Questions tagged [sniffing]
The sniffing tag has no usage guidance.
31
questions
15
votes
3
answers
84k
views
tcpdump: capture one of several vlans
I want tcpdump to capture VLAN 1000 or VLAN 501. man pcap-filter says:
The vlan [vlan_id] expression may be used more than once, to filter on VLAN hierarchies. Each use of that expression ...
- 471
10
votes
5
answers
3k
views
A website hosted on the 1.0.0.0/8 subnet, somewhere on the Internet?
Background
I'm attempting to demonstrate, using a real-world example, of why someone would not want to configure their internal network on the 1.0.0.0/8 subnet. Obviously it's because this is not ...
- 378
4
votes
2
answers
2k
views
tcpdump file size == traffic size?
I created a tcpdump file:
tcpdump -i eth0 host xxx.208.xxx.59 -n -s 0 -vvv -w /tmp/dump.dmp
duration was about 3 hours.
This file now has 450 MB. Can I say now that the IP xxx.208.xxx.59 generated ...
- 165
4
votes
1
answer
747
views
sniff mobile traffic data
I'm now preparing an automation testing lab for our mobile department consisting of mainly android devices.
For first phase i need HTTP device sniffing, i can't do it on the device as they are not ...
- 157
3
votes
1
answer
28k
views
How do I capture all packets on local wifi network using Wireshark settings -
I'm attempting to replicate a 'wifi cafe' setup in a home lab environment. I'd like to demonstrate that unencrypted (non-HTTPS) network traffic on a wifi network can be viewed by other wireless ...
- 172
2
votes
4
answers
787
views
Can I read data being sent to/from other computers?
Let's say sniff program is installed on computer A. And let's say I am looking at a Youtube video on the computer B.
Can the sniff program see what computer B is doing?
If that's possible, witch ...
- 21
2
votes
4
answers
1k
views
Can one server see traffic to another server inside a VLAN?
Scenario: I have a rack of servers that all belong to the same private VLAN. I transfer data from Server 1 to Server 2. Is it possible for any of the other servers to sniff out the data sent or is ...
- 800
2
votes
2
answers
3k
views
Monitor where an application is connecting to on MacOSX
I just downloaded wireshark for mac as I am trying to find out exactly where an app is connecting. I need to see the URL and the protocol whether it is https or http.
I am very new to Wireshark and ...
- 121
2
votes
1
answer
1k
views
Cisco ASA 5500 -- List of outbound connections?
Is there a command or GUI option to get a list of outbound connections. Ideally, I'd like to know the internal IP address, the external IP address, and the remote port used.
I don't need a lot of ...
- 651
2
votes
1
answer
752
views
How to Monitor and Log Port Usage and Destination Attempts of a local computer from a Linux Gateway?
I have access to a linux server that is acting as the gateway to an internal network.
There is a MagicJack Plus device plugged into this network via CAT5.
The MagicJack gets its ip via DHCP from the ...
- 1,530
1
vote
1
answer
4k
views
Passive ethernet tap [closed]
I'm having an hard time figuring out why can't I capture the packets flowing between two devices, in both directions, using a self made Ethernet tap, with copper cable, which looks just like this one:
...
- 137
1
vote
2
answers
3k
views
Can't decrypt imaps traffic in Wireshark
I have currently problems to decrypt IMAPS Traffic in Wireshark.
I set up the SSL Key with the correct IP Address, Port 993 and Protocol imap. The Key is the correct one.
That is what I see in the ...
- 195
1
vote
1
answer
421
views
Is it possible to capture traffic to the remote web server
I noticed that my user name and password is sent bare text to the remote server inside HTTP POST request. This is a sniffed packed from Wireshark
POST /***URL*** HTTP/1.1
Host: ***DNS NAME***
Content-...
- 266
1
vote
1
answer
179
views
Port mirroring, 1 source, two destination disadvantages [closed]
What are the disadvantages of having two port mirroring sessions?
I have a Cisco 2960 switch in which there is one session having Gi0/1 as source and Fa0/48 as destination.
Is it possible to ...
- 111
1
vote
2
answers
2k
views
Thomson TG585v7 router - promiscuous mode
I have a TG585v7 as a router with several machines plugged into it. In the default setup, the packets are only delivered to the specific machine but I want to be able to setup to monitor all network ...
