Questions tagged [pcap]

PCAP stands for Packet CAPture.

Filter by
Sorted by
Tagged with
-1
votes
1answer
49 views

SSH connection not established, but standard TCP/IP connection works

I'm working on a custom yocto Linux for a Raspberry PI 3 and try to get the WIFI connection working with SSH. However when trying to connect from my PC (Ubuntu 19.10, SSH OpenSSH_8.0p1 Ubuntu-6build1, ...
0
votes
0answers
16 views

“Correlate” two pcap files to measure packet latency / drop rates

Imagine I have two pcap files, recorded at ingress (eth0) and egress (eth1) interfaces of a rate-limiting, packet-forwarding host. Both pcaps contain the same TCP flows, and the time base in both ...
0
votes
0answers
36 views

Bandwidth Calculation using Pcap

Can Pcap be used to accurately calculate the speed or bandwidth of any user using only their IP in both uploading and downloading by checking the src/dst IPs of the packets?? If so, assuming that ...
1
vote
0answers
36 views

How can I capture traffic for a daemon listening on a cloned loopback IP address?

I have a daemon listening on a virtual IP address attached to a cloned loopback interface (lo1) on FreeBSD 11.x. Inbound traffic for that daemon could arrive on several different physical interfaces, ...
1
vote
0answers
86 views

How do i convert text capture files back to pcap files?

I have opened Wireshark, selected the a.pcap file, and then went to File->Export and chose (K12 text file) to convert to text. Result is a.txt file. How can I convert back a.txt file to original pcap ...
0
votes
1answer
27 views

Retrieve data from wireshark (PCAPNG)

I have a PCAPNG file and I need to retrieve two files from it, one is a TXT and the other one is a PNG. The provided file does not have FTP-DATA, it only have ARP, DHCP, DNS, FTP, HTTP, IGMPv3, OCSP, ...
0
votes
0answers
236 views

iperf test shows large number of TCP: duplicate ACK / retransmission & out-of-order

I carried out a network throughput test using iperf and captured packets at both ends. I see a almost 10% packets highlighted in tcp.analysis.flag with following characteristic: “TCP duplicate ack” ...
0
votes
1answer
112 views

Are TCP RTO value and RTT value influenced by the packet size?

I am doing troubleshooting in my network. I found some re-transmission by using wireshark. The segment 1400 bytes are well transmitted but The segment 800 bytes are lost and re-transmitted. I know ...
1
vote
2answers
170 views

I have a loopback traffic in linux involving port 631 and I have no idea what is causing it

So I did some packet capturing in my networking and everything else is actually fine except for this weird communication where source and destination is literally 127.0.0.1, source port is 631, and ...
0
votes
0answers
39 views

No ACK packets followed by server ignoring requests

I've been trying to debug an issue I've had with a PHP script for a while. Nothing seems to be working, so I went to capture the packets to see what PHP does differently to other software. These dumps ...
1
vote
0answers
46 views

disabling ethernet loopback packets

I have a linux machine with a few network interfaces which I use to run communication tests. In some of the tests I get a lot of packets with ether type 0x9000 (ethernet configuration testing protocol)...
0
votes
1answer
110 views

Capture packets on loopback

I'm running web service on my windows 10 machine. I decided to look at the packets between my service and client running on the same machine by using Wireshark. I know that it is not possible to get ...
1
vote
3answers
442 views

How can i see packets while capturing with tcpdump

How can I see traffic while I am capturing it with tcpdump. When I use -w, it doesn't show the packets during the capture. sudo tcpdump -i enp2s0 -w test.pcap tcpdump: listening on enp2s0, link-type ...
-5
votes
1answer
70 views

Serializing pcap file into 4B chunks [closed]

Given a previously generated pcap file, how do I serialize the data into 4B (or N byte) chunks. The format/protocol of the pcap data is not relevant here.
1
vote
1answer
1k views

Wireshark under Windows: Any way to capture packets before dropped by special filter drivers?

I've got some GigabitEthernet Vision cameras, which use Ethernet to communicate. The protocol is simple UDP, but for performance reasons (high packet throughput causing CPU load) the manufacturer uses ...
2
votes
1answer
1k views

How can I export more than 1000 http request bodies from a large pcap file?

