Sniffing is the act of passively collecting all network traffic that a machine hears, whether or not it is addressed to that machine. Commonly performed for network diagnostics, programming debugging and troubleshooting, and security analysis.

learn more… | top users | synonyms (3)

0
votes
2answers
6k views

How do I put my wireless interface back into managed mode from monitor mode in Mac OS X without rebooting?

On Mac OS X, I can turn my wireless interface in monitor mode, as explained in a 2007 OSXdaily article. I can also use the integrated Wireless Diagnostics utility to do so. Unfortunately, none of ...
-1
votes
0answers
32 views

Writing to pcap file on remote computer in real time using Scapy

I am trying to develop a stealthy sniffer for educational purposes. My plan is to use scapy to sniff the packets, write them to an open socket that connects to the remote computer in the format of a ....
1
vote
1answer
20 views

How do I capture device specific USB packets with tshark?

I have a USB instrument, and I want to capture packets on it. I ran .\tshark.exe -D and the USB interface is number 6. then I ran the command: .\tshark.exe -c 100 -i 6 it seemed to capture the USB ...
0
votes
1answer
44 views

Challenging RTMP stream

I can't figure out how to download this RTMP stream. I got all the info here extracted from Firefox: netstreambasepath=http://streamin.to/embed-stx1jx4ysd5a-828x480.html id=vplayer file=...
0
votes
0answers
12 views

One computer (Win7) with two network adaptors, how to configure it to work as a network bridge/sniffer

I have a laptop (Win7) with two Ethernet ports (actually one original, one USB-Ethernet adapter). Both of them can work individually well. Now I want to configure these two network adapters in this ...
3
votes
4answers
20k views

Sniffing and logging HTTP Traffic through my wireless router

This is probably a newb question, so sorry for that. I want to sniff traffic going through my wireless router. The router is provided by my cable company, so I don't want to flash the firmware or ...
2
votes
1answer
30 views

How to Sniff Upper Level of the Local Network?

So, I am basically a newbie pen tester and I am studying sniffing. I have 4 machines and 2 routers and decided to test some sniffing techniques. So I created a setup like this. Setup Image ...
0
votes
0answers
14 views

How to detect packet with specific “Total Length” or “Header Length” using Snort?

I'm using Snort to tutorial purposes. As you may know, it brings different rules available for the user to detect different types of transmission packets. The question is that I don't find any ...
0
votes
1answer
69 views

COM port RS485 sniffer using 9bit datawords

I have to monitor COM port, particularly log all raw data from it in a file. I don't have official technical specification of device, which communicates by this port, but as I found in some forum, "It ...
0
votes
1answer
12k views

How to set CommView to capture a specific wifi instead of the whole channel?

I am trying to experiment with CommView for Wifi. When I start searching for devices their are separated in channels. I click on the one I want and then Capture. As I see the program is capturing the ...
0
votes
1answer
545 views

HDI: Capture specific content types in wireshark?

I've been tasked to audit in/outbound traffic at our site, but I don't know much about Wireshark. I understand how to set up a capture filter for broad protocols (IP only or tcp, udp, icmp, etc), but ...
2
votes
1answer
26 views

How to ensure, that firewall does not pass any external packets into LAN?

Am I correct thinking, that in the case of NAT and correct firewall config, one should see no any packages with "source address" equals to global IP inside the LAN? Or NAT server will keep source ...
34
votes
5answers
3k views

What stops an internet router from sniffing my traffic?

Packets travel through internetworks, and take many routes through internet routers. On each route that forwards traffic to another until reaching the ultimate destination, what stops them from ...
0
votes
1answer
47 views

Apparently inexplicable packet-loss; possibly causing slow Skype connection despite speed-tests showing good up and downstream speeds at both ends

I have done a look Whois lookup on my IP Address which is returning [redacted by instruction]. We're currently connected via Skype so I know transmissions are sending; however, when my friend attempts ...
5
votes
1answer
1k views

Is there a popular application for Windows 7 to find nearby WiFi networks?

I was wondering if we can use a third party program, besides "Network and Sharing Center," to find WiFi networks. Is there a popular and recommended application for Windows 7 that finds WiFi networks?...
0
votes
1answer
45 views

Is there a way to reliably search for command line execution in Wireshark?

