commandline packet analyzer

learn more… | top users | synonyms

1
vote
0answers
251 views

monitor and log LAN network traffic on CentOS 6.x

I've been fiddling with this one for almost a week now. My setup is: LAN (windows/linux PCs/servers) <-> CentOS gateway/firewall box <-> ISP I'm trying to setup a monitoring solution which ...
1
vote
0answers
168 views

TCPDUMP Network IPv6 Packets

I am new to tcpdump tool and I am working in the analysis of network packets, I have analysed the IPv4 Ip packtes generated in case of wifi. But Now I am running my android phone in sim's 3g network ...
1
vote
1answer
90 views

Unable to see broadcast packets with tcpdump

I am launching an application which broadcasts udp packets. I also have a simple python script to confirm that these packets are being broadcast: sock = socket.socket(socket.AF_INET, socket....
1
vote
0answers
63 views

ICMP flood with ping working only one time

my problem is simple: The first time I made a flooding ping to a fake ip on my network (for testing if someone is on promisc mode), it works perfectly: $ping -f 192.168.1.10 After perfoming this, ...
1
vote
0answers
107 views

How do I troubleshoot if I see the incoming packet in tcpdump, but not at the socket?

For example, I see that the incoming packet in tcpdump, but not in strace for the program that is listening the appopriate socket. How do I trace the "fate" of this incoming packet on Linux? I ...
1
vote
1answer
300 views

how to capture “DROP”ped packets on OUTPUT of iptables?

having a fairly complex OUTPUT processing on iptables, how does one go about capturing / displaying (at least similarly to how tcpdump captures them) the packets that were to leave through an ...
1
vote
0answers
180 views

How to split pcap files maintaining tcp sessions

I have a pcap file which contains tcp traces. I was wondering if there's a way to split these traces in order to maintain tcp flows, but also filtering the traffic on a src ip basis. For example, if ...
1
vote
0answers
559 views

What's wrong with this tcpdump syntax?

sudo tcpdump -i ath1 -s 0 -nne "(type mgt and subtype beacon)" Can anyone help me? I was following a tutorial at http://wiki.secarmour.com/2013/09/capture-wireless-traffic.html but seems I got ...
1
vote
0answers
575 views

how to sniff from a TP-Link ADSL modem?

I have a PC and a tablet that connected to a TP-Link ADSL modem. PROBLEM: I want to see the packets that send and receive from my modem not my PC( to see both wire and wireless packets) I search ...
1
vote
0answers
240 views

No response received from github ssh randomly

My git pull started to stop working randomly with this error $ git pull ssh: connect to host github.com port 22: Connection timed out fatal: The remote end hung up unexpectedly I tried debugging ...
1
vote
1answer
1k views

have tcpdump show the 'conversation' as i would get from wireshark?

Is it possible to get the same output i would get from: tcpdump port 80 -w log.pcap wireshark log.pcap in wireshark Analyze > Follow TCP Stream and then in the bottom drop down Entire ...
1
vote
0answers
173 views

tcpdump loses connection

I'm on Ubuntu – but it's the same on Debian. I'm using tcpdump in order to track the connection of computers on my private network. At some point, the internet connection of the computers launching ...
1
vote
0answers
682 views

latency measurement on Linux-based router using tcpdump

I am using tcpdump to measure latency on a linux router, i.e. the delay experienced by packets as they pass through the router (made of Ubuntu 10). For this purpose, I captured packets in the IN and ...
1
vote
2answers
904 views

How can I monitor which applications make DNS requests on OS X?

I'm trying to send all of my unencrypted day-to-day traffic over an SSH tunnel, which is working pretty well with a simple SOCKS proxy. Skype still goes outside, but that's okay, as Skype is encrypted,...
0
votes
1answer
14 views

What's the purpose of the -interface option in tcpdump?

doing the following command: tcpdump -i eth0:cp5 shows exactly the same thing as the default ... tcpdump what's the purpose of allowing user to specify interfaces?
0
votes
2answers
6k views

Why are some tcp packets with the RST flag classified as new incoming connection?

While looking through my iptables log, I keep observing periodically incoming connections with the RESET flag being set from a few ip addresses within my ISP's network. This is a sample tcpdump on one ...
0
votes
2answers
7k views

TCPDUMP: are these args consistent or meaningless together?

