Sniffing is the act of passively collecting all network traffic that a machine hears, whether or not it is addressed to that machine. Commonly performed for network diagnostics, programming debugging and troubleshooting, and security analysis.
0
votes
1answer
34 views
How can I capture packets belonging to a certain process
I need to capture packets belonging to a program or process. I know Winshark, but it just displays network traffic in a mess (in my view).
If one wants to get the packets of a given process, you must ...
0
votes
0answers
20 views
Actual Destination IP instead of Proxy's IP in traffic capture
I want to capture the network traffic of my host through wireshark and need to get the source and destination ip addresses from the packets. The problem I am facing is that I am behind Proxy Server ...
0
votes
0answers
50 views
Check whether a packet contains some fields and then log all subsequent ones in Wireshark
How can I write a filter in Wireshark that checks if the first packet has some field, then checks the new packets for another field, and if they matched, show what you got:
if (someone has my valid ...
0
votes
2answers
36 views
Is sending syslog events over udp secure?
I'm considering using a service from papertrailapp.com (other similar services are loggly and splunk), where you configure your syslog to echo events to it over udp. It involves adding this entry to ...
0
votes
2answers
156 views
Wireshark - Help seeing all network traffic
I have a Ralink RT3290 802.11bgn Wi-Fi Adapter and am running Windows 8. Sadly although my new computer helps in the design and testing of my touch based applications, my Network Engineering abilities ...
0
votes
1answer
30 views
Need a creditable source on specifics of Promiscuous and Monitor WNIC modes?
Having searched a great deal of websites to find an explicit statement about the specifics of Promiscuous and Monitor mode as used in WNICs, I finally found this in Spiff's answer to: Wireless Card ...
4
votes
2answers
54 views
wifi router is masking ip addresses
I have a rookie question regarding routing and wifi access points.
Background
I have a main switch (cisco catalyst 2950) that sits behind my router/firewall. On that switch I have an IDS (snort) ...
1
vote
1answer
67 views
Lightweight network packet capture solution for windows? [closed]
I'm looking for a lightweight packet capture solution for Windows. It needs to capture all packets on a physical network device and write them to a file (preferably .pcap, because that's easiest for ...
0
votes
0answers
84 views
Web sniffer / HTTP viewer [migrated]
I am aware of the following sites that allow you to inspect the particulars of an HTTP transaction with most websites:
http://web-sniffer.net
HTTP & HTTPS
Only bookmark result if HTTP header ...
1
vote
2answers
60 views
Tracking information on HTTPS connection
My organization uses cyberoam firewall. They are monitoring all activities including my search text in Google, Wikipedia etc. So recently i changed to HTTPS versions and now using HTTPS connections of ...
1
vote
1answer
145 views
SSH tunneling commands for better security and privacy
i have a centos 6 VPS.
I use ssh -p 443 -D 8080 -f -C -N root@ip on mac terminal for SSH tunneling but with wireshark when i sniff my traffic i can see DNS requests are not encrypted ! (i use ...
0
votes
3answers
264 views
Sniff traffic coming from one particular application?
Basically I'd like to sniff HTTP requests made by an .exe on Windows. I tried using wireshark, but it's somewhat unhandy since it sniffs all traffic on the interface. Are there any alternatives?
0
votes
1answer
159 views
Looking for a simple home network analyzer for Windows/OS X
My home wireless network has gotten horribly slow and I'd like to figure out which of the various computers connected (and ideally what program on that machine) is eating up all of the bandwidth. Is ...
2
votes
3answers
118 views
Are SSH protocol headers sent in the clear over a client-server connection?
I know routing information is always sent in the clear (oversimplification, but bear with me) so in a scenario where there exists an SSH tunnel between a client and a server using non-standard ports, ...
0
votes
1answer
1k views
Sniffing and logging HTTP Traffic through my wireless router
This is probably a newb question, so sorry for that.
I want to sniff traffic going through my wireless router. The router is provided by my cable company, so I don't want to flash the firmware or ...
1
vote
2answers
405 views
What can I use to track application internet usage? [closed]
I want to see what connections my Modern UI apps are making, and more specifically, where they are sending information, what the protocol looks like, headers, etc. Is there a program that can help me ...
0
votes
1answer
96 views
Why do DNS queries use loopback interface?
