Questions tagged [pcap]
PCAP stands for Packet CAPture.
21
questions with no upvoted or accepted answers
3
votes
0
answers
586
views
Modify ip addresses in a socks capture pcap
I have a pcap capture of socks traffic. The traffic goes like -
client_ip <-> 127.0.0.1:9050 <-> destination_ip
Looking at pcap in wireshark, thus, shows:
src_ip = 127.0.0.1
dst_ip = ...
- 131
3
votes
0
answers
2k
views
Can I use tshark to write SSL-decrypted packets to a file?
I have a PCAP file containing SSL-encrypted HTTP traffic and the private key from the relevant web server. I'd like a PCAP file that contains the decrypted HTTP traffic to feed into a different tool. ...
- 375
2
votes
0
answers
240
views
disabling ethernet loopback packets
I have a linux machine with a few network interfaces which I use to run communication tests. In some of the tests I get a lot of packets with ether type 0x9000 (ethernet configuration testing protocol)...
- 151
2
votes
1
answer
857
views
Allowing node.js applications to run libpcap without sudo ("Symlink" issue )
I want to use the following command to allow usage of the libpcap package without to sudo (on a debian system):
sudo setcap 'CAP_NET_RAW+eip CAP_NET_ADMIN+eip' /usr/bin/nodejs
I'm getting this error:...
- 121
2
votes
0
answers
632
views
replay decrypted ssl traffic with tcpreplay
I have an pcap format from some https traffic from one of my web-servers.
So I can use the key from my webserver to decrypt the traffic in wireshark. The problem I'm now facing is that I can't get an ...
- 968
2
votes
1
answer
2k
views
Freeradius server is not accepting accounting packets through tcpreplay
I am running a free radius server on system A. I am sending test accounting requests using radclient radclient -x systemA acct testing123 from system B. I can see that the radius server recieved these ...
- 131
1
vote
0
answers
66
views
Why does snort can not alert this pcap?
the rule is
alert tcp any any <> any any (sid:11111;content:"GET";)
a file named http.pcap,in which has content
GET /s?wd=%E7%99%BE%E5%BA%A6 HTTP/1.0
a config file named 1.conf
...
- 11
1
vote
0
answers
215
views
How can I capture traffic for a daemon listening on a cloned loopback IP address?
I have a daemon listening on a virtual IP address attached to a cloned loopback interface (lo1) on FreeBSD 11.x.
Inbound traffic for that daemon could arrive on several different physical interfaces, ...
- 21.4k
1
vote
0
answers
4k
views
How do i convert text capture files back to pcap files?
I have opened Wireshark, selected the a.pcap file, and then went to File->Export and chose (K12 text file) to convert to text. Result is a.txt file.
How can I convert back a.txt file to original pcap ...
- 111
1
vote
0
answers
80
views
Slow VPN performance - TCP Issue?
I am having issues with the performance of a VPN, it is just one VPN in particular and I have captured the following PCAP from the server in question.
My understanding is that the "Ack" field should ...
- 149
1
vote
1
answer
194
views
How to leave promiscuous mode in dnscap?
How to leave promiscuous mode in dnscap?
dnscap -a makes no difference.
- 858
0
votes
0
answers
125
views
Method of streaming a packet capture from a Windows machine
I have a Windows 10 VM on Hyper-V. It is a production system (yeah I know) that is running multiple critical services that I need to analyse so I can migrate it off to something better. I need to ...
- 1
0
votes
1
answer
2k
views
Linux: bridge vs. vlan vs. tcpdump
I have a Proxmox host with kernel 5.15.19-2-pve.
It has a bond0 interface made from eth2 and eth3, which receives vlan tagged traffic.
I created a vmbr666 bridge that shows looks like this:
# /etc/...
- 681
0
votes
1
answer
178
views
Can I determine a EWOULDBLOCK/EAGAIN situation from a pcap/tcpdump
Is there a way I can determine if a certain message resulted in an EWOULDBLOCK/EAGAIN return code to the server which sent the packet?
The server was sending messages to the client
At time 10,the ...
- 133
0
votes
1
answer
806
views
Pcap (tcpdump) filter to match against local port
I'm trying to write a libpcap (tcpdump, iftop) filter that would match packets having a specific local port.
That is, I'm interested in traffic that either goes out of port 12345 on the local machine ...
- 144
0
votes
1
answer
1k
views
Retrieve data from wireshark (PCAPNG)
I have a PCAPNG file and I need to retrieve two files from it, one is a TXT and the other one is a PNG. The provided file does not have FTP-DATA, it only have ARP, DHCP, DNS, FTP, HTTP, IGMPv3, OCSP, ...
0
votes
1
answer
214
views
Filter pcap by subsecond detail?
I'm trying to export a subset of a pcap file given a start and an end message, this start and end message identification is currently done using ngrep on the raw data(because we have no dissector for ...
- 113
0
votes
1
answer
377
views
how can i export sflow data to be saved in pcap on other server in realtime?
I have a pfsense server, all of attacks will come to its WAN interface. i have setup another packet analysis tool on private network behind pfsense. i want to send realtime WAN traffic from pfsense ...
- 4,309
0
votes
0
answers
173
views
http timing stats from tcp trace
I am trying to find a tool to extract HTTP timing stats from network traces; namely time to connect, time to first byte, total time to serve.I am talking about very large traces with millions of ...
- 1
0
votes
1
answer
109
views
MCU packet capture
I am trying to do a packet capture of a video conference hosted with CISCO [Codian] MCU. The instructions for capturing SIP packets with Wireshark are available. I also configured MCU to accept SIP ...
- 207
-1
votes
1
answer
890
views
SSH connection not established, but standard TCP/IP connection works
I'm working on a custom yocto Linux for a Raspberry PI 3 and try to get the WIFI connection working with SSH. However when trying to connect from my PC (Ubuntu 19.10, SSH OpenSSH_8.0p1 Ubuntu-6build1, ...
- 1