Questions tagged [pcap]

The tag has no usage guidance.

Filter by
Sorted by
Tagged with
0
votes
0answers
10 views

Comparsion of captured traffic in pcap

I'm facing a problem that I can't figure out. My goal: Compare pcaps and measure the loss in capture. Scenario: I've sent data (1,5 GB file) from laptop A via WiFi to shared directory on laptop B. On ...
0
votes
1answer
132 views

What are the specific requirements for libpcap directional capture support?

I'm using libpcap on Linux to capture network traffic from a wireless adapter (2.4 GHz). The pcap_setdirection seems to allow you to setup the capture device so that it ignores traffic originating ...
0
votes
0answers
42 views

make a difference between pcap files

I have two pcap files and I want to make the difference between them. And store the difference in another pcap file. I tried diff command but it's not suitable with the binary files and I used also ...
0
votes
0answers
85 views

Capture Loss when reading pcap with Zeek/Bro

I wanted to create logs with Zeek (Bro) from a pcap file. I read it with the -r option like bro -r my.pcap local Now I have the problem that the logs are created but with extremly much capture loss (...
1
vote
1answer
48 views

tcpdump: “packet exceeded snapshot”

I am using tcpdump to look into some pcap files, but in the output, I see the following error, instead of getting the header information: packet exceeded snapshot I googled it, but I couldn't find ...
1
vote
1answer
79 views

Weird TCP re-transmission

My question is why a TCP flow make a re-transmission when a network has enough link bandwidth. For finding a cause, I used a wireshark. I got the below captured at a host side (10.0.0.1) 25434 50....
0
votes
0answers
27 views

Spurious Retransmissions with different Seq Num

I have a pcap where I see Spurious Retransmissions. However the Seq number of the Spur Retrans frame is totally different from the one which is ACKed. With TCP's cumulative acknowledgement, the Seq ...
0
votes
0answers
81 views

can't replay recorded wireshark pcap of tcp connection due to seq/ack number not synchonized

I want to replay a recorded wireshark pcap which records packets from machine m1 to machine m2. The reason of the replay is to test a server (tcp listener and message handler) in m2. I can use ...
0
votes
1answer
251 views

How to stream captured packets via UDP? tcpdump or other tool

I want to capture traffic or router and send it to remote host via tzcp or other udp proto. How to stream captured packets via UDP? tcpdump or other tool Use case: Linux box connected to internet ...
0
votes
0answers
33 views

debugging websocket from the cli

I am trying to monitor/inspect/debug websocket traffic between two debian boxes. I'd like to have the equivalent of ngrep or tcpdump, ie something that will listen to the traffic on the interface of ...
0
votes
1answer
3k views

Snort finding the alert file DATA with snort.logs.xxxxxxx

I'am working on task where my security team is asking me to provide a pcap file under the folder /var/log/snort. They have picked up a source IPADDRESS from an alert file and they need to do more ...
0
votes
1answer
463 views

how to program tcpdump to only capture packets and nothing else

I am developing a program where a .pcap file is going to be an input. However, when I run tcpdump -w someFile.pcap ,in Terminal, the .pcap file captures extra data such as timestamp, microseconds, ...
1
vote
3answers
6k views

How to filter packets with distinct source address in wireshark?

I have a pcap file and I want to wireshark shows me packets with distinct source address. How can I do this in wireshark?
1
vote
0answers
1k views

ethernet interface on Linux drops packets

I'm trying to capture some Ethernet frames with Linux. Some of these packets/frames are invalid and contain corrupted data. For example an Ethernet frame contains the type 0x0800 which is IPv4, but ...
1
vote
1answer
922 views

Wireshark/PCAP XML attributes explained

I'm generating XML-formatted output from a Wireshark dump using the following command: tshark -r my_wireshark_data.pcap -T pdml > my_wireshark_data.xml Looking at the XML file generated, I cannot ...
0
votes
1answer
238 views

Sngrep Unknown File Format Error

I am attempting to use the sngrep utility on a Mac OSX El Capitan 10.11.4 and getting an error when I try to open any pcap file. The error is as follows: Johns-MacBook-Pro:Downloads gojira$ sngrep -...
0
votes
1answer
837 views

TCPDUMP Rotating Capture File using -G not working

I'm attempting to run a tcpdump for packet capture for the headers of encrypted traffic. I'm trying to do it with the rotating capture based off time. This is the command I'm running. sudo tcpdump -...
0
votes
1answer
355 views

How to find 802.11 protocol variant, and decipher packet_payload_info in PcapNG files?

