Sniffing is the act of passively collecting all network traffic that a machine hears, whether or not it is addressed to that machine. Commonly performed for network diagnostics, programming debugging and troubleshooting, and security analysis.

learn more… | top users | synonyms (3)

1
vote
2answers
146 views

Relay/forward captured packtes

Fellow members, Got a small question, How can one relay/forward the packet captured on unix/linux machine to a network device using ftp/tftp/any other mechanism. I've got a wireless network ...
1
vote
2answers
258 views

How to view other lan users packets via wireshark

It seems that I can only view my own packets, how to view other lan users packets via wireshark?
1
vote
2answers
2k views

how to find tcp streams without final ack/fin sequence in a huge packet capture file

I have a huge pcap file which contains a large number of individual tcp streams.But out of these , there are some invalid streams which dont have the final fin/ack sequence. Is there any way i can ...
0
votes
2answers
599 views

Command for removing monitor/promisc from an adapter on OSX Yosemite

How do I accomplish this? I see posts on how to turn it on with the Apple802.11.framework but nothing on turning it off. I ran wash and now I’m currently stuck on monitor mode. Please help! sudo ...
0
votes
2answers
38 views

What does this hex value mean in source column within NETMON?

I am using NETMON to try and figure out why my local network is running so slow. I think it may be related to a system logged into it, but in order to not draw attention to my task i have been ...
1
vote
1answer
517 views

How to detect TOR usage with Wireshark?

I use TOR inside a Virtual Machine. I run Wireshark on my Host. I want to detect TOR usage (for learning/studying) with Wireshark but don't know how. I've tried this: https://ask.wireshark.org/...
1
vote
1answer
96 views

Quick and easy setup for Packet Sniffing/Network Collection

I'm doing some research right now where I want to monitor a group of individuals uses of the web (with permission, of course). I'm looking for the cheapest, and easiest way to collect network traffic,...
0
votes
1answer
68 views

COM port RS485 sniffer using 9bit datawords

I have to monitor COM port, particularly log all raw data from it in a file. I don't have official technical specification of device, which communicates by this port, but as I found in some forum, "It ...
0
votes
1answer
21 views

Safe Capture of WAN Packets

I have an aggregating network tap between my WAN connetion and my home router. I have a dedicated machine running Wireshark to capture all WAN traffic via the network tap. This machine is running ...
0
votes
1answer
218 views

WiFi connection lags from time to time

My home LAN connection lags from time to time (approx once a minute). This is noticeable by temporary pauses of continuos operations like file copying, RDP working and video playback with small ...
0
votes
1answer
39 views

Is there a way to limit number of packet captures with tcpflow?

I want to limit the number of captured packets, such as: tcpdump -c 20 I want to use tcpflow instead. Is this possible? The console throws a syntax error using tcpflow with the -c parameter. edit - ...
0
votes
1answer
214 views

how to see the communication between client and server (string form)

I have a client-server application. The problem is the server is not able to support as many client as being mentioned in the specs or as being claimed by the provider. What i am trying to is to ...
0
votes
1answer
96 views

Need a creditable source on specifics of Promiscuous and Monitor WNIC modes?

Having searched a great deal of websites to find an explicit statement about the specifics of Promiscuous and Monitor mode as used in WNICs, I finally found this in Spiff's answer to: Wireless Card ...
0
votes
1answer
545 views

HDI: Capture specific content types in wireshark?

I've been tasked to audit in/outbound traffic at our site, but I don't know much about Wireshark. I understand how to set up a capture filter for broad protocols (IP only or tcp, udp, icmp, etc), but ...
0
votes
1answer
844 views

Network packet editor for Linux?

Anyone know network packet editor for Linux, or a way to modify network packets in wireshark?
-1
votes
1answer
279 views

how can I sniff Bluetooth traffic coming from my and another device?

I am trying to debug some Bluetooth traffic. I have one windows computer that I have full access too, I have an android phone, and I have a wireless hardware device. I want to know if there is a way ...
-1
votes
1answer
93 views

Modify a packet's content on DD-WRT

I need to modify incoming data to my network. Specifically, I want to modify all responses from a specific internet site so it doesn't show a certain HTML element. Is this possible with DD-WRT/...
4
votes
0answers
269 views

why am I not seeing traffic using TCPDUMP while sniffing on wireless interface with the station in WDS mode

I've 2 wireless interfaces one has the type of AP and the other has the type monitor. the AP is attached to a bridge br-lan. When I run for example: tcpdump port 5201 -s 0 -ni wlan0 TCPdump is ...
2
votes
0answers
222 views

What might be causing specific IPv6 HTTPS servers to send an excessive number of RST packets?

Client browsers on my IPv6-enabled home network hang and time out when attempting to load https:// URLs from specific IPv6 sites, such as ones operated by CloudFlare. In those situations, the live log ...
1
vote
0answers
50 views

How to modify HTTP Responses on android?

