Questions tagged [pcap]

PCAP stands for Packet CAPture.

Filter by
Sorted by
Tagged with
0
votes
0answers
9 views

dumpcap filter size, and maybe taken from file?

When running `dumpcap -i any -f "host 1.2.3.4 or host 2.3.4.5..." -w file.pcap how big can the filter be, and is it possible to use a file for filter as input, if I want to capture from let'...
0
votes
1answer
23 views

Can I determine a EWOULDBLOCK/EAGAIN situation from a pcap/tcpdump

Is there a way I can determine if a certain message resulted in an EWOULDBLOCK/EAGAIN return code to the server which sent the packet? The server was sending messages to the client At time 10,the ...
1
vote
1answer
43 views

How to split pcap per IRC channels

I wonder if there is a way how to split a pcap that contains (only) IRC per channels. I'm trying to compare accuracy of botnet detection in channels using existing IDS (suricata, snort). The only way ...
0
votes
1answer
122 views

Pcap (tcpdump) filter to match against local port

I'm trying to write a libpcap (tcpdump, iftop) filter that would match packets having a specific local port. That is, I'm interested in traffic that either goes out of port 12345 on the local machine ...
0
votes
0answers
15 views

communication between 2 servers via NSP

I'm in a situation where one server(tb06) should populate its health status to another server(admin03) via NSP in nsxml format. When I have taken TCPDUMP(.pcap) on admin03, apart from tb06 HTTP header,...
-1
votes
1answer
82 views

SSH connection not established, but standard TCP/IP connection works

I'm working on a custom yocto Linux for a Raspberry PI 3 and try to get the WIFI connection working with SSH. However when trying to connect from my PC (Ubuntu 19.10, SSH OpenSSH_8.0p1 Ubuntu-6build1, ...
1
vote
0answers
41 views

How can I capture traffic for a daemon listening on a cloned loopback IP address?

I have a daemon listening on a virtual IP address attached to a cloned loopback interface (lo1) on FreeBSD 11.x. Inbound traffic for that daemon could arrive on several different physical interfaces, ...
1
vote
0answers
390 views

How do i convert text capture files back to pcap files?

I have opened Wireshark, selected the a.pcap file, and then went to File->Export and chose (K12 text file) to convert to text. Result is a.txt file. How can I convert back a.txt file to original pcap ...
0
votes
1answer
149 views

Retrieve data from wireshark (PCAPNG)

I have a PCAPNG file and I need to retrieve two files from it, one is a TXT and the other one is a PNG. The provided file does not have FTP-DATA, it only have ARP, DHCP, DNS, FTP, HTTP, IGMPv3, OCSP, ...
0
votes
1answer
172 views

Are TCP RTO value and RTT value influenced by the packet size?

I am doing troubleshooting in my network. I found some re-transmission by using wireshark. The segment 1400 bytes are well transmitted but The segment 800 bytes are lost and re-transmitted. I know ...
1
vote
2answers
316 views

I have a loopback traffic in linux involving port 631 and I have no idea what is causing it

So I did some packet capturing in my networking and everything else is actually fine except for this weird communication where source and destination is literally 127.0.0.1, source port is 631, and ...
1
vote
0answers
73 views

disabling ethernet loopback packets

I have a linux machine with a few network interfaces which I use to run communication tests. In some of the tests I get a lot of packets with ether type 0x9000 (ethernet configuration testing protocol)...
0
votes
1answer
202 views

Capture packets on loopback

I'm running web service on my windows 10 machine. I decided to look at the packets between my service and client running on the same machine by using Wireshark. I know that it is not possible to get ...
3
votes
4answers
2k views

How can i see packets while capturing with tcpdump

How can I see traffic while I am capturing it with tcpdump. When I use -w, it doesn't show the packets during the capture. sudo tcpdump -i enp2s0 -w test.pcap tcpdump: listening on enp2s0, link-type ...
-5
votes
1answer
72 views

Serializing pcap file into 4B chunks [closed]

Given a previously generated pcap file, how do I serialize the data into 4B (or N byte) chunks. The format/protocol of the pcap data is not relevant here.
1
vote
1answer
1k views

Wireshark under Windows: Any way to capture packets before dropped by special filter drivers?

