commandline packet analyzer

learn more… | top users | synonyms

0
votes
2answers
3k views

TCPDUMP: are these args consistent or meaningless together?

I'm using tcpdump on routing software, and trying to check whether the presence of ip/ip6 protocol with an ip6/ip host (i.e., the other IP family), or else specifying a mix of IPv4 and IPv6 IPs as ...
0
votes
1answer
478 views

Detect HTTP sessions using tcpdump [closed]

I have a tracefile and I want to find all web servers that were successfully visited in the trace, contacted via HTTP. I'm using: tcpdump -r file.trace - tcp port 80 Maybe I have to search for a ...
0
votes
1answer
24 views

Why filtering on udp port in TCPDUMP gives only fragmented IP frames

I've a device capturing traffic with Tcpdump filtering on "upd dst port" then it creates a pcap file to be read in wireshark. what I obtain from running: tcpdump udp dst port 5201 -qUns 0 -i wlan0 ...
0
votes
1answer
98 views

Why does tcpdump not come precompiled and how to compile it?

Hello I recently downloaded tcpdump from the www.tcpdump.org/ website, extracted the tar.gz file and found nothing but source and header files, I do not posses the necessary knowledge to get a working ...
0
votes
1answer
31 views

tcpdump prints nothing while trying to listen communication with sip server

The following command sudo tcpdump -nqt -s 0 -A -i eth0 port 5060 works and prints incoming SIP messages. Now I want to see entire communication and entering the IP address of the SIP server: ...
0
votes
1answer
244 views

Captured packets with tcpdump vs. tcpdump > file

Why is there such difference in number of packets captured by tcpdump when the output is written to console and to file? $ tcpdump ... 1681 packets captured 1681 packets received by filter 0 packets ...
0
votes
2answers
843 views

how to use tcpdump to capture all packets on local network?

I have a home used wireless router, one linux laptop and android connected to it. Lets say the linux has ip 10.5.5.1, mac AA:AA:AA:AA:AA:AA and android has 10.5.5.2, mac AA:AA:AA:AA:AA:AB. The ...
0
votes
2answers
1k views

Trouble with mergecap [ concatenation of pcap files ] - undesired info in output file

I hope somebody will be able to help me... The problem is with merging multiple .pcap files. Recently - like a week ago I've used a mergecap to merge mutiple pcap files into one. Everything worked ...
0
votes
2answers
626 views

TCP packets not captured by PHP listener

I have a device (GPS localizer) that is sending TCP (I think so) packets to my server on given IP address and through given port. Since I have only SSH access to that server, I opened up two sessions ...
0
votes
2answers
2k views

Is there a tool to decrypt all SSL/SSH traffic originating from this computer?

I expect the program to scan memory of all local processes (or debug them, or provide crypto libraries with hook like in LD_PRELOAD) and use keys to decrypt traffic, making it analysable with ...
0
votes
3answers
1k views

Using nc (netcat) to emulate NTP server response

I want to test some security on an NTP client developed in-house and would like to use netcat to do it. I have packets captured with Wireshark from previous NTP exchanges that I tried to feed to the ...
0
votes
1answer
2k views

tcpdump not showing all packets? [duplicate]

Possible Duplicate: my tcpdump always filters packets? I've been using tcpdump for about a month now, and recently, it has stopped capturing any packets that were not sent to or from the ...
0
votes
1answer
304 views

my tcpdump always filters packets?

I've been using tcpdump for about a month now, and recently, it has stopped capturing any packets that were not sent to or from the computer running tcpdump. I've stripped down my command to just: ...
0
votes
1answer
1k views

tcpdump missing on Cygwin v1.7.7 for packet sniffing

I am trying to debug why my TCP packets are truncated. I see that only the first 24 bytes of each packet are showing up in my program. The 25th through 28th bytes are scrambled and all others after ...
0
votes
0answers
12 views

UDP traceroute delay?

