Questions tagged [sniffing]
Sniffing is the act of passively collecting all network traffic that a machine hears, whether or not it is addressed to that machine. Commonly performed for network diagnostics, programming debugging and troubleshooting, and security analysis.
296
questions
1
vote
1
answer
5k
views
sending packet with scapy custom ethernet header
Why sending packet with different ethernet source Mac address never reach target? Note: I used scapy sendp for sending the packet and I have my friends laptop up and connected to network?
3
votes
1
answer
1k
views
Profibus or MODBUS over RS485
We are operating old systems which have many modules we are not able to find on the market. So we are looking for replacements. S7-200 PLC with several sensors is communicating over RS485 pair cable. ...
- 31
-1
votes
1
answer
63
views
Open website using IP, not domain
I wish to comment Loading a website using IP, but I can't because of reputation.
I have question because I don't understand process of opening website hosted with virtual hosting. When I write https:/...
- 31
0
votes
0
answers
160
views
How default Web Page is loaded with just TCP connection and no HTTP transaction?
Below is the packet capture from WireShark when a web request is made to the Google Server
172.217.26.228 is the IP address of the Google Server.
Filter that I am using is
(ip.dst == 172.217.26....
- 659
1
vote
1
answer
99
views
Sniffing data on a network
I have a couple of GoPro's connected to a Smart Remote device. I am able to connect to the hidden wifi access point created by the Smart Remote. I want to observe the communication between the GoPro's ...
- 227
2
votes
0
answers
608
views
How can I capture and analyse LTE packets using Wireshark and LTE modem? [closed]
Is it possible to analyse LTE packets using Wireshark. I'm having trouble using Wireshark to capture mobile LTE traffic. I ma using a MacBook and a LTE modem.
Do I need specific configuration to ...
- 121
0
votes
1
answer
202
views
Sniff ethernet communication
I have a setup in which I'm connected to a switch and there are 2 more devices there. Just protocol converters ... that have recently stopped working.
Since this equipment doesn't have any type of ...
- 123
0
votes
1
answer
2k
views
How to force Linux bridge to output frame on multiple interfaces?
I have a Linksys E2500 router running Tomato v1.28 (Linux kernel 2.6.22.19, no USB drive capability) that is functioning in bridge mode to connect three interfaces:
root@TomatoE2500Host:/# brctl show
...
0
votes
0
answers
200
views
Iptables rules seem to be missing packets?
On my home network (192.168.1.0/24), I am trying to use iptables to silently clone all wifi TCP/UDP traffic to/from my Xbox One to my Windows 10 desktop, for packet sniffing via Wireshark.
Due to ...
0
votes
1
answer
314
views
tcpdump: (all BPF devices are busy) - How to solve this
I was running tcpdump and then after some time I got this error:
tcpdump: (all BPF devices are busy)
I am not sure why? I killed all tcpdump processes, in case that this had something to do with it, ...
- 101
0
votes
2
answers
710
views
How to make Wireshark show http format instead of 802.11 or check if Wireshark is capturing it
First of all, this might look like a duplicate from this post, and it kind of is, but at the time writing my rep is not high enough to comment and I was walking in to some issues whilst applying that ...
- 101
0
votes
1
answer
309
views
can I sniff traffic with NIC connected to network and without having IP address
Is it possible to sniff network traffic by just connecting to network but without assigning IP address to NIC?
If sniffing is not possible, how easy is to guess get valid IP address if DHCP is ...
- 11
0
votes
1
answer
1k
views
tshark: using frame contains and write to file
i want to filter out TCP packets that contain a specific string in the frame data (data.data)
tshark -i 1 -f "tcp port 8800" -Y "frame contains FILE" -w "data.txt"
This is exactly what i want.
...
- 165
0
votes
0
answers
571
views
trying to enable monitor mode in Raspbian
I followed this tutorial in order to enable monitor mode in my Raspberry Pi 3, when I get to the step where I have to create the monitor interface, I've got the following error:
iw phy iw dev wlan0 ...
- 259
1
vote
1
answer
1k
views
TcpDump capture stops after few minutes. (Windows)
I'm trying to capture all my networking with tcpdump.
I'm using tcpdump.exe -i {} -W 5 -C 10 -w capfile. After 10 mints (+-) the capture stopped for some reason, and tcpdump is still running.
Maybe ...
0
votes
1
answer
424
views
Capturing Link layer frames
I've been trying to capture link layer frames. I've tried using wireshark (also tcpdump and airmon-ng) both in monitor mode and managed mode (/promiscuous mode), yet have been unable to see them. Put ...