I've got some GigabitEthernet Vision cameras, which use Ethernet to communicate. The protocol is simple UDP, but for performance reasons (high packet throughput causing CPU load) the manufacturer uses ...
2
votes
1answer
2k views

How can I export more than 1000 http request bodies from a large pcap file?

I have a pcap file (~2.3G) containing HTTP requests. I need to extract the body of each request in some way that I can further process it. Each request in its own file would work well, but I can be ...
1
vote
3answers
2k views

(internal) Packet capture in a google cloud VPC network?

I have a VPC network set up in google cloud with a few instances running. One of these instances serves as a VPN machine, allowing me to interact with the instances from the internet. I want to ...
1
vote
0answers
71 views

Slow VPN performance - TCP Issue?

I am having issues with the performance of a VPN, it is just one VPN in particular and I have captured the following PCAP from the server in question. My understanding is that the "Ack" field should ...
1
vote
1answer
1k views

Replaying pcap file for Snort

I currently have the following, presumably standard, setup: I have a physical server with Snort running. Snort logs into its log files as it should. Those files are tracked by barnyard2 which writes ...
0
votes
1answer
114 views

Filter pcap by subsecond detail?

I'm trying to export a subset of a pcap file given a start and an end message, this start and end message identification is currently done using ngrep on the raw data(because we have no dissector for ...
2
votes
0answers
414 views

Modify ip addresses in a socks capture pcap

I have a pcap capture of socks traffic. The traffic goes like - client_ip <-> 127.0.0.1:9050 <-> destination_ip Looking at pcap in wireshark, thus, shows: src_ip = 127.0.0.1 dst_ip = ...
0
votes
2answers
738 views

Packet fragmentation confusion

I was playing around with dpkt in Python, trying to decode PPPoE - and the program was working just fine, till I noticed that the Offset in the encapsulation IP packets was always 0, even with clearly ...
0
votes
1answer
374 views

ngrep output format clarification

I am trying to debug a connection that has been appearing in my environment from an unknown server. I want to find a PID if it is associated with one. Tried "netstat -anp" but it doesn't find ...
0
votes
1answer
257 views

how can i export sflow data to be saved in pcap on other server in realtime?

I have a pfsense server, all of attacks will come to its WAN interface. i have setup another packet analysis tool on private network behind pfsense. i want to send realtime WAN traffic from pfsense ...
0
votes
0answers
151 views

http timing stats from tcp trace

I am trying to find a tool to extract HTTP timing stats from network traces; namely time to connect, time to first byte, total time to serve.I am talking about very large traces with millions of ...
1
vote
1answer
568 views

Possible to dump sflow data to pcap format?

I want to get the packet capture from fortiet/fortigate device, to capture all traffic from it on one of its interface. For it i have enabled sflow and sent it to another ntopng server. but on ntopng ,...
2
votes
1answer
641 views

Allowing node.js applications to run libpcap without sudo (“Symlink” issue )

I want to use the following command to allow usage of the libpcap package without to sudo (on a debian system): sudo setcap 'CAP_NET_RAW+eip CAP_NET_ADMIN+eip' /usr/bin/nodejs I'm getting this error:...
0
votes
1answer
2k views

Mirror traffic to tcpdump server and automatically save pcaps

Looking to port mirror a network firewall interface, connect that interface to a Linux server, and have that Linux server constantly run a tcpdump and storing the output in files. Specifically, my ...
1
vote
1answer
266 views

Search all pcap files in a folder and sub-folders for a certain condition

I have a folder (containing many sub-folders) full of pcap files and I'd like to get all pcap files containing packets that match a certain condition, for example "have source IP 1.1.1.1". Do you know ...
0
votes
2answers
741 views

Unable to install pcapsipdump

I'm trying to install pcapsipdump but I get the error below when I try to make. libpcab and libpcap-devel are installed, which I did via "yum install libpcap libpcap-devel". I'm currently stuck on how ...
0
votes
1answer
540 views

PCAP filter for first few packets, and packets related to disconnection, TCP-only

I'd like to use tcpdump with a filter for some long-running debugging. Specifically, I only want to capture packets with the following conditions: First 10 packets or so of a new TCP connection (...
0
votes
1answer
292 views

PCAP traffic frame length short

I'm trying to make traffic and capture it using pcap file. I get pcap file from CAIDA(caida.org) site. This pcap file too big and doesn't have ethernet header. So i splitted pcap file to small size(40 ...
6
votes
3answers
8k views

How would a PCAP filter look like to capture all DHCP related traffic?