I have a pcap file (~2.3G) containing HTTP requests. I need to extract the body of each request in some way that I can further process it. Each request in its own file would work well, but I can be ...
0
votes
1answer
1k views

(internal) Packet capture in a google cloud VPC network?

I have a VPC network set up in google cloud with a few instances running. One of these instances serves as a VPN machine, allowing me to interact with the instances from the internet. I want to ...
1
vote
0answers
67 views

Slow VPN performance - TCP Issue?

I am having issues with the performance of a VPN, it is just one VPN in particular and I have captured the following PCAP from the server in question. My understanding is that the "Ack" field should ...
1
vote
1answer
1k views

Replaying pcap file for Snort

I currently have the following, presumably standard, setup: I have a physical server with Snort running. Snort logs into its log files as it should. Those files are tracked by barnyard2 which writes ...
0
votes
1answer
95 views

Filter pcap by subsecond detail?

I'm trying to export a subset of a pcap file given a start and an end message, this start and end message identification is currently done using ngrep on the raw data(because we have no dissector for ...
2
votes
0answers
363 views

Modify ip addresses in a socks capture pcap

I have a pcap capture of socks traffic. The traffic goes like - client_ip <-> 127.0.0.1:9050 <-> destination_ip Looking at pcap in wireshark, thus, shows: src_ip = 127.0.0.1 dst_ip = ...
0
votes
2answers
679 views

Packet fragmentation confusion

I was playing around with dpkt in Python, trying to decode PPPoE - and the program was working just fine, till I noticed that the Offset in the encapsulation IP packets was always 0, even with clearly ...
0
votes
1answer
311 views

ngrep output format clarification

I am trying to debug a connection that has been appearing in my environment from an unknown server. I want to find a PID if it is associated with one. Tried "netstat -anp" but it doesn't find ...
0
votes
1answer
221 views

how can i export sflow data to be saved in pcap on other server in realtime?

I have a pfsense server, all of attacks will come to its WAN interface. i have setup another packet analysis tool on private network behind pfsense. i want to send realtime WAN traffic from pfsense ...
0
votes
0answers
150 views

http timing stats from tcp trace

I am trying to find a tool to extract HTTP timing stats from network traces; namely time to connect, time to first byte, total time to serve.I am talking about very large traces with millions of ...
1
vote
1answer
492 views

Possible to dump sflow data to pcap format?

I want to get the packet capture from fortiet/fortigate device, to capture all traffic from it on one of its interface. For it i have enabled sflow and sent it to another ntopng server. but on ntopng ,...
2
votes
1answer
556 views

Allowing node.js applications to run libpcap without sudo (“Symlink” issue )

I want to use the following command to allow usage of the libpcap package without to sudo (on a debian system): sudo setcap 'CAP_NET_RAW+eip CAP_NET_ADMIN+eip' /usr/bin/nodejs I'm getting this error:...
0
votes
1answer
2k views

Mirror traffic to tcpdump server and automatically save pcaps

Looking to port mirror a network firewall interface, connect that interface to a Linux server, and have that Linux server constantly run a tcpdump and storing the output in files. Specifically, my ...
1
vote
1answer
194 views

Search all pcap files in a folder and sub-folders for a certain condition

I have a folder (containing many sub-folders) full of pcap files and I'd like to get all pcap files containing packets that match a certain condition, for example "have source IP 1.1.1.1". Do you know ...
0
votes
2answers
659 views

Unable to install pcapsipdump

I'm trying to install pcapsipdump but I get the error below when I try to make. libpcab and libpcap-devel are installed, which I did via "yum install libpcap libpcap-devel". I'm currently stuck on how ...
0
votes
1answer
444 views

PCAP filter for first few packets, and packets related to disconnection, TCP-only

I'd like to use tcpdump with a filter for some long-running debugging. Specifically, I only want to capture packets with the following conditions: First 10 packets or so of a new TCP connection (...
0
votes
1answer
235 views

PCAP traffic frame length short

I'm trying to make traffic and capture it using pcap file. I get pcap file from CAIDA(caida.org) site. This pcap file too big and doesn't have ethernet header. So i splitted pcap file to small size(40 ...
6
votes
3answers
7k views

How would a PCAP filter look like to capture all DHCP related traffic?

As I understand it, for IPv4 I would need to capture UDP port 67 and 68, ARP, ICMP echo request and reply, and for IPv6 I would need UDP port 546 and 547, all DHCP-related multicast addresses, ...
1
vote
1answer
2k views

How to efficiently re-order packets in PCAP files based on timestamp?