0
votes
1
answer
2k
views
Configuring virtual network interface as sniffing interface
I have a Snort IDS running Ubuntu Server 16.04 with one physical ethernet interface (eno1). I have configured two virtual network interfaces using the eno1 interface: eno1:0 for the sniffing interface ...
- 61
1
vote
0
answers
180
views
Configuring virtual network interface as sniffing interface
I have a Snort IDS running Ubuntu Server 16.04 with one physical ethernet interface (eno1). I have configured two virtual network interfaces using the eno1 interface: eno1:0 for the sniffing interface ...
- 61
0
votes
1
answer
2k
views
Decrypting Application Data with (Pre)-Master-Secret log file in Wireshark
I've read a few articles outlining a process for decrypting SSL/TLS traffic without a private key. Session keys are generated in a log file, which are then read from Wireshark by point to the log file....
- 103
0
votes
2
answers
233
views
Packets sniffer and domain
I have a doubt about packets sniffer. I read that it can sniff only in local segment and often it is referred as collision domain. But... The collision domain for a switch is each single port ...
- 147
0
votes
2
answers
746
views
Sniff packets seeing interface name and in/out flag
I'm trying to monitor my traffic and installed WireShark as found most recommended tool, on Linux.
However, I found no sure way to see if packet is incoming or outgoing and display interface name (...
- 199
0
votes
1
answer
88
views
Does FIlezilla (or FTP in general) have any sniffer protection?
Is possible track credentials of a normal Filezilla connection (no SFTP) in the same wifi with methods like "Man in the Middle", or the program have any security about this?
- 101
0
votes
0
answers
2k
views
Wireshark capture ARP traffic and EAPOL
I'm trying to capture only ARP traffic and EAPOL on wireshark. I'm using the following capture filter:
ether proto 0x888e or arp
But I only capture EAPOL traffic. On the other hand using the ...
0
votes
1
answer
871
views
How to sniff all ARP traffic on a WiFi network?
I would like to know if it's possible to sniff all ARP traffic (even if I am not the intender destination) on a WiFi network. I've tried on Wireshark and Scapy neither works.
Thank you.
-1
votes
1
answer
71
views
Wireshark - what happened?
This Wireshark issue has been driving my crazy for a few hours. What's happening here?
192.168.2.100 is an Apache server that is serving a static file.
192.168.2.196 is an embedded client ...
0
votes
1
answer
415
views
How to inspect particular DHCP server response by IP (linux)?
I have following setup:
ISP -> junk-isp-router -> MikroTik RB2011 -> ...
Yesterday I enabled rogue DHCP server alerting on RB2011 and today I received alert that it somehow got DHCP ...
- 810
1
vote
1
answer
2k
views
How do I sniff traffic from a vm using another vm using Wireshark in the same network?
I have setup 2 virtual machines.
Ubuntu16.04 - 10.10.130.10
Kali-rolling with wireshark 2.2.7 - 10.10.130.13
Both have access to the internet.
I'm trying to understand how the flows look like when ...
- 119
0
votes
1
answer
2k
views
How To Sniff Modem's Traffic
Every time my Modem (Sagem F@ST 3284, which is also a router) reboots it sends a request to the ISP with the current OS version. If it's not updated it will download the firmware from the ISP and ...
0
votes
0
answers
407
views
Only outputting plain text from TShark
I was wondering if there was a feature like follow TCP stream for TShark.
I have a got a NetCat IRC server setup with the following command: nc -lnvp 1234.
My android phone connects with netcat 10.0....
- 11
0
votes
1
answer
585
views
ESP8266 TCPDump only arp but no tcp
I have a problem with sniffing a ESP8266. I use a raspberry pi 3 as wifi access point (no wpa in use), a laptop as a server and the esp to communicate to the server.
When I use tcpdump on my ...
- 3
1
vote
2
answers
1k
views
How to sniff a virsh virtual bridge from a virtual machine
So I want to sniff the traffic from a virtual bridge (virbr2) from a virtual machine. I can successfully sniff virbr2 directly from the host machine, but when setting that interface to the virtual ...
- 11
2
votes
1
answer
2k
views
iptables -L not showing all rules?
I've added this rule with iptables:
iptables -t mangle -I PREROUTING -j TEE --gateway 192.162.122.62
I've checked it with iptables -L or iptables -S but I can't see anything.
Is that normal? how can ...
- 21
0
votes
2
answers
1k
views
How can one send packets or files on a LAN IP without it being wanted by the receiving computer
I don't know if it is possible but I want to know if someone connected on your LAN can send a file to you by just knowing your LAN IP addresses.
