Questions tagged [sniffing]
The sniffing tag has no usage guidance.
31
questions
0
votes
0answers
95 views
Sniffing packets over a wifi network, with or without monitor mode using wireshark
So, I am actually confused, there are some guides that say you can't just capture traffic on wireless LAN with promiscuous mode and you need to setup monitor mode, also enter the wifi password to be ...
0
votes
0answers
600 views
What's the meaning of this binary sequence arriving at my http server?
I'm running a http server written in Rebol and sometimes I see that the server is woken by data like this arriving at port 80
...
0
votes
2answers
64 views
Is it possible to sniff packets of other users on connected over LAN in a workspace or college lab? [closed]
I am asking this (for educational purposes) to be alert if this kind of thing happens to me.
2
votes
1answer
21k views
How do I capture all packets on local wifi network using Wireshark settings -
I'm attempting to replicate a 'wifi cafe' setup in a home lab environment. I'd like to demonstrate that unencrypted (non-HTTPS) network traffic on a wifi network can be viewed by other wireless ...
2
votes
2answers
966 views
Monitor where an application is connecting to on MacOSX
I just downloaded wireshark for mac as I am trying to find out exactly where an app is connecting. I need to see the URL and the protocol whether it is https or http.
I am very new to Wireshark and ...
0
votes
0answers
6k views
Error 10061: No connection could be made because the target machine actively refused it
I have recently installed a (cross platform) client server application consisting of a web server backend and a thick (dumb) desktop client.
I have been able to connect to the server and run the ...
0
votes
0answers
146 views
In the output of Chaosreader, where are the source and destination port numbers and IP addresses for each packet?
I used this tutorial to use Chaosreader on an output file of WinDump. My purpose was to get the HTTP payload, which I got. But I'd also like to extract other information, like source IP and ...
0
votes
1answer
318 views
How to perform Wiresharks File->Extract Objects->HTTP through Tshark commandline interface?
Using TShark, I want to be able to extract the payload in HTTP response from packets data captured through tshark in a .pcap file.
In the Wireshark GUI, I was able to do that by File > Extract ...
1
vote
0answers
145 views
Am I being picked up by a proxy sending my IP/request URLs to China? Sketchy
I spun up a new machine on Digital Ocean today which is pre-configured with a web environment. I made an initial request to the new site and found the following (IP address redacted) in my nginx ...
0
votes
1answer
3k views
How to trigger DHCP request and inspect the reply from DHCP server
Is it possible to trigger a DHCP request from my DHCP server and then sniff and inspect the whole DHCP reply from the server to see what options/parameters it sends to the clients?
2
votes
4answers
652 views
Can one server see traffic to another server inside a VLAN?
Scenario: I have a rack of servers that all belong to the same private VLAN. I transfer data from Server 1 to Server 2. Is it possible for any of the other servers to sniff out the data sent or is ...
4
votes
1answer
553 views
sniff mobile traffic data
I'm now preparing an automation testing lab for our mobile department consisting of mainly android devices.
For first phase i need HTTP device sniffing, i can't do it on the device as they are not ...
2
votes
1answer
967 views
Cisco ASA 5500 — List of outbound connections?
Is there a command or GUI option to get a list of outbound connections. Ideally, I'd like to know the internal IP address, the external IP address, and the remote port used.
I don't need a lot of ...
0
votes
1answer
5k views
Outgoing IP Packet Capture and Logging with iptables
My goal is to use ipset lists in iptables to log outbound traffic to certain IP addresses. I intend to monitor an entire network passively.
I have port mirroring enabled and the port mirrored ...
1
vote
1answer
4k views
Passive ethernet tap [closed]
I'm having an hard time figuring out why can't I capture the packets flowing between two devices, in both directions, using a self made Ethernet tap, with copper cable, which looks just like this one:
...
1
vote
1answer
167 views
Port mirroring, 1 source, two destination disadvantages [closed]
What are the disadvantages of having two port mirroring sessions?
I have a Cisco 2960 switch in which there is one session having Gi0/1 as source and Fa0/48 as destination.
Is it possible to ...
