Questions tagged [pcap]

PCAP stands for Packet CAPture.

Filter by
Sorted by
Tagged with
0 votes
1 answer
95 views

Linux: bridge vs. vlan vs. tcpdump

I have a Proxmox host with kernel 5.15.19-2-pve. It has a bond0 interface made from eth2 and eth3, which receives vlan tagged traffic. I created a vmbr666 bridge that shows looks like this: # /etc/...
user avatar
1 vote
1 answer
244 views

Extracting TCP application data from pcap file

Given a .pcap (or similar) file, I'd like to select one TCP connection and dump both application data streams (the one from the other peer and the one two the other peer) into two separate files on ...
user avatar
0 votes
0 answers
60 views

tc traffic shaping with HTB and CQB causes packet transmission gap inconsistencies

Problem: When the tc HTB or CQB is used to do traffic shaping, first two packet that are sent after some time gap are sent back to back as recorded in the pcap log. I have a intermediate computer with ...
user avatar
0 votes
1 answer
48 views

Can I determine a EWOULDBLOCK/EAGAIN situation from a pcap/tcpdump

Is there a way I can determine if a certain message resulted in an EWOULDBLOCK/EAGAIN return code to the server which sent the packet? The server was sending messages to the client At time 10,the ...
user avatar
  • 133
1 vote
1 answer
81 views

How to split pcap per IRC channels

I wonder if there is a way how to split a pcap that contains (only) IRC per channels. I'm trying to compare accuracy of botnet detection in channels using existing IDS (suricata, snort). The only way ...
user avatar
  • 113
0 votes
1 answer
300 views

Pcap (tcpdump) filter to match against local port

I'm trying to write a libpcap (tcpdump, iftop) filter that would match packets having a specific local port. That is, I'm interested in traffic that either goes out of port 12345 on the local machine ...
user avatar
  • 134
-1 votes
1 answer
334 views

SSH connection not established, but standard TCP/IP connection works

I'm working on a custom yocto Linux for a Raspberry PI 3 and try to get the WIFI connection working with SSH. However when trying to connect from my PC (Ubuntu 19.10, SSH OpenSSH_8.0p1 Ubuntu-6build1, ...
user avatar
  • 1
1 vote
0 answers
48 views

How can I capture traffic for a daemon listening on a cloned loopback IP address?

I have a daemon listening on a virtual IP address attached to a cloned loopback interface (lo1) on FreeBSD 11.x. Inbound traffic for that daemon could arrive on several different physical interfaces, ...
user avatar
  • 21k
1 vote
0 answers
1k views

How do i convert text capture files back to pcap files?

I have opened Wireshark, selected the a.pcap file, and then went to File->Export and chose (K12 text file) to convert to text. Result is a.txt file. How can I convert back a.txt file to original pcap ...
user avatar
  • 111
0 votes
1 answer
438 views

Retrieve data from wireshark (PCAPNG)

I have a PCAPNG file and I need to retrieve two files from it, one is a TXT and the other one is a PNG. The provided file does not have FTP-DATA, it only have ARP, DHCP, DNS, FTP, HTTP, IGMPv3, OCSP, ...
user avatar
0 votes
1 answer
252 views

Are TCP RTO value and RTT value influenced by the packet size?

I am doing troubleshooting in my network. I found some re-transmission by using wireshark. The segment 1400 bytes are well transmitted but The segment 800 bytes are lost and re-transmitted. I know ...
user avatar
1 vote
2 answers
556 views

I have a loopback traffic in linux involving port 631 and I have no idea what is causing it

So I did some packet capturing in my networking and everything else is actually fine except for this weird communication where source and destination is literally 127.0.0.1, source port is 631, and ...
user avatar
1 vote
0 answers
141 views

disabling ethernet loopback packets

I have a linux machine with a few network interfaces which I use to run communication tests. In some of the tests I get a lot of packets with ether type 0x9000 (ethernet configuration testing protocol)...
user avatar
  • 131
0 votes
1 answer
328 views

Capture packets on loopback

I'm running web service on my windows 10 machine. I decided to look at the packets between my service and client running on the same machine by using Wireshark. I know that it is not possible to get ...
user avatar
  • 99
3 votes
4 answers
5k views

How can i see packets while capturing with tcpdump

How can I see traffic while I am capturing it with tcpdump. When I use -w, it doesn't show the packets during the capture. sudo tcpdump -i enp2s0 -w test.pcap tcpdump: listening on enp2s0, link-type ...
user avatar
-5 votes
1 answer
74 views

Serializing pcap file into 4B chunks [closed]

Given a previously generated pcap file, how do I serialize the data into 4B (or N byte) chunks. The format/protocol of the pcap data is not relevant here.
user avatar
1 vote
1 answer
1k views

Wireshark under Windows: Any way to capture packets before dropped by special filter drivers?