I have an Android Device which is capable of running both Linux And Android Side by side, I need to keep checking the packets being sent by the device to a particular domain, And when the domain meets ...
1
vote
0answers
254 views

monitor and log LAN network traffic on CentOS 6.x

I've been fiddling with this one for almost a week now. My setup is: LAN (windows/linux PCs/servers) <-> CentOS gateway/firewall box <-> ISP I'm trying to setup a monitoring solution which ...
1
vote
0answers
317 views

Trying to use mdk3 with Alfa AWUS036NHA, wireshark detects frames but cannot detect network

I'm testing out some various tools, trying to get them to work, but I cannot seem to get the MDK3 beacon flooding mode to work. I'm currently running Debian with a few Kali repositories installed. I'm ...
1
vote
0answers
183 views

Sniffing Application Network Traffic on Windows

I have an application running on my computer which communicates with a server over Windows-VPN. I would like to sniff the traffic between that app and the server but Wireshark f.x. will only show me ...
1
vote
0answers
583 views

how to sniff from a TP-Link ADSL modem?

I have a PC and a tablet that connected to a TP-Link ADSL modem. PROBLEM: I want to see the packets that send and receive from my modem not my PC( to see both wire and wireless packets) I search ...
1
vote
0answers
510 views

How to get data from sniffed usb communication?

we are trying to get raw measurement data from one usb sensor as the control software is a black box and the manual does not contain anything about how it process the measurements. I was able to ...
1
vote
0answers
137 views

Sniffing content of web pages in a network - experiment

I want to sniff the web content. Don't worry, no vicious intentions, it is an experiment : ) So the scenario is: I have my host machine, and multiple guest virtual machines running on it. All VMs go ...
1
vote
0answers
516 views

SocketSniff equivalent for 64-bit applications

SocketSniff allows you to watch the Windows Sockets (WinSock) activity of the selected process. On x64 version of Windows, SocketSniff can only work with 32-bit programs. Is there any SocketSniff ...
0
votes
0answers
12 views

One computer (Win7) with two network adaptors, how to configure it to work as a network bridge/sniffer

I have a laptop (Win7) with two Ethernet ports (actually one original, one USB-Ethernet adapter). Both of them can work individually well. Now I want to configure these two network adapters in this ...
0
votes
0answers
14 views

How to detect packet with specific “Total Length” or “Header Length” using Snort?

I'm using Snort to tutorial purposes. As you may know, it brings different rules available for the user to detect different types of transmission packets. The question is that I don't find any ...
0
votes
0answers
26 views

How do I detect type of proxy

I have a proxy connection to one server. I need to know the type of proxy is it https tunnel or is it a standard ssl web proxy? How do I can do this? Note: This proxy is created inside of a program,...
0
votes
0answers
26 views

weird arp reply behavior

I implemented a program with python so i can discover if a certain machine is sniffing in my network. Lets suppose that the machine that i wan't to know if it is sniffing has the IP address 192.168....
0
votes
0answers
17 views

How do I find out to what hostname a potential malware wants to connect?

Without connecting my computer to Internet. I can only think about netstat and packet capturing tools, but I dont really know which method is suitable.
0
votes
0answers
26 views

Can a virtual adapter work in promiscuous mode even if the host is not configured as such?

I am currently running Wireshark to sniff my own network. My network landscape looks like this: DLINK Router (192.168.0.1) Windows 7 Physical Machine (192.168.0.2) Kali Linux Virtual Machine (192....
0
votes
0answers
19 views

Is there a light exe / sniffer to ensure that certain traffic is traveling over intended ports to validate vpn/ssh settings?

I'm using ssh and split-tunneling vpn and I'd like to get a log of which traffic is sent over which ports. Is there a simple software to do this? Is there a way to easily show this over wireshark (...
0
votes
0answers
366 views

Problem creating evil twin using airbase-ng

I am trying to create an evil twin access point using airbase-ng.I am creating a hotspot using my mobile and connecting anther mobile to this hotspot.Now I am trying to create an evil twin access ...
0
votes
0answers
72 views

Monitor TCP port traffic and get a sound alert when a specific text string is found on Windows

I need to watch a port for several hours and make an audible alert whenever a specific string comes through. Windows only. Is this possible with Wireshark or another sniffer tool or maybe a sniffer ...
0
votes
0answers
76 views

Reading packets with Wireshark

How do I read packets captured with Wireshark. I was finally able to capture incoming and outgoing data in hopes of developing something along the lines of an IDS. Thanks in advance for the help. A ...
0
votes
0answers
73 views

HTTP Sniffing using wireshark

I am using Wireshark on my Mac, which is running Yosemite. When I am sniffing the HTTP protocol, I can only see the HTTP/get and I cannot see the HTTP/OK.. Is there a way to enable this on my MAC? I ...
0
votes
0answers
67 views

Wifi sniffing only outgoing packets

When I am setting my wifi card in monitor mode and disconnecting it from wifi I am able to sniff every packet coming in and out from my tablet (http requests and responses) but when I connect to ...
0
votes
0answers
83 views

How to capture HTTP headers to particular url in my Ubuntu computer?

I am connecting a website and can see the hearders by firefox inspect tool. I like to do it from outside of the browser for particular url acceses. How can I do it in my Ubuntu computer?
0
votes
0answers
472 views

Actual Destination IP instead of Proxy's IP in traffic capture

I want to capture the network traffic of my host through wireshark and need to get the source and destination ip addresses from the packets. The problem I am facing is that I am behind Proxy Server ...
-1
votes
0answers
32 views

Writing to pcap file on remote computer in real time using Scapy

I am trying to develop a stealthy sniffer for educational purposes. My plan is to use scapy to sniff the packets, write them to an open socket that connects to the remote computer in the format of a ....