Sniffing (using Wireshark), for didactical purpose, my loopback interface on Ubuntu 12.04, I noticed that a lot of DNS queries (maybe ALL of them) have 127.0.0.1 as source and destination address.
...
1
vote
1answer
187 views
Need advice on using Wireshark + aircrack-ng
I am making acquiantance with wireless security and attacks and was told to run some tests with aircrack-ng and wireshark.
So I installed both of them and ran airmon to switch wi-fi card to monitor ...
3
votes
4answers
199 views
Download videos from youtube as I see it
This may seem a somewhat strange requirement : I want to download youtube videos as I see it. I know that I would have to capture the packets using a program like wireshark , and I do know that this ...
-1
votes
1answer
158 views
Monitor and view contents of incoming and outgoing internet traffic in Windows [duplicate]
Possible Duplicate:
Software for measuring internet traffic?
In the Chrome developer tools, I can easily monitor traffic that comes into and out of the browser.
Is there a way to monitor ...
0
votes
0answers
156 views
Weird connection attempt. Need TCP packet analyzer / Firewall to analyze it without allowing
When I switched on my computer today, my firewall alerted me that svchost.exe is trying to connect to 87.245.215.72 on the HTTP port 80. This didn't happen before, I have all the updates and stuff ...
0
votes
0answers
27 views
downloading (grabbing) streaming quicktime media on page
I would like to download some quicktime media files for editing in audacity into smaller, digestible clips.
I have tried Orbit downloader and it's grab++ tool, and I can't get the file.
This is the ...
1
vote
1answer
156 views
Unknown Inbound UTP Packets
I need some help figuring out something. I was looking at my network traffic using Wireshark and I saw a bunch of inbound UTP (uTorrent Transport Protocol) packets to my IP. About 10 different IP's ...
0
votes
0answers
163 views
Capture and Display Filters for HTTP/HTTPS using TCPDump or TShark
I am running CentOS v5.8 64bit. What are the correct capture and display filters to use in TCPDump or TShark to monitor and trace HTTP/HTTPS traffic similar to what is provided by HTTPWatch?
Also, ...
2
votes
2answers
307 views
Program to record data transmission between two computers using a TCP port
I am looking for a way to view data being transmitted over a TCP port between two computers.
Is there a software package that allows this? I suppose I could script something to re-route data coming ...
0
votes
0answers
31 views
how can i capture packets from my router to a server [duplicate]
Possible Duplicate:
How can I capture packets going from my router to a specific server?
I have a small local network in my house that has two computers connected to a modem-router. i would ...
1
vote
4answers
4k views
How can I capture packets going from my router to a specific server?
I have a small local network in my house that has two computers connected to a modem-router.
I want to capture the packets going from the router to a specific server (I know the IP address of the ...
1
vote
1answer
159 views
How to disable network traffic on windows 7
I am having Windows 7 hosted on VMWare which is running on Windows7 as well. My guest W7 is using my client network card as NAT.
Now i want to monitor some traffic from some specfic website. I ...
-3
votes
1answer
179 views
How to read data from ethernet through lan cable [closed]
I want to read raw ethernet data from a PC. What software can I use to capture data to and from a TCP/IP server?
In our project we have a PLC that has an ethernet RJ45 socket and serial RS485 plug. ...
1
vote
0answers
211 views
How to get data from sniffed usb communication?
we are trying to get raw measurement data from one usb sensor as the control software is a black box and the manual does not contain anything about how it process the measurements.
I was able to ...
0
votes
1answer
208 views
HDI: Capture specific content types in wireshark?
I've been tasked to audit in/outbound traffic at our site, but I don't know much about Wireshark. I understand how to set up a capture filter for broad protocols (IP only or tcp, udp, icmp, etc), but ...
2
votes
1answer
628 views
What speed are Wi-Fi management and control frames sent at?
There are a bunch of different 802.11 Wi-Fi standards, e.g. 802.11a, 802.11b, 802.11g, 802.11n etc. that all support different speeds. Wi-Fi frames are generally categorised as one of the following:
...
2
votes
2answers
3k views
What is the best way to monitor and record the URLs called by device to establish or monitor browsing history?
I have home internet access via Comcast/Xfinity and the router below providing wifi to multiple devices - laptops, iPads, iPhones, iPod Touch. Macs.
What is the best way to monitor and record the ...
0
votes
0answers
25 views
Shiffer software with custom protocol parsing ability on Windows?