I've got some GigabitEthernet Vision cameras, which use Ethernet to communicate. The protocol is simple UDP, but for performance reasons (high packet throughput causing CPU load) the manufacturer uses ...
user avatar
  • 365
2 votes
1 answer
3k views

How can I export more than 1000 http request bodies from a large pcap file?

I have a pcap file (~2.3G) containing HTTP requests. I need to extract the body of each request in some way that I can further process it. Each request in its own file would work well, but I can be ...
user avatar
  • 770
1 vote
3 answers
3k views

(internal) Packet capture in a google cloud VPC network?

I have a VPC network set up in google cloud with a few instances running. One of these instances serves as a VPN machine, allowing me to interact with the instances from the internet. I want to ...
user avatar
  • 11
1 vote
0 answers
74 views

Slow VPN performance - TCP Issue?

I am having issues with the performance of a VPN, it is just one VPN in particular and I have captured the following PCAP from the server in question. My understanding is that the "Ack" field should ...
user avatar
1 vote
1 answer
2k views

Replaying pcap file for Snort

I currently have the following, presumably standard, setup: I have a physical server with Snort running. Snort logs into its log files as it should. Those files are tracked by barnyard2 which writes ...
user avatar
  • 121
0 votes
1 answer
146 views

Filter pcap by subsecond detail?

I'm trying to export a subset of a pcap file given a start and an end message, this start and end message identification is currently done using ngrep on the raw data(because we have no dissector for ...
user avatar
  • 113
2 votes
0 answers
460 views

Modify ip addresses in a socks capture pcap

I have a pcap capture of socks traffic. The traffic goes like - client_ip <-> 127.0.0.1:9050 <-> destination_ip Looking at pcap in wireshark, thus, shows: src_ip = 127.0.0.1 dst_ip = ...
user avatar
  • 121
0 votes
2 answers
816 views

Packet fragmentation confusion

I was playing around with dpkt in Python, trying to decode PPPoE - and the program was working just fine, till I noticed that the Offset in the encapsulation IP packets was always 0, even with clearly ...
user avatar
  • 103
0 votes
1 answer
423 views

ngrep output format clarification

I am trying to debug a connection that has been appearing in my environment from an unknown server. I want to find a PID if it is associated with one. Tried "netstat -anp" but it doesn't find ...
user avatar
  • 2,488
0 votes
1 answer
300 views

how can i export sflow data to be saved in pcap on other server in realtime?

I have a pfsense server, all of attacks will come to its WAN interface. i have setup another packet analysis tool on private network behind pfsense. i want to send realtime WAN traffic from pfsense ...
user avatar
  • 4,180
0 votes
0 answers
155 views

http timing stats from tcp trace

I am trying to find a tool to extract HTTP timing stats from network traces; namely time to connect, time to first byte, total time to serve.I am talking about very large traces with millions of ...
user avatar
  • 1
1 vote
1 answer
694 views

Possible to dump sflow data to pcap format?

I want to get the packet capture from fortiet/fortigate device, to capture all traffic from it on one of its interface. For it i have enabled sflow and sent it to another ntopng server. but on ntopng ,...
user avatar
  • 4,180
2 votes
1 answer
706 views

Allowing node.js applications to run libpcap without sudo ("Symlink" issue )

I want to use the following command to allow usage of the libpcap package without to sudo (on a debian system): sudo setcap 'CAP_NET_RAW+eip CAP_NET_ADMIN+eip' /usr/bin/nodejs I'm getting this error:...
user avatar
  • 121
0 votes
1 answer
2k views

Mirror traffic to tcpdump server and automatically save pcaps

Looking to port mirror a network firewall interface, connect that interface to a Linux server, and have that Linux server constantly run a tcpdump and storing the output in files. Specifically, my ...
user avatar
  • 1,021
1 vote
1 answer
456 views

Search all pcap files in a folder and sub-folders for a certain condition

I have a folder (containing many sub-folders) full of pcap files and I'd like to get all pcap files containing packets that match a certain condition, for example "have source IP 1.1.1.1". Do you know ...
user avatar
0 votes
2 answers
837 views

Unable to install pcapsipdump

I'm trying to install pcapsipdump but I get the error below when I try to make. libpcab and libpcap-devel are installed, which I did via "yum install libpcap libpcap-devel". I'm currently stuck on how ...
user avatar
  • 173
0 votes
1 answer
627 views

PCAP filter for first few packets, and packets related to disconnection, TCP-only

I'd like to use tcpdump with a filter for some long-running debugging. Specifically, I only want to capture packets with the following conditions: First 10 packets or so of a new TCP connection (...
user avatar
  • 1,379
0 votes
1 answer
360 views

PCAP traffic frame length short

I'm trying to make traffic and capture it using pcap file. I get pcap file from CAIDA(caida.org) site. This pcap file too big and doesn't have ethernet header. So i splitted pcap file to small size(40 ...
user avatar
6 votes
3 answers
9k views

How would a PCAP filter look like to capture all DHCP related traffic?