I'm using tcpdump on routing software, and trying to check whether the presence of ip/ip6 protocol with an ip6/ip host (i.e., the other IP family), or else specifying a mix of IPv4 and IPv6 IPs as ...
0
votes
2answers
2k views

tcpdump not capturing any packets

I'm trying to monitor what's going on in my network, so I've tried tcpdump command. I'm just learning to use it, so I thought on playing around a little bit with it. My problem is that I cannot ...
0
votes
1answer
575 views

Detect HTTP sessions using tcpdump [closed]

I have a tracefile and I want to find all web servers that were successfully visited in the trace, contacted via HTTP. I'm using: tcpdump -r file.trace - tcp port 80 Maybe I have to search for a ...
0
votes
1answer
43 views

Can't connect local server by public domain name

I have my server (Debian Wheezy) in my local home network. On that server I have my own DNS server (dnsmasq) for other local servers (so I can type name instead of local IP) and reverse proxy (nginx). ...
0
votes
2answers
201 views

Capturing incoming UDP packet fails

My Environment: Mac OS X 10.8.5 (IP: 192.168.10.5) CentOS 6.5 (IP: 192.168.10.8) I'm trying to capture UDP incoming packet on OS X. I tried on the Terminal of OS X # tcpdump -In udp portrange ...
0
votes
1answer
31 views

libpcap : Filter by ether_type and by speficied bytes

Thanks to pcap_filter, I want to filter by ether_type : Protocol 0x88b5 AND by specific bytes in the payload : "ASK", or 0x41434b It's ethernet-level => no network layer, directly the payload. => ...
0
votes
1answer
793 views

Why filtering on udp port in TCPDUMP gives only fragmented IP frames

I've a device capturing traffic with Tcpdump filtering on "upd dst port" then it creates a pcap file to be read in wireshark. what I obtain from running: tcpdump udp dst port 5201 -qUns 0 -i wlan0 -...
0
votes
1answer
215 views

Why does tcpdump not come precompiled and how to compile it?

Hello I recently downloaded tcpdump from the www.tcpdump.org/ website, extracted the tar.gz file and found nothing but source and header files, I do not posses the necessary knowledge to get a working ...
0
votes
1answer
77 views

tcpdump prints nothing while trying to listen communication with sip server

The following command sudo tcpdump -nqt -s 0 -A -i eth0 port 5060 works and prints incoming SIP messages. Now I want to see entire communication and entering the IP address of the SIP server: ...
0
votes
1answer
635 views

Captured packets with tcpdump vs. tcpdump > file

Why is there such difference in number of packets captured by tcpdump when the output is written to console and to file? $ tcpdump ... 1681 packets captured 1681 packets received by filter 0 packets ...
0
votes
2answers
2k views

how to use tcpdump to capture all packets on local network?

I have a home used wireless router, one linux laptop and android connected to it. Lets say the linux has ip 10.5.5.1, mac AA:AA:AA:AA:AA:AA and android has 10.5.5.2, mac AA:AA:AA:AA:AA:AB. The ...
0
votes
2answers
2k views

Trouble with mergecap [ concatenation of pcap files ] - undesired info in output file

I hope somebody will be able to help me... The problem is with merging multiple .pcap files. Recently - like a week ago I've used a mergecap to merge mutiple pcap files into one. Everything worked ...
0
votes
2answers
865 views

TCP packets not captured by PHP listener

I have a device (GPS localizer) that is sending TCP (I think so) packets to my server on given IP address and through given port. Since I have only SSH access to that server, I opened up two sessions ...
0
votes
2answers
3k views

Is there a tool to decrypt all SSL/SSH traffic originating from this computer?

I expect the program to scan memory of all local processes (or debug them, or provide crypto libraries with hook like in LD_PRELOAD) and use keys to decrypt traffic, making it analysable with ...
0
votes
3answers
1k views

Using nc (netcat) to emulate NTP server response

I want to test some security on an NTP client developed in-house and would like to use netcat to do it. I have packets captured with Wireshark from previous NTP exchanges that I tried to feed to the ...
0
votes
0answers
11 views

tcpdump doesn't captures properly on specific port

I'm in a network and I want to capture FTP packets from another server in the network but I have a problem with tcpdump about this. I've used this command, where X.X.X.X is the FTP server: tcpdump -...
0
votes
1answer
23 views

Human readable SSL/TLS packets

If I have a protocol-analyzer/packet-sniffer, such as wireshark installed on a particular device.. (or in this case; tcpdump & tshark etc. on my smartphone..) ..should I be able to read ...
0
votes
0answers
1k views