- 141
1
vote
0
answers
299
views
Sniffing packets over a wifi network, with or without monitor mode using wireshark
So, I am actually confused, there are some guides that say you can't just capture traffic on wireless LAN with promiscuous mode and you need to setup monitor mode, also enter the wifi password to be ...
- 111
1
vote
0
answers
2k
views
What's the meaning of this binary sequence arriving at my http server?
I'm running a http server written in Rebol and sometimes I see that the server is woken by data like this arriving at port 80
...
- 111
1
vote
0
answers
173
views
Am I being picked up by a proxy sending my IP/request URLs to China? Sketchy
I spun up a new machine on Digital Ocean today which is pre-configured with a web environment. I made an initial request to the new site and found the following (IP address redacted) in my nginx ...
- 168
1
vote
1
answer
859
views
tshark not recognizing wpa psk option
I'm trying to decrypt captured wpa-psk traffic with tshark, but it's not recognizing the option I'm trying to override. This option allows me to specify a PSK to use for decrypting. I'm using tshark 1....
- 327
1
vote
0
answers
191
views
Configure SilkPerformer to work with Fiddler
Does anyone know how to capture a Silk Performer HTTP request, using Fiddler?
We can't seem to capture this information no matter what we try (it seems like it ignores all proxy settings).
- 155
0
votes
1
answer
7k
views
Outgoing IP Packet Capture and Logging with iptables
My goal is to use ipset lists in iptables to log outbound traffic to certain IP addresses. I intend to monitor an entire network passively.
I have port mirroring enabled and the port mirrored ...
- 1
0
votes
2
answers
3k
views
Problem with WireShark (MySQL sniffing)
How can I snif MySQL data using WireShark? Also I used «mysqlsniffer» and have no results. There are no any packets from MySQL. I've filtered by «MySQL.isPresent» in WireShark but nothing happened.
...
- 337
0
votes
2
answers
801
views
Is it possible to sniff packets of other users on connected over LAN in a workspace or college lab? [closed]
I am asking this (for educational purposes) to be alert if this kind of thing happens to me.
- 101
0
votes
1
answer
705
views
How to perform Wiresharks File->Extract Objects->HTTP through Tshark commandline interface?
Using TShark, I want to be able to extract the payload in HTTP response from packets data captured through tshark in a .pcap file.
In the Wireshark GUI, I was able to do that by File > Extract ...
- 23
0
votes
1
answer
5k
views
How to trigger DHCP request and inspect the reply from DHCP server
Is it possible to trigger a DHCP request from my DHCP server and then sniff and inspect the whole DHCP reply from the server to see what options/parameters it sends to the clients?
- 3
0
votes
0
answers
8k
views
Error 10061: No connection could be made because the target machine actively refused it
I have recently installed a (cross platform) client server application consisting of a web server backend and a thick (dumb) desktop client.
I have been able to connect to the server and run the ...
0
votes
0
answers
200
views
In the output of Chaosreader, where are the source and destination port numbers and IP addresses for each packet?
I used this tutorial to use Chaosreader on an output file of WinDump. My purpose was to get the HTTP payload, which I got. But I'd also like to extract other information, like source IP and ...
- 23
0
votes
1
answer
744
views
Log http data in unique files using tcpick
I'm trying to use tcpick to log http data in unique files (client and server mixed together). This is one of the examples from tcpick's man page:
$ tcpick -i eth0 "port 80" -wRub
I expected this to ...
- 545
-1
votes
1
answer
250
views
Suspicious redirection to russian pages. Is government spying us? [closed]
Recently when I browse some multi-language websites, the default language becomes Russian.
An example is www.amd.com which redirects me to http://www.amd.com/ru/Pages/AMDHomePage.aspx
I am sure I ...
- 581
-3
votes
1
answer
3k
views
Why can't I "decode" packets using Wireshark and some wireless network?
Re,
I have no problem capturing packets on various wireless hotspots but there are a couple in my town that I just cannot understand why packets aren't being captured, other than those of my own. ...
- 1
-4
votes
2
answers
2k
views
Getting IP addresses through sniffing [closed]
Is it possible to know the gateway address of a wireless AP that I'm not connected to through sniffing? Airodump-ng can show MAC addresses of the AP and the clients associated but doesn't show IP ...
- 1