The tag has no usage guidance.

learn more… | top users | synonyms

0
votes
1answer
31 views

Sngrep Unknown File Format Error

I am attempting to use the sngrep utility on a Mac OSX El Capitan 10.11.4 and getting an error when I try to open any pcap file. The error is as follows: Johns-MacBook-Pro:Downloads gojira$ sngrep ...
0
votes
1answer
51 views

TCPDUMP Rotating Capture File using -G not working

I'm attempting to run a tcpdump for packet capture for the headers of encrypted traffic. I'm trying to do it with the rotating capture based off time. This is the command I'm running. sudo tcpdump ...
0
votes
0answers
94 views

packets information in tcpdump /capinfos

I'm testing the packet capture efficiency of a sniffer application (netsniff-ng) w.r.t a proprietary sniffer recorder. I had a linux system use tcpreplay to send 25 pcap files @ 100Mbps to both the ...
0
votes
1answer
82 views

How to find 802.11 protocol variant, and decipher packet_payload_info in PcapNG files?

I'm building a (Python) parser of PcapNG files created by Wireshark. After reading https://www.winpcap.org/ntar/draft/PCAP-DumpFileFormat.html, I'm having the following problems: I'd like to ...
1
vote
0answers
170 views

How to split pcap files maintaining tcp sessions

I have a pcap file which contains tcp traces. I was wondering if there's a way to split these traces in order to maintain tcp flows, but also filtering the traffic on a src ip basis. For example, if ...
0
votes
0answers
194 views

packet sniffing 3ds

I am trying to packet sniff my 3DS just to see what information is available. With Wireshark I noticed that I can only capture traffic which communicates with my computer directly, and not any device ...
0
votes
1answer
93 views

Config to make only pcap receive packet

I am trying to use pcap to modify the packet before sending it out. For example, I have a server (running Ubuntu) listening on port 8000. Before it sends out SYN-ACK for incoming SYN packet, I am ...
1
vote
2answers
414 views

How do capture filters in Wireshark work internally?

I am wondering exactly what happens internally in TShark when I use a capture filter. Specifically, let's say I have the following filter to capture multicast data: host 224.0.26.3 && port ...
1
vote
1answer
886 views

Provide Session Master Key to Wireshark UI?

I'm working on an issue with HTTPS. I suspect its related to client certificates. I want to read some of the encrypted handshake messages that follows the ServerHelloDone message. (Once the ...
1
vote
1answer
2k views

Why does tcpdump take so long to read pcap files?

I am using a third-party tool that captures network traffic as a pcap file during a network test. When I attempt to play these files back, I use the tcpdump tool with the -Aq -r options, and pipe the ...
0
votes
2answers
602 views

Compile Jnetpcap library for ARM platform?

I am trying to execute a java project on arm platform. my code use jnetpcap library. but when i execute the program it shows me an error "/usr/lib/jnetpcap.so: cannot open shared object: no such file ...
1
vote
1answer
515 views

How do I flush Moloch?

I've installed Moloch and the documentation is a bit thin. Does anyone know how I can flush both the database and pcap logs to return the system to a freshly installed state? There is a script for ...
2
votes
1answer
445 views

Follow a .pcap file in wireshark like tail -f

I have a .pcap file on my android device, that I can access from my PC with wireshark via smb and wondering if it possible to get a 'Live view' of that file in wireshark. Is there any solution?
0
votes
1answer
326 views

TCPReplay 3.4.4: Unable to find libpcap in /usr

I'm having a problem installing TCPReplay 3.4.4 for Ubuntu 12.04 LTS. I'm getting this error when I run configure checking for libpcap... configure: error: Unable to find libpcap in /usr I have ...
1
vote
1answer
210 views

How to differentiate between three different flavours of pcap files?

There appears to be 3 different file formats associated with the ".pcap" extension -- libpcap /w microsecond timestamps, libpcap /w nanosecond timestamps, and pcapng. Is there an easy way to ...
0
votes
2answers
2k views

Trouble with mergecap [ concatenation of pcap files ] - undesired info in output file

I hope somebody will be able to help me... The problem is with merging multiple .pcap files. Recently - like a week ago I've used a mergecap to merge mutiple pcap files into one. Everything worked ...
9
votes
2answers
99k views

What's all this deploy.akamaitechnologies.com traffic?

I happened to do a tcpdump while leaving my Mac idle, and when I came back after a mere half-hour there were something like 5000 packets involving deploy.akamaitechnologies.com, in which my computer ...
1
vote
1answer
322 views

How to enter pcap filter in Wireshark 1.8?

Previously in capture options window there was a very handy input field for pcap filter expression. But in 1.8.* this window looks different: So, how to set pcap filter expression before starting ...
0
votes
1answer
2k views

How to extract mpeg-1 stream from pcap in wireshark

I have a pcap network dump that has an MPEG-1 stream inside and I would like to play the mpeg stream. So far I've tried playing through the RTP analyzer but that plays without any sound. I've also ...