I'm building a (Python) parser of PcapNG files created by Wireshark. After reading https://www.winpcap.org/ntar/draft/PCAP-DumpFileFormat.html, I'm having the following problems: I'd like to ...
2
votes
1answer
793 views

How to split pcap files maintaining tcp sessions

I have a pcap file which contains tcp traces. I was wondering if there's a way to split these traces in order to maintain tcp flows, but also filtering the traffic on a src ip basis. For example, if ...
0
votes
0answers
559 views

packet sniffing 3ds

I am trying to packet sniff my 3DS just to see what information is available. With Wireshark I noticed that I can only capture traffic which communicates with my computer directly, and not any device ...
0
votes
1answer
152 views

Config to make only pcap receive packet

I am trying to use pcap to modify the packet before sending it out. For example, I have a server (running Ubuntu) listening on port 8000. Before it sends out SYN-ACK for incoming SYN packet, I am ...
1
vote
2answers
901 views

How do capture filters in Wireshark work internally?

I am wondering exactly what happens internally in TShark when I use a capture filter. Specifically, let's say I have the following filter to capture multicast data: host 224.0.26.3 && port ...
1
vote
1answer
2k views

Provide Session Master Key to Wireshark UI?

I'm working on an issue with HTTPS. I suspect its related to client certificates. I want to read some of the encrypted handshake messages that follows the ServerHelloDone message. (Once the ...
2
votes
1answer
4k views

Why does tcpdump take so long to read pcap files?

I am using a third-party tool that captures network traffic as a pcap file during a network test. When I attempt to play these files back, I use the tcpdump tool with the -Aq -r options, and pipe the ...
1
vote
2answers
1k views

Compile Jnetpcap library for ARM platform?

I am trying to execute a java project on arm platform. my code use jnetpcap library. but when i execute the program it shows me an error "/usr/lib/jnetpcap.so: cannot open shared object: no such file ...
1
vote
1answer
2k views

How do I flush Moloch?

I've installed Moloch and the documentation is a bit thin. Does anyone know how I can flush both the database and pcap logs to return the system to a freshly installed state? There is a script for ...
5
votes
2answers
1k views

Follow a .pcap file in wireshark like tail -f

I have a .pcap file on my android device, that I can access from my PC with wireshark via smb and wondering if it possible to get a 'Live view' of that file in wireshark. Is there any solution?
0
votes
1answer
471 views

TCPReplay 3.4.4: Unable to find libpcap in /usr

I'm having a problem installing TCPReplay 3.4.4 for Ubuntu 12.04 LTS. I'm getting this error when I run configure checking for libpcap... configure: error: Unable to find libpcap in /usr I have ...
1
vote
1answer
289 views

How to differentiate between three different flavours of pcap files?

There appears to be 3 different file formats associated with the ".pcap" extension -- libpcap /w microsecond timestamps, libpcap /w nanosecond timestamps, and pcapng. Is there an easy way to ...
0
votes
3answers
3k views

Trouble with mergecap [ concatenation of pcap files ] - undesired info in output file

I hope somebody will be able to help me... The problem is with merging multiple .pcap files. Recently - like a week ago I've used a mergecap to merge mutiple pcap files into one. Everything worked ...
17
votes
2answers
163k views

What's all this deploy.akamaitechnologies.com traffic?

I happened to do a tcpdump while leaving my Mac idle, and when I came back after a mere half-hour there were something like 5000 packets involving deploy.akamaitechnologies.com, in which my computer ...
1
vote
1answer
339 views

How to enter pcap filter in Wireshark 1.8?

Previously in capture options window there was a very handy input field for pcap filter expression. But in 1.8.* this window looks different: So, how to set pcap filter expression before starting ...
2
votes
1answer
4k views

How to extract mpeg-1 stream from pcap in wireshark

I have a pcap network dump that has an MPEG-1 stream inside and I would like to play the mpeg stream. So far I've tried playing through the RTP analyzer but that plays without any sound. I've also ...