1
vote
1answer
743 views
tshark not recognizing wpa psk option
I'm trying to decrypt captured wpa-psk traffic with tshark, but it's not recognizing the option I'm trying to override. This option allows me to specify a PSK to use for decrypting. I'm using tshark 1....
0
votes
1answer
619 views
Log http data in unique files using tcpick
I'm trying to use tcpick to log http data in unique files (client and server mixed together). This is one of the examples from tcpick's man page:
$ tcpick -i eth0 "port 80" -wRub
I expected this to ...
1
vote
0answers
177 views
Configure SilkPerformer to work with Fiddler
Does anyone know how to capture a Silk Performer HTTP request, using Fiddler?
We can't seem to capture this information no matter what we try (it seems like it ignores all proxy settings).
2
votes
1answer
451 views
How to Monitor and Log Port Usage and Destination Attempts of a local computer from a Linux Gateway?
I have access to a linux server that is acting as the gateway to an internal network.
There is a MagicJack Plus device plugged into this network via CAT5.
The MagicJack gets its ip via DHCP from the ...
3
votes
2answers
1k views
tcpdump file size == traffic size?
I created a tcpdump file:
tcpdump -i eth0 host xxx.208.xxx.59 -n -s 0 -vvv -w /tmp/dump.dmp
duration was about 3 hours.
This file now has 450 MB. Can I say now that the IP xxx.208.xxx.59 generated ...
1
vote
2answers
2k views
Thomson TG585v7 router - promiscuous mode
I have a TG585v7 as a router with several machines plugged into it. In the default setup, the packets are only delivered to the specific machine but I want to be able to setup to monitor all network ...
1
vote
2answers
2k views
Can't decrypt imaps traffic in Wireshark
I have currently problems to decrypt IMAPS Traffic in Wireshark.
I set up the SSL Key with the correct IP Address, Port 993 and Protocol imap. The Key is the correct one.
That is what I see in the ...
-4
votes
2answers
1k views
Getting IP addresses through sniffing [closed]
Is it possible to know the gateway address of a wireless AP that I'm not connected to through sniffing? Airodump-ng can show MAC addresses of the AP and the clients associated but doesn't show IP ...
2
votes
4answers
375 views
Can I read data being sent to/from other computers?
Let's say sniff program is installed on computer A. And let's say I am looking at a Youtube video on the computer B.
Can the sniff program see what computer B is doing?
If that's possible, witch ...
1
vote
1answer
289 views
Is it possible to capture traffic to the remote web server
I noticed that my user name and password is sent bare text to the remote server inside HTTP POST request. This is a sniffed packed from Wireshark
POST /***URL*** HTTP/1.1
Host: ***DNS NAME***
Content-...
0
votes
2answers
3k views
Problem with WireShark (MySQL sniffing)
How can I snif MySQL data using WireShark? Also I used «mysqlsniffer» and have no results. There are no any packets from MySQL. I've filtered by «MySQL.isPresent» in WireShark but nothing happened.
...
-1
votes
1answer
235 views
Suspicious redirection to russian pages. Is government spying us? [closed]
Recently when I browse some multi-language websites, the default language becomes Russian.
An example is www.amd.com which redirects me to http://www.amd.com/ru/Pages/AMDHomePage.aspx
I am sure I ...
10
votes
5answers
3k views
A website hosted on the 1.0.0.0/8 subnet, somewhere on the Internet?
Background
I'm attempting to demonstrate, using a real-world example, of why someone would not want to configure their internal network on the 1.0.0.0/8 subnet. Obviously it's because this is not ...
-3
votes
1answer
3k views
Why can't I “decode” packets using Wireshark and some wireless network?
Re,
I have no problem capturing packets on various wireless hotspots but there are a couple in my town that I just cannot understand why packets aren't being captured, other than those of my own. ...
12
votes
3answers
61k views
tcpdump: capture one of several vlans
I want tcpdump to capture VLAN 1000 or VLAN 501. man pcap-filter says:
The vlan [vlan_id] expression may be used more than once, to filter on VLAN hierarchies. Each use of that expression ...