Suppose I wish to sniff my network traffic with some conventional software, but the protocol I wish to analyze is custom. Which software allows to write plugins or something to parse custom protocol ...
-1
votes
1answer
60 views
Is there a way I can check what information a piece of software is sending out [duplicate]
Possible Duplicate:
How can I sniff traffic sent by POST method (on another computer)?
I need to streamline a process for a client. Currently he has some a bit of software which extracts ...
1
vote
0answers
112 views
Sniffing content of web pages in a network - experiment
I want to sniff the web content. Don't worry, no vicious intentions, it is an experiment : )
So the scenario is: I have my host machine, and multiple guest virtual machines running on it. All VMs go ...
1
vote
2answers
640 views
Do machines connected to the same switch belong to the same subnet?
When we talk about a subnet - do we mean all the systems connected to the same switch?
If I have an assigned IP address of 10.0.2.1, am I in the same subnet as that of 10.0.1.39?
When we talk about ...
1
vote
4answers
153 views
if an outdated, vulnerable but clean Windows machine is connected to network behind router, can it be detected and attacked?
suppose the machine is clean of all malware but not in any sense updated, patched, secured etc. Suppose I connect it to the internet from behind wireless router with the intent of using it only on a ...
0
votes
1answer
117 views
How dropbox knows about my corporate email?
I'm dropbox user.
Today I received some promotional email from them and not to my regular email account but on my corporate-one. I NEVER entered that email address in any of the forms while signing up ...
1
vote
0answers
172 views
how to find tcp streams without final ack/fin sequence in a huge packet capture file
I have a huge pcap file which contains a large number of individual tcp streams.But out of these , there are some invalid streams which dont have the final fin/ack sequence. Is there any way i can ...
0
votes
4answers
7k views
How do I limit packet capturing in Wireshark to only a specific protocol?
I would like to listen to HTTP traffic on port 8080. When I start capturing packets in Wireshark, it's flooded by packets using the SSDP protocol on port 1900. I would like to limit the packet ...
0
votes
1answer
302 views
decrypt local ssl traffic (MacOS)
I am trying to reverse engineer a protocol which uses HTTPS exclusively.
On Windows I was using oSpy to view the plaintext of local SSL packets, but for MacOS I have not been able to find an ...
2
votes
2answers
114 views
Intercepting web traffic locally
I am currently the victim of some kind of virus. I noticed this when I visited the Barclays site and was presented with some unusual questions about my details that just didn't seem right.
After some ...
0
votes
2answers
643 views
Replay UDP Packet Capture
I have a UDP packet capture which was streamed from Port1 on IP1 to Port2 on IP2 on network N1. I need to replay these packets on another network N2 from Port3 on IP3 to Port4 on IP4.
I need to know ...
2
votes
2answers
102 views
How does HTTPS avoids the key for encryption to be sniffed in the first place?
When a 2 computer establish an HTTPS connection them have to resolve what key is going to be used, right?
So, to do that, at some point the key have to travel unencrypted from one computer to ...
1
vote
1answer
460 views
Filtering sniffed logs using Wireshark
I'm experimenting with packet sniffing and log examination using Wireshark, and I'm quickly realizing that I'm not nearly as safe as I should be when using public hot spots. In efforts to better ...
2
votes
4answers
1k views
Get active network interface on Windows
I'm developing an application that provides a UI to windump, the packet sniffer. Windump has a "-D" parameter that lists all network interfaces it can find, and then you can specify which interface to ...
1
vote
1answer
66 views
Quick and easy setup for Packet Sniffing/Network Collection
I'm doing some research right now where I want to monitor a group of individuals uses of the web (with permission, of course).
I'm looking for the cheapest, and easiest way to collect network ...
0
votes
1answer
836 views
Wireshark sniffing “microsoft-ds [syn] seq=0..”
I'm new to wireshark. (installed it today)
I'm just looking at the traffic and noticed this kind of packages:
60261 microsoft-ds [syn] seq=0 Win=8192 Len=0 MSS=1460 SACK_PERM=1
its sent to ip: ...
1
vote
3answers
212 views
Why do unicast packets not intended to me reach my NIC when I'm in promiscous mode?
When I'm connected to a switch, the switch knows which mac address belongs to which port. So even when I'm in promiscous mode, why do I receive unicast packets that are addressed to different mac ...
