12
votes
How to determine which process is sending UDP packets once per hour?
You can easily accomplish this with SysInternals' Process Monitor. Run it as Administrator, then configure it as follows:
On the Filter menu click Filter...
In the first drop down box, select ...
- 3,121
9
votes
tcpdump: capture one of several vlans
It can be done in more simply way than using deep packet exam, just use grep:
tcpdump -n -i eth1 -e | grep "vlan 1000"
-e: Print the link-level header on each dump line.
it will print lines like
...
- 91
5
votes
Copying packets from an interface to another
You can use tc mirred action. For example:
For incoming traffic:
tc qdisc add dev eth0 ingress
tc filter add dev eth0 parent ffff: \
protocol all prio 2 u32 \
match u32 0 0 flowid 1:1 \
...
- 996
4
votes
Accepted
Why do different packet analyzers sometimes produce different results?
The protocol field is the application's best guess at the nature of the protocol. It is not part of the actual capture.
- 109k
4
votes
Is there a way to "replay" a packet capture of a smtp session for the purpose of debugging?
I hate to turn this into a discussion about tools, rather than about the technology involved, but you may want to look into the use of tcpreplay which takes .pcap files and replays them even at the ...
- 32.5k
4
votes
Client sends RST after FIN,ACK
The FIN and RST packets in your flow are not directly related. By sending FIN 10.77.137.106 is signalling that it has no more data to send. It could still receive more data from the other end of the ...
- 30.2k
4
votes
Can user credentials from HTTP session be seen through Wireshark?
If the client passes the user credentials as plain text then yes, it will be possible to see them in the http packets.
- 115k
3
votes
Accepted
How can NETSH be used to sniff and collate network traffic?
Just use netsh trace start capture=yes without any of the other stuff. This gets you just a basic packet capture that you can view in Network Monitor.
You don't need to use the ETW providers like ...
- 55.3k
3
votes
Accepted
Can I use HAProxy's new 'capture' feature to save the remote address in a TCP frontend, and use it as the `X-Forwarded-For` header in an HTTP backend?
To answer my own question, this does not seem possible, as the traffic 'leaves' HAProxy here:
TCP HTTP
frontend->backend (->leaving->) frontend->backend
...
- 402
3
votes
Is there a quick way to determine what applications are present within a Wireshark capture? If so how
WireShark sits too low in the network stack to have any information on which processes sent or received traffic. The trick is to know something about what you're looking for - it shouldn't take that ...
- 15.4k
3
votes
Accepted
Suspicious IP packets on port 53
You have noted that the packets are arriving from outside your organisation, via a NAT rule in your router which translates 86.34.156.51 <-> 10.10.10.100. I reverse-resolve that address, and I get ...
- 79.2k
3
votes
Port forwarding for 100K+ IP's
I do not have an infrastructure at hand to simulate your scenario, but I think using custom iptables chains could help here. These could be utilized to cascade the rules and get away from a huge ...
- 383
2
votes
How can I create a packet capture file on a headless server for a single process?
Another option is to pipe dumpcap output over SSH into wireshark running in on your local machine.
wireshark -k -i <(ssh -l USER REMOTEHOST "dumpcap -i lo -P -w - -f 'not tcp port 22'")
This will ...
- 153
2
votes
How to log all inbound connections on Windows server
In Wireshark (1.12.4 here): you can try on the menu Statistics and use the tools Conversations or Endpoints (whatever it fits your needs), once there you can choose to show connections statistics on ...
2
votes
Accepted
Process names in MS Message Analyzer
It seems to require Windows_Kernel_Trace messages to provide process names. I had the same problem that you did where I applied a session filter before the session start including an IP Address filter....
- 36
2
votes
How can I decrypt STARTTLS communication over SMTP in a packet capture (if I have the private key)?
It may be that the wireshark SMTP protocol parser doesn't know how to handle TLS/SSL. But maybe you can use the HTTP protocol parser instead. Go to edit->preferences->protocols->HTTP and add the port ...
- 27.9k
2
votes
Accepted
How can I decrypt STARTTLS communication over SMTP in a packet capture (if I have the private key)?
Knowledge of the RSA private key is only sufficient if RSA key exchange is done. Modern systems instead use Diffie Helmann key exchange (DHE*, ECDHE* ciphers) to provide forward secrecy. In this case ...
- 12.6k
2
votes
Who can issue a RST?
A RST could be issued by the server or a network device that is interacting with the traffic (such as firewall, VPN concentrator).
Depending on network device and its configuration, it could respond ...
- 111
1
vote
Packet Captures saved in bin file format
I had to create an account at the teradici website, their website just says its in binary format, but they do provide a script in python to convert it to a pcap. KB2484.
The script says i'm not ...
- 288
1
vote
Accepted
How to capture network packets that use SS7 protocol using Wireshark?
Unless you have the ability to perform packet captures within a telco network, you will never see SS7 traffic. For GSM, SS7 usage would be used over the mobile RF network, which not only is encrypted, ...
- 109k
1
vote
Accepted
packet colorization in Wireshark
For some people, Wireshark colouring rules make it easier for "interesting" traffic to pop out, making troubleshooting issues a bit easier.
Head into View > Coloring Rules to see which rules are ...
- 1,113
1
vote
Accepted
How to perform Wiresharks File->Extract Objects->HTTP through Tshark commandline interface?
I don't know if TShark can do it, but you can use Chaosreader instead.
- 991
1
vote
PCAP traffic frame length short
You cannot make .pcap file work properly, non-executale files don't work. However, you probably can make tcpdump work properly, by specifying -s 0 key and recapturing the traffic. If the file is too ...
- 8,500
1
vote
Accepted
How to ping a host with different MTU size to simulate icmpv6 packet too big scenario?
On linux it is ping6 -s <packet_size> your.destination.com.
- 4,619
1
vote
How to log all inbound connections on Windows server
I think you can do what you are asking by turning on logging in Windows Firewall: https://technet.microsoft.com/en-us/library/Cc947815%28v=WS.10%29.aspx#...
- 565
1
vote
Accepted
Is it possible to run 2 concurrent tcpdump with different options?
Yes, its possible. It won't cause conflicts at all.
1
vote
centos doesn't reply to icmp request
You have 2 IPs in the same subnet(82.79.24.74/29) on the same interface (em2):
𝛌 ~ ipcalc 82.79.24.74/29
Address: 82.79.24.74 01010010.01001111.00011000.01001 010
Netmask: 255.255.255....
- 5,651
Only top scored, non community-wiki answers of a minimum length are eligible