Questions tagged [pcap]
The pcap tag has no usage guidance.
37
questions
1
vote
0
answers
60
views
kali linux filter by protocol wireshark's pcaps
I spent the last 2h looking for a way to quikly filter pcaps, it seems that it is possible using cmd/bat on windows but I can't find anything for kali linux.
I have a way too big pcap and I want to ...
1
vote
1
answer
230
views
Black hole output interface for tcpreplay
I'm using a command line like this to replay a huge PCAP file at high speed - I'm benchmarking various aspects of tcpreplay:
sudo tcpreplay --mbps=1000 --intf1=docker0 linuxbig_log.pcap
As I don't ...
0
votes
0
answers
227
views
Why is the output of tshark `http.file_data` different from the Content Length?
I've got a PCAP file that has 3,445 HTTP "206 Partial Content" packets for the application/pdf media type. Each of these requests is for the same file, different Content-Ranges are being ...
1
vote
1
answer
803
views
How to use ciscodump?
In wireshark, there is this option called Cisco remote capture: ciscodump, which, from my understanding, should enable to do a tcpdump on a cisco router (for example) via SSH and get back the results ...
1
vote
0
answers
621
views
Generate alert from pcap file with Snort
I'm learning to use snort by myself and I can't figure out if I'm generating alerts from a file well.
The rules i have in local.rules are:
alert icmp any any -> any any (msg:"Testing ICMP"...
0
votes
1
answer
433
views
Wireshark - exports what it recognises as a jpeg but the jpeg doesn't open
I have a JPEG GET request in my PCAP as below but when I export it, it's not a valid JPEG file
Any advice as to what I'm doing wrong?
1
vote
0
answers
526
views
ALFA wifi network card Monitor Mode on Mac OS
I recently bought an ALFA AWUSO36EAC and I want to use it for packet injection and monitor mode on Mac OS. I was told that this is a better page to ask about Network Card related questions. I have ...
0
votes
1
answer
3k
views
tshark how to count the number of returned packets
I am using tshark and i need to findout how many of my 10,0000 packets contain a HTTP URI
Therefore, i have written the line of code that goes as followes:
tshark -r tsharklab.pcap -Y "http....
0
votes
1
answer
348
views
TLS handshake to microsoft.com hangs
Two Linux machines (Ubuntu 20.04 & 18.04.4 running on vSphere) behind NAT are not able to complete the TLS handshake to https://microsoft.com and https://mcr.microsoft.com, while they are able to ...
0
votes
1
answer
224
views
What are the specific requirements for libpcap directional capture support?
I'm using libpcap on Linux to capture network traffic from a wireless adapter (2.4 GHz). The pcap_setdirection seems to allow you to setup the capture device so that it ignores traffic originating ...
0
votes
1
answer
512
views
make a difference between pcap files
I have two pcap files and I want to make the difference between them. And store the difference in another pcap file.
I tried diff command but it's not suitable with the binary files and I used also ...
1
vote
1
answer
339
views
tcpdump: "packet exceeded snapshot"
I am using tcpdump to look into some pcap files, but in the output, I see the following error, instead of getting the header information:
packet exceeded snapshot
I googled it, but I couldn't find ...
1
vote
1
answer
227
views
Weird TCP re-transmission
My question is why a TCP flow make a re-transmission when a network has enough link bandwidth.
For finding a cause, I used a wireshark. I got the below captured at a host side (10.0.0.1)
25434 50....
0
votes
1
answer
2k
views
How to stream captured packets via UDP? tcpdump or other tool
I want to capture traffic or router and send it to remote host via tzcp or other udp proto.
How to stream captured packets via UDP? tcpdump or other tool
Use case:
Linux box connected to internet ...
0
votes
1
answer
9k
views
Snort finding the alert file DATA with snort.logs.xxxxxxx
I'am working on task where my security team is asking me to provide a pcap file under the folder /var/log/snort. They have picked up a source IPADDRESS from an alert file and they need to do more ...
0
votes
1
answer
1k
views
how to program tcpdump to only capture packets and nothing else
I am developing a program where a .pcap file is going to be an input. However, when I run tcpdump -w someFile.pcap ,in Terminal, the .pcap file captures extra data such as timestamp, microseconds, ...
2
votes
3
answers
16k
views
How to filter packets with distinct source address in wireshark?
I have a pcap file and I want to wireshark shows me packets with distinct source address. How can I do this in wireshark?
1
vote
0
answers
2k
views
ethernet interface on Linux drops packets
I'm trying to capture some Ethernet frames with Linux. Some of these packets/frames are invalid and contain corrupted data.
For example an Ethernet frame contains the type 0x0800 which is IPv4, but ...
1
vote
1
answer
2k
views
Wireshark/PCAP XML attributes explained
I'm generating XML-formatted output from a Wireshark dump using the following command:
tshark -r my_wireshark_data.pcap -T pdml > my_wireshark_data.xml
Looking at the XML file generated, I cannot ...