As I understand it, for IPv4 I would need to capture UDP port 67 and 68, ARP, ICMP echo request and reply, and for IPv6 I would need UDP port 546 and 547, all DHCP-related multicast addresses, ...
1
vote
1answer
2k views

How to efficiently re-order packets in PCAP files based on timestamp?

I have a PCAP file which contains many packets. They are however out of order based on the timestamp (it is actually randomized). What is the best way to efficiently sort the PCAP packets based on ...
0
votes
1answer
90 views

MCU packet capture

I am trying to do a packet capture of a video conference hosted with CISCO [Codian] MCU. The instructions for capturing SIP packets with Wireshark are available. I also configured MCU to accept SIP ...
0
votes
1answer
540 views

PCap filter by IP not filtering out 0.0.0.0

I have my PCap filter set to "dst net 10.36.95.0 mask 255.255.255.0". This works in that it filters out most traffic with a destination outside of the 10.36.95.0/24 subnet, the exception being that it ...
0
votes
1answer
2k views

how to determine client side or server side retransmission from a pcap

I am trying to get some clarification on something I read here: how to calculate packet loss from a binary TCPDUMP file The first answer says that the sequence number will be the same from client to ...
2
votes
2answers
4k views

How to use tshark or tcpdump to calculate bytes transmitted

I am using this command with tshark: tshark -r pcapfile "tcp and ip.src==192.168.1.1" -T text -V -x | grep 'Total Length' This essentially parses the pcap for only connections from the source ip and ...
0
votes
2answers
7k views

Why am I not getting an ARP reply with this request?

Using pcap_sendpacket in C, I'm manually sending the following packet on wlan0 (I've left out some fields, but I think they are correct): (Ethernet layer) eth src: <wlan0 MAC address> eth dest:...
0
votes
1answer
118 views

Extract nth Packet From a Pacp File

Is there any command line tool to extract the n th packet from a pcap file? I am on CentOS 6.5. Thanks in advance.
8
votes
2answers
11k views

Packet captures: filtering on RX vs TX

I have a network problem where frames with a source MAC which matches with one of my host's source MACs are arriving at the host - an apparent duplicate MAC, or loop, or other L2 problem. I believe ...
2
votes
2answers
6k views

Counting number of connections in a pcap file

What tool can I used to get a count of the number of TCP and UDP connections inside of a pcap file?
4
votes
1answer
3k views

How to filter ANY dns requests with tshark

Does anyone know how I might be able to filter DNS requests in tshark which ask for the ANY record? So far I am able to filter DNS queries with: tshark -r capture.cap -T fields -e ip.src -e ip.dst -e ...
4
votes
2answers
3k views

Compressing the output of tshark when in multiple files mode

I'm running tshark to dump wireless traffic. I am currently running in multiple files mode, splitting output into 50MB chunks. Is there any way to also have these 50MB chunks compressed with something ...
2
votes
0answers
1k views

Can I use tshark to write SSL-decrypted packets to a file?

I have a PCAP file containing SSL-encrypted HTTP traffic and the private key from the relevant web server. I'd like a PCAP file that contains the decrypted HTTP traffic to feed into a different tool. ...
3
votes
1answer
2k views

How can I assign multiple IPv6 addresses with DHCPv6 to a single interface?

This seems to be possible based on the spec rfc 3315 page 23: Excerpt: The configuration information in an IA consists of one or more IPv6 addresses along with the times T1 and T2 for the IA. See ...
2
votes
0answers
474 views

replay decrypted ssl traffic with tcpreplay

I have an pcap format from some https traffic from one of my web-servers. So I can use the key from my webserver to decrypt the traffic in wireshark. The problem I'm now facing is that I can't get an ...
2
votes
3answers
3k views

How to capture contents of the first packet of TCP connections using tcpdump

I'm tasked with monitoring and debugging a SOAP web service, on network level. I can use tcpdump to capture the whole traffic coming from customers on port 80, but I can't limit the capture for every ...
0
votes
2answers
811 views

How do I set Securityonion/snort to not capture certain packets?

After looking through my pcaps from Security onion I'd like to filter out a host (let's call it 192.168.4.4) and filter out some traffic (ports 80 & 443), current project is to look at other ...