Tagged Questions

The tag has no wiki summary.

learn more… | top users | synonyms

0
votes
1answer
20 views

Config to make only pcap receive packet

I am trying to use pcap to modify the packet before sending it out. For example, I have a server (running Ubuntu) listening on port 8000. Before it sends out SYN-ACK for incoming SYN packet, I am ...
0
votes
0answers
5 views

Mergecap multithread

I need to merge a lot of pcap files into one. I ran the command "mergecap *.pcap -w outputFile" , and it actually merges the files, but it's really slow. I was wondering if there's a way to launch a ...
1
vote
2answers
79 views

How do capture filters in Wireshark work internally?

I am wondering exactly what happens internally in TShark when I use a capture filter. Specifically, let's say I have the following filter to capture multicast data: host 224.0.26.3 && port ...
1
vote
1answer
149 views

Provide Session Master Key to Wireshark UI?

I'm working on an issue with HTTPS. I suspect its related to client certificates. I want to read some of the encrypted handshake messages that follows the ServerHelloDone message. (Once the ...
0
votes
0answers
22 views

File storage system with metadata-search [duplicate]

I've many files (pcap) and want to tag them with different attributes like frames, protocol-type and so on. example: file1.pcap (frames: 200, type: ip) file2.pcap (frames: 130, type: sercos) ...
0
votes
1answer
399 views

Why does tcpdump take so long to read pcap files?

I am using a third-party tool that captures network traffic as a pcap file during a network test. When I attempt to play these files back, I use the tcpdump tool with the -Aq -r options, and pipe the ...
0
votes
2answers
252 views

Compile Jnetpcap library for ARM platform?

I am trying to execute a java project on arm platform. my code use jnetpcap library. but when i execute the program it shows me an error "/usr/lib/jnetpcap.so: cannot open shared object: no such file ...
0
votes
0answers
25 views

Kismet logs only fragment of data in the XML file

So basically I am running a kismet on my laptop. I wrote a simple parser that gets me some data of interest from the generated XML file. But the problem is, that for whatever reason only a fraction of ...
1
vote
1answer
232 views

How do I flush Moloch?

I've installed Moloch and the documentation is a bit thin. Does anyone know how I can flush both the database and pcap logs to return the system to a freshly installed state? There is a script for ...
2
votes
1answer
201 views

Follow a .pcap file in wireshark like tail -f

I have a .pcap file on my android device, that I can access from my PC with wireshark via smb and wondering if it possible to get a 'Live view' of that file in wireshark. Is there any solution?
0
votes
1answer
228 views

TCPReplay 3.4.4: Unable to find libpcap in /usr

I'm having a problem installing TCPReplay 3.4.4 for Ubuntu 12.04 LTS. I'm getting this error when I run configure checking for libpcap... configure: error: Unable to find libpcap in /usr I have ...
1
vote
1answer
128 views

How to differentiate between three different flavours of pcap files?

There appears to be 3 different file formats associated with the ".pcap" extension -- libpcap /w microsecond timestamps, libpcap /w nanosecond timestamps, and pcapng. Is there an easy way to ...
0
votes
2answers
947 views

Trouble with mergecap [ concatenation of pcap files ] - undesired info in output file

I hope somebody will be able to help me... The problem is with merging multiple .pcap files. Recently - like a week ago I've used a mergecap to merge mutiple pcap files into one. Everything worked ...
2
votes
3answers
40k views

What's all this deploy.akamaitechnologies.com traffic?

I happened to do a tcpdump while leaving my Mac idle, and when I came back after a mere half-hour there were something like 5000 packets involving deploy.akamaitechnologies.com, in which my computer ...
1
vote
1answer
281 views

How to enter pcap filter in Wireshark 1.8?

Previously in capture options window there was a very handy input field for pcap filter expression. But in 1.8.* this window looks different: So, how to set pcap filter expression before starting ...
0
votes
1answer
1k views

How to extract mpeg-1 stream from pcap in wireshark

I have a pcap network dump that has an MPEG-1 stream inside and I would like to play the mpeg stream. So far I've tried playing through the RTP analyzer but that plays without any sound. I've also ...