Let's suppose I wish to inspect the Packet Bytes section and search for inbound shell command execution--specifically, the "dir" command on a Windows machine. From a remote attacker's CLI, I'll ...
0
votes
2answers
44 views

How to detect all Wi-Fi consumers and their signal strength on Windows?

I am trying to create an infrastructure which detects the approximate count of people in the different zones of the huge building for statistical purposes using Wi-Fi. Don't worry, it is going to be ...
2
votes
2answers
5k views

Wireshark only capturing beacon frames

I am trying to sniff my own network to capture http traffic. On airodump my network security show "WPA - TKIP - PSK", so I went to Wireshark > Edit > Preferences > Protocols > IEEE 802.11 > Enabled ...
0
votes
0answers
26 views

How do I detect type of proxy

I have a proxy connection to one server. I need to know the type of proxy is it https tunnel or is it a standard ssl web proxy? How do I can do this? Note: This proxy is created inside of a program,...
17
votes
1answer
2k views

Can I detect sniffers in monitor mode on my Wi-Fi?

Attackers can sniff Wi-Fi networks in monitor mode to intercept the data without connecting to the router. Is it possible to check if somebody is sniffing my network?
0
votes
0answers
26 views

weird arp reply behavior

I implemented a program with python so i can discover if a certain machine is sniffing in my network. Lets suppose that the machine that i wan't to know if it is sniffing has the IP address 192.168....
0
votes
1answer
173 views

promiscuous mode not working

I've searched, and heard that the promiscuous mode lets us listen to all wireless trafic in the Access Point that we are associated with. But when i use this mode with wireshark, i don't get the exact ...
0
votes
5answers
3k views

Connecting PS4 through SonicWall TZ100 firewall | Sony Error NW 31162-3

I am attempting to Connect my PlayStation 4 through my SonicWall TZ100. I have below Ports Forwarded. I'm not great with Packet capturing, but as far as I can tell nothing is getting bounced that is ...
0
votes
2answers
600 views

Command for removing monitor/promisc from an adapter on OSX Yosemite

How do I accomplish this? I see posts on how to turn it on with the Apple802.11.framework but nothing on turning it off. I ran wash and now I’m currently stuck on monitor mode. Please help! sudo ...
0
votes
0answers
17 views

How do I find out to what hostname a potential malware wants to connect?

Without connecting my computer to Internet. I can only think about netstat and packet capturing tools, but I dont really know which method is suitable.
0
votes
1answer
21 views

Safe Capture of WAN Packets

I have an aggregating network tap between my WAN connetion and my home router. I have a dedicated machine running Wireshark to capture all WAN traffic via the network tap. This machine is running ...
0
votes
1answer
58 views

Listen for Wake-on-LAN requests on windows platform

We would like to search for Wake-on-LAN packet senders within our network from our Windows machines (mostly Windows 10). The solution described by Chaos applies only to Linux. Is there also a ...
0
votes
2answers
333 views

Wireshark to capture all IP devices on a network

I have a Windows PC with hardwired Ethernet and two wireless Linux devices on a LAN. My Wireless router is an Asus RT-AC68U. The Windows PC is running Wireshark. I would like to capture all network ...
0
votes
2answers
189 views

Sniff packets from router

So I have TP-Link router and I want to sniff all the packets going through the router. I'm using Wireshark right now but not able to get the packets which passes through my router. So What I've tried ...
1
vote
2answers
272 views

Listing all devices connected to a simple router remotely

I have two simple routers given to me by my ISP. One is Technicolor TC7200 and the other one is Thomson TWG870UG. I would like to remotely list all of the devices connected to the router (their IP and ...
1
vote
0answers
50 views

How to modify HTTP Responses on android?

I have an Android Device which is capable of running both Linux And Android Side by side, I need to keep checking the packets being sent by the device to a particular domain, And when the domain meets ...
0
votes
0answers
26 views

Can a virtual adapter work in promiscuous mode even if the host is not configured as such?

I am currently running Wireshark to sniff my own network. My network landscape looks like this: DLINK Router (192.168.0.1) Windows 7 Physical Machine (192.168.0.2) Kali Linux Virtual Machine (192....
8
votes
5answers
17k views

Windows tool to find out which port an app is trying to use?

