The tag has no wiki summary.

learn more… | top users | synonyms

1
vote
2answers
57 views

How do capture filters in Wireshark work internally?

I am wondering exactly what happens internally in TShark when I use a capture filter. Specifically, let's say I have the following filter to capture multicast data: host 224.0.26.3 && port ...
1
vote
1answer
106 views

Provide Session Master Key to Wireshark UI?

I'm working on an issue with HTTPS. I suspect its related to client certificates. I want to read some of the encrypted handshake messages that follows the ServerHelloDone message. (Once the ...
0
votes
0answers
22 views

File storage system with metadata-search [duplicate]

I've many files (pcap) and want to tag them with different attributes like frames, protocol-type and so on. example: file1.pcap (frames: 200, type: ip) file2.pcap (frames: 130, type: sercos) ...
0
votes
1answer
322 views

Why does tcpdump take so long to read pcap files?

I am using a third-party tool that captures network traffic as a pcap file during a network test. When I attempt to play these files back, I use the tcpdump tool with the -Aq -r options, and pipe the ...
0
votes
2answers
225 views

Compile Jnetpcap library for ARM platform?

I am trying to execute a java project on arm platform. my code use jnetpcap library. but when i execute the program it shows me an error "/usr/lib/jnetpcap.so: cannot open shared object: no such file ...
0
votes
0answers
24 views

Kismet logs only fragment of data in the XML file

So basically I am running a kismet on my laptop. I wrote a simple parser that gets me some data of interest from the generated XML file. But the problem is, that for whatever reason only a fraction of ...
1
vote
1answer
214 views

How do I flush Moloch?

I've installed Moloch and the documentation is a bit thin. Does anyone know how I can flush both the database and pcap logs to return the system to a freshly installed state? There is a script for ...
2
votes
1answer
183 views

Follow a .pcap file in wireshark like tail -f

I have a .pcap file on my android device, that I can access from my PC with wireshark via smb and wondering if it possible to get a 'Live view' of that file in wireshark. Is there any solution?
0
votes
1answer
225 views

TCPReplay 3.4.4: Unable to find libpcap in /usr

I'm having a problem installing TCPReplay 3.4.4 for Ubuntu 12.04 LTS. I'm getting this error when I run configure checking for libpcap... configure: error: Unable to find libpcap in /usr I have ...
1
vote
1answer
123 views

How to differentiate between three different flavours of pcap files?

There appears to be 3 different file formats associated with the ".pcap" extension -- libpcap /w microsecond timestamps, libpcap /w nanosecond timestamps, and pcapng. Is there an easy way to ...
0
votes
2answers
915 views

Trouble with mergecap [ concatenation of pcap files ] - undesired info in output file

I hope somebody will be able to help me... The problem is with merging multiple .pcap files. Recently - like a week ago I've used a mergecap to merge mutiple pcap files into one. Everything worked ...
2
votes
3answers
38k views

What's all this deploy.akamaitechnologies.com traffic?

I happened to do a tcpdump while leaving my Mac idle, and when I came back after a mere half-hour there were something like 5000 packets involving deploy.akamaitechnologies.com, in which my computer ...
1
vote
1answer
280 views

How to enter pcap filter in Wireshark 1.8?

Previously in capture options window there was a very handy input field for pcap filter expression. But in 1.8.* this window looks different: So, how to set pcap filter expression before starting ...
0
votes
1answer
1k views

How to extract mpeg-1 stream from pcap in wireshark

I have a pcap network dump that has an MPEG-1 stream inside and I would like to play the mpeg stream. So far I've tried playing through the RTP analyzer but that plays without any sound. I've also ...