I mean without you putting the computer in listening ...
0
votes
2
answers
6k
views
How to decrypt 802.11 packets manually?
Without using Wireshark, how are 802.11 meant to be decrypted? I know the EAPOL and passphrase are required, but what are the steps required to perform the decryption? Another way to put it is, how ...
- 249
0
votes
1
answer
1k
views
how to program tcpdump to only capture packets and nothing else
I am developing a program where a .pcap file is going to be an input. However, when I run tcpdump -w someFile.pcap ,in Terminal, the .pcap file captures extra data such as timestamp, microseconds, ...
- 243
0
votes
1
answer
206
views
Packet sniffer in Network?
I found a blocked MAC address (00-1A-B6-00-64-00) in MAC access list and after disabling the MAC filtering show this detail in Wireshark :
Frame 112389: 342 bytes on wire (2736 bits), 342 bytes ...
- 1
2
votes
1
answer
1k
views
Battlefield: Inspect packet-loss and packet-return-time of multiplayer game
I'm aware that this is an unusual question, but it seems the people here are very likely the ones who can help. I'm trying to debug with my ISP why I'm having extreme lags during gameplay.
Question: ...
- 204
0
votes
0
answers
794
views
Auomtatically capture and analyze IP traffic with netsh on Windows
I'm looking to capture all IP traffic on a Windows machine to/from all interfaces.
I must be able to capture the process ID which generated the outgoing traffic.
I need to be able to trigger ...
- 163
2
votes
2
answers
2k
views
Sniff wireless traffic between two machines via Wireshark
Foreword: I am woefully inexperienced with this. As in, this is literally my first time encountering something like this. Please bear with me.
Hello everyone,
The situation is as follows. We (as in, ...
- 121
1
vote
1
answer
9k
views
how to capture only SMTP using latest Wireshark 2.2.6 or later
I am debugging a problem with my Azure VM Windows server receiving SMTP from the Internet, and want to use Wireshark to show ONLY SMTP.
I would also like to use Wireshark to show the contents of the ...
- 788
1
vote
0
answers
1k
views
Tcpdump or similar - How can I only capture one instance of each packet destination and port?
I want to leave something like tcpdump running for up to a week and therefore make its output as concise as possible to reduce file size and speed up post-capture analysis.
All I need to to do is log ...
- 2,742
0
votes
1
answer
238
views
How to capture network traffic periodically, with every capture file containing full network flows
I need to dump network flow periodically on a Linux platform, ideally using the command line interface (i.e., non-GUI tools), and I want every capture file (pcap files) to contain complete flows. How ...
- 111
1
vote
0
answers
162
views
Can't see mirrored packets from dd-wrt flashed router
I have a Linksys/Cisco wrt610n v1 router running dd-wrt. I have port mirroring enabled on my primary switch and it is mirroring the packets that I need to monitor into port 2 on my dd-wrt router. I ...
- 111
0
votes
1
answer
74
views
Why does a chromebook call out to these non existent domains?
Is this one of their forms of checking for a captive portal or what?
- 71
0
votes
2
answers
83
views
Capture traffic over https in work area
I'm working in an enterprise. I was wondering when I visit websites that support https protocol, is it possible for anyone who accesses network of the enterprise(e.g. Network owner) to capture what ...
- 117
0
votes
1
answer
3k
views
Wireshark highlight missing sequence number
I run Iperf over wifi sending udp packets from a client to a server and I capture the traffic with Wireshark. The total number of datagrams captured in Wireshark is less than sent with Iperf. Based on ...
- 101
2
votes
2
answers
4k
views
Port mirroring Vs. Network Sniffer?
What's the difference between capturing the internet traffic using Port mirroring hub installed on router and simply running a Wireshark on the computer on which you want to capture the packets?
I ...
- 21
1
vote
1
answer
991
views
tcpreplay does not work
I have a problem with tcpreplay and hostapd, this is my scenario: a client connects to 172.24.1.91/OPEN and /CLOSE and processes a GET request to a server that lights up or down a Led. I made a Java ...
- 11
0
votes
1
answer
68
views
Inspect/sniff unencyrpted packets on my local network between 2 devices
Long story short I'm trying to reverse engineer an app that makes http (not ssl) requests to my TV to tinker with some home automation.
I spoofed my TVs mac address and switched to it's IP while the ...
- 809
0
votes
0
answers
2k
views
Enterprise Wireless 5GHz Deauth
I am running blackbox pentests on an enterprise wireless setup. My area of attack consists of multiple APs that have both a 2.4GHz and a 5GHz radio.
I have successfully deauthenticated users from the ...