We are seeing timeout packages when running traceroute command between two Linux systems on a private network. However, we do not see such symptoms using TCP or ICMP over traceroute. This is a private ...
0
votes
0answers
16 views

ICMP flood with ping working only one time

my problem is simple: The first time I made a flooding ping to a fake ip on my network (for testing if someone is on promisc mode), it works perfectly: $ping -f 192.168.1.10 After perfoming this, ...
0
votes
2answers
22 views

Decompress logged GZIP binary data

In an effort to verify my app was sending back and forth with my server correctly, I had run tcpdump -w ~/capture.txt -s 0 port 80 on a server with proxy sitting in between to capture all ...
0
votes
1answer
25 views

Graphical representation of iperf3 results

I'm using Iperf3 on 2 machines and actually I'm running 2 instances of Iperf3, one to generate traffic with high priority and the other generates traffic with low priority. I would like to generate a ...
0
votes
0answers
28 views

How do I troubleshoot if I see the incoming packet in tcpdump, but not at the socket?

For example, I see that the incoming packet in tcpdump, but not in strace for the program that is listening the appopriate socket. How do I trace the "fate" of this incoming packet on Linux? I ...
0
votes
0answers
12 views

tcptrace from wireshark capture

How can I use tcptrace to generate tcptrace graph from captures on wireshark ? I already know how to generate the tcptrace on wireshark itself, but I want to generate the graph outside wireshark ...
0
votes
0answers
19 views

Frame logging of third party hardware on my router (specifically smart TV)

After reading recently about so-called smart TVs "listening" to sound in a person's home, and transmitting this recorded sound across the internet for speech-to-text translation, I have become curious ...
0
votes
1answer
300 views

ipv6 ping host got destination host unreachable until run tcpdump

At first (all computer booted) when I ping the gateway (linux computer, two network cards(one is usb)) from a windows computer, I got: "Destination host unreachable", but when I run "tcpdump -i ...
0
votes
1answer
47 views

Get external email from action “mailto”-form

Is it possible to pick out the email adress that a "mailto"-form will send an external email to? example from this (swedish "ebay" - ad) ...
0
votes
2answers
426 views

Packet filter logging [currently with tcpdump in background as root]

I am running OS X Mavericks and use the "packet filter" firewall. However, it seems that "pflogd" is not available. I found that you can create an interface named pflog0 and then use tcpdump to see ...
0
votes
1answer
250 views

Detect HTTP sessions using tcpdump

I have a tracefile and I want to find all web servers that were successfully visited in the trace, contacted via HTTP. I'm using: tcpdump -r file.trace - tcp port 80 Maybe I have to search for a ...
0
votes
1answer
29 views

Is there a way to limit number of packet captures with tcpflow?

I want to limit the number of captured packets, such as: tcpdump -c 20 I want to use tcpflow instead. Is this possible? The console throws a syntax error using tcpflow with the -c parameter. edit - ...
0
votes
2answers
438 views

miss /dev/bpf in freebsd

I'm using tcpdump in freebsd, and I got the following error: $ /usr/sbin/tcpdump -i bge0 tcpdump: (cannot open device) /dev/bpf: No such file or directory a few google search indicate that the ...
0
votes
0answers
19 views

Executing tcpdump remotely while storing packet capture locally [duplicate]

I have run into stumbling block while attempting to create a bash script that will write packet capture files from tcpdump onto a remote server, while displaying the output of the tcpdump command so ...
0
votes
0answers
658 views

Executing tcpdump remotely while storing packet capture locally

I have run into stumbling block while attempting to create a bash script that will write packet capture files from tcpdump onto a remote server, while displaying the output of the tcpdump command so ...
0
votes
1answer
614 views

How do I capture 802.11 headers on an AP while not in monitor mode?

I am wondering if it is possible to extract 802.11 frames on a router running OpenWrt operating as an access point. I tried using tcpdump and loading the dumped packets in Wireshark, but I could only ...
0
votes
1answer
553 views

Can't display RSSI values in Wireshark

I am trying to analyze the up-link Wireless traffic generated by my Sony Ericsson phone and captured by my D-Link router, on which I installed the DD-WRT firmware. To do this, first I log in the ...
0
votes
2answers
993 views

Discover the public ip of a network without being connected

Let say, I'm next to a network and can see the traffic (with airodump or similar tool) but can not decipher it (because I am not connected on the network). Is it possible to discover the public ip ...
0
votes
2answers
205 views

Able to write on stdout but not in a file

I want to keep a trace of the URL I visit, so I use a command line like this: tcpdump -ien1 -v -X 'tcp port 80' | sed -nl 's/^.0x[0-9a-f]{4}:.{43}(.)$/\1/p' |perl break.pl |perl -pe ...