I am guessing that netstat shows apps and their ports that already have a connection and it doesn't show or can't show an app that is trying to open a connection. If I have an app that's trying to ...
2
votes
1answer
5k views

Sniffing the Router for Packets

I have used WireShark software to sniff my Network Interface. What if i wanted to sniff the router that what other computers on the network are doing? Is there any way to do that? Computers are ...
2
votes
1answer
1k views

Capturing traffic by HTTP host name, not by IP, via WireShark

I'm trying to filter traffic only to a given HTTP host name. I have a server, and I have dozens of websites on it. It only has one interface and one IP address. Thus filtering to my IP address is not ...
1
vote
0answers
254 views

monitor and log LAN network traffic on CentOS 6.x

I've been fiddling with this one for almost a week now. My setup is: LAN (windows/linux PCs/servers) <-> CentOS gateway/firewall box <-> ISP I'm trying to setup a monitoring solution which ...
0
votes
0answers
366 views

Problem creating evil twin using airbase-ng

I am trying to create an evil twin access point using airbase-ng.I am creating a hotspot using my mobile and connecting anther mobile to this hotspot.Now I am trying to create an evil twin access ...
0
votes
1answer
79 views

How to capture traffic in monitor mode when you know the password

I have turned on the monitor mode using airmon-ng start wlan0 and I can see this when I do iwconfig: mon0 IEEE 802.11bgn Mode:Monitor Tx-Power=20 dBm Retry short limit:7 RTS ...
6
votes
4answers
9k views

Get active network interface on Windows

I'm developing an application that provides a UI to windump, the packet sniffer. Windump has a "-D" parameter that lists all network interfaces it can find, and then you can specify which interface to ...
0
votes
0answers
19 views

Is there a light exe / sniffer to ensure that certain traffic is traveling over intended ports to validate vpn/ssh settings?

I'm using ssh and split-tunneling vpn and I'd like to get a log of which traffic is sent over which ports. Is there a simple software to do this? Is there a way to easily show this over wireshark (...
-1
votes
1answer
280 views

how can I sniff Bluetooth traffic coming from my and another device?

I am trying to debug some Bluetooth traffic. I have one windows computer that I have full access too, I have an android phone, and I have a wireless hardware device. I want to know if there is a way ...
2
votes
5answers
1k views

Can I collect wireless packets using Wireshark while being connected to the Internet via cable?

I am working on a PC which is connected to my router using a LAN cable, and the other computers in my house are connected to my router using WiFi. We are all connected to the same network, so I ...
5
votes
4answers
14k views

promiscuous mode with Intel Centrino Advanced-N 6200 AGN wireless card

I'm trying to solve this problem for a long time, googling, reading and trying with no help. I have laptop with Intel Centrino Advanced-N 6200 AGN wireless card which suppose to support promiscuous ...
0
votes
1answer
237 views

COD4 Linux game server doesn't send UDP packets as response to broadcast

I am setting up a bunch of Game servers for a medium sized LAN tournament using CentOS 6 and the various Linux binaries used for the game servers. With COD4 the servers did not show up in the server ...
2
votes
2answers
3k views

Sniffing wireless LAN network using tcpdump

If I correctly understood the basics of the wireless working, I should be able to sniff the traffic of other computers over the wireless LAN. So I connected a second computer to my wireless LAN and ...
0
votes
1answer
176 views

iperf and Wireshark show different data rate

I was testing the capture performance of a sniffer application in Linux. I have a Windows machine that sends UDP multicast packets to the capture port of the sniffer system using iperf at 8Mbits/s. I ...
0
votes
0answers
72 views

Monitor TCP port traffic and get a sound alert when a specific text string is found on Windows

I need to watch a port for several hours and make an audible alert whenever a specific string comes through. Windows only. Is this possible with Wireshark or another sniffer tool or maybe a sniffer ...
1
vote
1answer
580 views

Capture data that my ADSL modem send

I'd like to capture the data sent by my ADSL modem (what's really sent on the RJ11 cable). I have no access to my modem (no ssh), so I'd like to build a mini-computer with 2 RJ11 plug, one connected ...
4
votes
0answers
269 views

why am I not seeing traffic using TCPDUMP while sniffing on wireless interface with the station in WDS mode

I've 2 wireless interfaces one has the type of AP and the other has the type monitor. the AP is attached to a bridge br-lan. When I run for example: tcpdump port 5201 -s 0 -ni wlan0 TCPdump is ...
0
votes
0answers
76 views

Reading packets with Wireshark

How do I read packets captured with Wireshark. I was finally able to capture incoming and outgoing data in hopes of developing something along the lines of an IDS. Thanks in advance for the help. A ...