any way to also have these 50MB chunks compressed with something ...
2
votes
0
answers
2k
views
Can I use tshark to write SSL-decrypted packets to a file?
I have a PCAP file containing SSL-encrypted HTTP traffic and the private key from the relevant web server. I'd like a PCAP file that contains the decrypted HTTP traffic to feed into a different tool. ...
- 355
3
votes
1
answer
2k
views
How can I assign multiple IPv6 addresses with DHCPv6 to a single interface?
This seems to be possible based on the spec rfc 3315 page 23:
Excerpt:
The configuration information in an IA consists of one or more IPv6
addresses along with the times T1 and T2 for the IA. See ...
- 202
2
votes
0
answers
581
views
replay decrypted ssl traffic with tcpreplay
I have an pcap format from some https traffic from one of my web-servers.
So I can use the key from my webserver to decrypt the traffic in wireshark. The problem I'm now facing is that I can't get an ...
- 968