0
votes
1
answer
486
views
Sngrep Unknown File Format Error
I am attempting to use the sngrep utility on a Mac OSX El Capitan 10.11.4 and getting an error when I try to open any pcap file.
The error is as follows:
Johns-MacBook-Pro:Downloads gojira$ sngrep -...
0
votes
1
answer
2k
views
TCPDUMP Rotating Capture File using -G not working
I'm attempting to run a tcpdump for packet capture for the headers of encrypted traffic. I'm trying to do it with the rotating capture based off time. This is the command I'm running.
sudo tcpdump -...
0
votes
1
answer
498
views
How to find 802.11 protocol variant, and decipher packet_payload_info in PcapNG files?
I'm building a (Python) parser of PcapNG files created by Wireshark.
After reading https://www.winpcap.org/ntar/draft/PCAP-DumpFileFormat.html, I'm having the following problems:
I'd like to ...
2
votes
1
answer
1k
views
How to split pcap files maintaining tcp sessions
I have a pcap file which contains tcp traces.
I was wondering if there's a way to split these traces in order to maintain tcp flows, but also filtering the traffic on a src ip basis.
For example, if ...
0
votes
0
answers
732
views
packet sniffing 3ds
I am trying to packet sniff my 3DS just to see what information is available.
With Wireshark I noticed that I can only capture traffic which communicates with my computer directly, and not any device ...
0
votes
1
answer
170
views
Config to make only pcap receive packet
I am trying to use pcap to modify the packet before sending it out. For example, I have a server (running Ubuntu) listening on port 8000. Before it sends out SYN-ACK for incoming SYN packet, I am ...
1
vote
2
answers
1k
views
How do capture filters in Wireshark work internally?
I am wondering exactly what happens internally in TShark when I use a capture filter. Specifically, let's say I have the following filter to capture multicast data:
host 224.0.26.3 && port ...
1
vote
1
answer
3k
views
Provide Session Master Key to Wireshark UI?
I'm working on an issue with HTTPS. I suspect its related to client certificates. I want to read some of the encrypted handshake messages that follows the ServerHelloDone message. (Once the ...
5
votes
1
answer
5k
views
Why does tcpdump take so long to read pcap files?
I am using a third-party tool that captures network traffic as a pcap file during a network test. When I attempt to play these files back, I use the tcpdump tool with the -Aq -r options, and pipe the ...
1
vote
2
answers
1k
views
Compile Jnetpcap library for ARM platform?
I am trying to execute a java project on arm platform. my code use jnetpcap library. but when i execute the program it shows me an error
"/usr/lib/jnetpcap.so: cannot open shared object: no such file ...
1
vote
1
answer
3k
views
How do I flush Moloch?
I've installed Moloch and the documentation is a bit thin. Does anyone know how I can flush both the database and pcap logs to return the system to a freshly installed state?
There is a script for ...
5
votes
2
answers
3k
views
Follow a .pcap file in wireshark like tail -f
I have a .pcap file on my android device, that I can access from my PC with wireshark via smb and wondering if it possible to get a 'Live view' of that file in wireshark.
Is there any solution?
0
votes
1
answer
648
views
TCPReplay 3.4.4: Unable to find libpcap in /usr
I'm having a problem installing TCPReplay 3.4.4 for Ubuntu 12.04 LTS.
I'm getting this error when I run configure
checking for libpcap... configure: error: Unable to find libpcap in /usr
I have ...
1
vote
1
answer
597
views
How to differentiate between three different flavours of pcap files?
There appears to be 3 different file formats associated with the ".pcap" extension -- libpcap /w microsecond timestamps, libpcap /w nanosecond timestamps, and pcapng.
Is there an easy way to ...
1
vote
3
answers
3k
views
Trouble with mergecap [ concatenation of pcap files ] - undesired info in output file
I hope somebody will be able to help me...
The problem is with merging multiple .pcap files. Recently - like a week ago I've used a mergecap to merge mutiple pcap files into one. Everything worked ...
18
votes
2
answers
185k
views
What's all this deploy.akamaitechnologies.com traffic?
I happened to do a tcpdump while leaving my Mac idle, and when I came back after a mere half-hour there were something like 5000 packets involving deploy.akamaitechnologies.com, in which my computer ...
1
vote
1
answer
350
views
How to enter pcap filter in Wireshark 1.8?
Previously in capture options window there was a very handy input field for pcap filter expression. But in 1.8.* this window looks different:
So, how to set pcap filter expression before starting ...
2
votes
2
answers
4k
views
How to extract mpeg-1 stream from pcap in wireshark
I have a pcap network dump that has an MPEG-1 stream inside and I would like to play the mpeg stream. So far I've tried playing through the RTP analyzer but that plays without any sound. I've also ...