As I understand it, for IPv4 I would need to capture UDP port 67 and 68, ARP, ICMP echo request and reply, and for IPv6 I would need UDP port 546 and 547, all DHCP-related multicast addresses, ...
user avatar
1 vote
1 answer
2k views

How to efficiently re-order packets in PCAP files based on timestamp?

I have a PCAP file which contains many packets. They are however out of order based on the timestamp (it is actually randomized). What is the best way to efficiently sort the PCAP packets based on ...
user avatar
  • 155
0 votes
1 answer
100 views

MCU packet capture

I am trying to do a packet capture of a video conference hosted with CISCO [Codian] MCU. The instructions for capturing SIP packets with Wireshark are available. I also configured MCU to accept SIP ...
user avatar
0 votes
1 answer
613 views

PCap filter by IP not filtering out 0.0.0.0

I have my PCap filter set to "dst net 10.36.95.0 mask 255.255.255.0". This works in that it filters out most traffic with a destination outside of the 10.36.95.0/24 subnet, the exception being that it ...
user avatar
0 votes
1 answer
2k views

how to determine client side or server side retransmission from a pcap

I am trying to get some clarification on something I read here: how to calculate packet loss from a binary TCPDUMP file The first answer says that the sequence number will be the same from client to ...
user avatar
  • 609
2 votes
2 answers
6k views

How to use tshark or tcpdump to calculate bytes transmitted

I am using this command with tshark: tshark -r pcapfile "tcp and ip.src==192.168.1.1" -T text -V -x | grep 'Total Length' This essentially parses the pcap for only connections from the source ip and ...
user avatar
  • 609
0 votes
2 answers
9k views

Why am I not getting an ARP reply with this request?

Using pcap_sendpacket in C, I'm manually sending the following packet on wlan0 (I've left out some fields, but I think they are correct): (Ethernet layer) eth src: <wlan0 MAC address> eth dest:...
user avatar
  • 126
0 votes
1 answer
157 views

Extract nth Packet From a Pacp File

Is there any command line tool to extract the n th packet from a pcap file? I am on CentOS 6.5. Thanks in advance.
user avatar
  • 165
9 votes
2 answers
13k views

Packet captures: filtering on RX vs TX

I have a network problem where frames with a source MAC which matches with one of my host's source MACs are arriving at the host - an apparent duplicate MAC, or loop, or other L2 problem. I believe ...
user avatar
2 votes
2 answers
8k views

Counting number of connections in a pcap file

What tool can I used to get a count of the number of TCP and UDP connections inside of a pcap file?
user avatar
  • 33
5 votes
1 answer
4k views

How to filter ANY dns requests with tshark

Does anyone know how I might be able to filter DNS requests in tshark which ask for the ANY record? So far I am able to filter DNS queries with: tshark -r capture.cap -T fields -e ip.src -e ip.dst -e ...
user avatar
4 votes
2 answers
4k views

Compressing the output of tshark when in multiple files mode

I'm running tshark to dump wireless traffic. I am currently running in multiple files mode, splitting output into 50MB chunks. Is there any way to also have these 50MB chunks compressed with something ...
user avatar
2 votes
0 answers
2k views

Can I use tshark to write SSL-decrypted packets to a file?

I have a PCAP file containing SSL-encrypted HTTP traffic and the private key from the relevant web server. I'd like a PCAP file that contains the decrypted HTTP traffic to feed into a different tool. ...
user avatar
3 votes
1 answer
2k views

How can I assign multiple IPv6 addresses with DHCPv6 to a single interface?

This seems to be possible based on the spec rfc 3315 page 23: Excerpt: The configuration information in an IA consists of one or more IPv6 addresses along with the times T1 and T2 for the IA. See ...
user avatar
  • 202
2 votes
0 answers
517 views

replay decrypted ssl traffic with tcpreplay

I have an pcap format from some https traffic from one of my web-servers. So I can use the key from my webserver to decrypt the traffic in wireshark. The problem I'm now facing is that I can't get an ...
user avatar
  • 958
2 votes
3 answers
4k views

How to capture contents of the first packet of TCP connections using tcpdump

I'm tasked with monitoring and debugging a SOAP web service, on network level. I can use tcpdump to capture the whole traffic coming from customers on port 80, but I can't limit the capture for every ...
user avatar
  • 161