Multiple connections to Plex dlna port 32469

Sorry if this is not in the correct forum. I have Plex server installed on a Raspberry PI running Raspbian with Open Media Vault. Everything works well. The only issue I have is that I get lots of ...
0
votes
0answers
138 views

Log to file WSS Websocket packet traffic

How can I log to file all packet traffic coming from a wss web socket on port 1234 using stunnel, openssl and tcpdump ? I have already seen https://gist.github.com/jeremiahsnapp/6426298#file-stunnel-...
0
votes
0answers
16 views

How do I find out to what hostname a potential malware wants to connect?

Without connecting my computer to Internet. I can only think about netstat and packet capturing tools, but I dont really know which method is suitable.
0
votes
0answers
58 views

NAT doesn't allow TCP ACK for sent TCP SYN

We are using TCP Simultaneous Open for connecting TCP socket. Lets call one SideA and other SideB. From the wireshark log I see that first two SYN sent from SideB is blocked by SideA NAT. Then SideA ...
0
votes
0answers
20 views

How can I capture a list of all servers my computer connects to?

I'd like to capture, in real-time, a list of all servers (URL preferred, IP address ok) my computer connects to. I've used tshark and tcpdump, but they return different results. This makes me wonder ...
0
votes
0answers
34 views

TCP Dump received from Verizon, along with an abuse notice

Apologies in advance if this Question is not a good fit for your forum, but I hope it is and someone can help. I'm a FIOS customer and received from "abuse@verizon.net" a TCP dump as part of an email ...
0
votes
1answer
79 views

how to use tcpdump to capture LAN packets which are not from or destined to my PC?

I'm using wifi for network access. I'm doing an experiment with my smartphone to do some experiment and I want to capture packets which are from my smartphone. My idea is to use my laptop with tcpdump ...
0
votes
0answers
124 views

How to capture packets of rysnc using tcpdump

I am trying to do rysnc a 4G file to another directory and want to capture rsync packets using tcpdump. I tried listning to port 873 which is used for rsync but did not find anything captured. I ...
0
votes
1answer
78 views

Yosemite Run Command on Boot as Root without Password

I run OS X Yosemite and I would like to always have the command run, as root, on startup: tcpdump -i en0 'icmp and icmp[icmptype]=icmp-echo' >> /var/vtcakavsmoace/Desktop/ping_information.txt ...
0
votes
0answers
86 views

Review RDP Session from TCPDump

Is it possible to visualize a RDP-Session (ie. convert to video) if you have the tcpdump (containing the entire session) and all involved cryptographic keys (client and server)?
0
votes
1answer
57 views

TCPDUMP Rotating Capture File using -G not working

I'm attempting to run a tcpdump for packet capture for the headers of encrypted traffic. I'm trying to do it with the rotating capture based off time. This is the command I'm running. sudo tcpdump -...
0
votes
0answers
94 views

packets information in tcpdump /capinfos

I'm testing the packet capture efficiency of a sniffer application (netsniff-ng) w.r.t a proprietary sniffer recorder. I had a linux system use tcpreplay to send 25 pcap files @ 100Mbps to both the ...
0
votes
1answer
84 views

How to get details- like Remote ip- about alert genrated by suricata after scanning pcap file

I wanted to test security of my android phone so I leaved it for one day running tcpdump in the background. Then I send resulting pcap to virustotal.com. They are scanning pcap file using snort and ...
0
votes
0answers
99 views

UDP traceroute delay?

We are seeing timeout packages when running traceroute command between two Linux systems on a private network. However, we do not see such symptoms using TCP or ICMP over traceroute. This is a private ...
0
votes
2answers
218 views

Decompress logged GZIP binary data

In an effort to verify my app was sending back and forth with my server correctly, I had run tcpdump -w ~/capture.txt -s 0 port 80 on a server with proxy sitting in between to capture all requests....
0
votes
1answer
425 views

Graphical representation of iperf3 results

I'm using Iperf3 on 2 machines and actually I'm running 2 instances of Iperf3, one to generate traffic with high priority and the other generates traffic with low priority. I would like to generate a ...
0
votes
0answers
32 views

Frame logging of third party hardware on my router (specifically smart TV)

After reading recently about so-called smart TVs "listening" to sound in a person's home, and transmitting this recorded sound across the internet for speech-to-text translation, I have become curious ...