I have a PCAP file which contains many packets. They are however out of order based on the timestamp (it is actually randomized). What is the best way to efficiently sort the PCAP packets based on ...
0
votes
1answer
79 views

MCU packet capture

I am trying to do a packet capture of a video conference hosted with CISCO [Codian] MCU. The instructions for capturing SIP packets with Wireshark are available. I also configured MCU to accept SIP ...
0
votes
1answer
433 views

PCap filter by IP not filtering out 0.0.0.0

I have my PCap filter set to "dst net 10.36.95.0 mask 255.255.255.0". This works in that it filters out most traffic with a destination outside of the 10.36.95.0/24 subnet, the exception being that it ...
0
votes
1answer
2k views

how to determine client side or server side retransmission from a pcap

I am trying to get some clarification on something I read here: how to calculate packet loss from a binary TCPDUMP file The first answer says that the sequence number will be the same from client to ...
1
vote
2answers
3k views

How to use tshark or tcpdump to calculate bytes transmitted

I am using this command with tshark: tshark -r pcapfile "tcp and ip.src==192.168.1.1" -T text -V -x | grep 'Total Length' This essentially parses the pcap for only connections from the source ip and ...
0
votes
2answers
5k views

Why am I not getting an ARP reply with this request?

Using pcap_sendpacket in C, I'm manually sending the following packet on wlan0 (I've left out some fields, but I think they are correct): (Ethernet layer) eth src: <wlan0 MAC address> eth dest:...
0
votes
1answer
101 views

Extract nth Packet From a Pacp File

Is there any command line tool to extract the n th packet from a pcap file? I am on CentOS 6.5. Thanks in advance.
8
votes
2answers
10k views

Packet captures: filtering on RX vs TX

I have a network problem where frames with a source MAC which matches with one of my host's source MACs are arriving at the host - an apparent duplicate MAC, or loop, or other L2 problem. I believe ...
2
votes
2answers
5k views

Counting number of connections in a pcap file

What tool can I used to get a count of the number of TCP and UDP connections inside of a pcap file?
4
votes
1answer
3k views

How to filter ANY dns requests with tshark

Does anyone know how I might be able to filter DNS requests in tshark which ask for the ANY record? So far I am able to filter DNS queries with: tshark -r capture.cap -T fields -e ip.src -e ip.dst -e ...
2
votes
2answers
2k views

Compressing the output of tshark when in multiple files mode

I'm running tshark to dump wireless traffic. I am currently running in multiple files mode, splitting output into 50MB chunks. Is there any way to also have these 50MB chunks compressed with something ...
2
votes
0answers
1k views

Can I use tshark to write SSL-decrypted packets to a file?

I have a PCAP file containing SSL-encrypted HTTP traffic and the private key from the relevant web server. I'd like a PCAP file that contains the decrypted HTTP traffic to feed into a different tool. ...
2
votes
1answer
1k views

How to assign multiple IPv6 addresses with DHCPv6 to a single interface?

This seems to be possible based on the spec rfc 3315 page 23: Excerpt: The configuration information in an IA consists of one or more IPv6 addresses along with the times T1 and T2 for the IA. See ...
2
votes
0answers
447 views

replay decrypted ssl traffic with tcpreplay

I have an pcap format from some https traffic from one of my web-servers. So I can use the key from my webserver to decrypt the traffic in wireshark. The problem I'm now facing is that I can't get an ...
2
votes
3answers
3k views

How to capture contents of the first packet of TCP connections using tcpdump

I'm tasked with monitoring and debugging a SOAP web service, on network level. I can use tcpdump to capture the whole traffic coming from customers on port 80, but I can't limit the capture for every ...
0
votes
2answers
722 views

How do I set Securityonion/snort to not capture certain packets?

After looking through my pcaps from Security onion I'd like to filter out a host (let's call it 192.168.4.4) and filter out some traffic (ports 80 & 443), current project is to look at other ...
1
vote
2answers
308 views

Is it possible to split PCAPS into multiple files bases on simple criteria

Is it possible to split PCAPS into multiple files bases on simple criteria Origional.pcap {split on port 80} which generates the 2 following files all_port_80.pcap everything_else.pcap Or would it ...