Questions tagged [pcap]

The tag has no usage guidance.

Filter by
Sorted by
Tagged with
1 vote
0 answers
60 views

kali linux filter by protocol wireshark's pcaps

I spent the last 2h looking for a way to quikly filter pcaps, it seems that it is possible using cmd/bat on windows but I can't find anything for kali linux. I have a way too big pcap and I want to ...
the shadow's user avatar
1 vote
1 answer
230 views

Black hole output interface for tcpreplay

I'm using a command line like this to replay a huge PCAP file at high speed - I'm benchmarking various aspects of tcpreplay: sudo tcpreplay --mbps=1000 --intf1=docker0 linuxbig_log.pcap As I don't ...
Ken Y-N's user avatar
  • 124
0 votes
0 answers
227 views

Why is the output of tshark `http.file_data` different from the Content Length?

I've got a PCAP file that has 3,445 HTTP "206 Partial Content" packets for the application/pdf media type. Each of these requests is for the same file, different Content-Ranges are being ...
ajmeese7's user avatar
  • 101
1 vote
1 answer
803 views

How to use ciscodump?

In wireshark, there is this option called Cisco remote capture: ciscodump, which, from my understanding, should enable to do a tcpdump on a cisco router (for example) via SSH and get back the results ...
user1741932's user avatar
1 vote
0 answers
621 views

Generate alert from pcap file with Snort

I'm learning to use snort by myself and I can't figure out if I'm generating alerts from a file well. The rules i have in local.rules are: alert icmp any any -> any any (msg:"Testing ICMP"...
Claudia De Michele's user avatar
0 votes
1 answer
433 views

Wireshark - exports what it recognises as a jpeg but the jpeg doesn't open

I have a JPEG GET request in my PCAP as below but when I export it, it's not a valid JPEG file Any advice as to what I'm doing wrong?
pee2pee's user avatar
  • 493
1 vote
0 answers
526 views

ALFA wifi network card Monitor Mode on Mac OS

I recently bought an ALFA AWUSO36EAC and I want to use it for packet injection and monitor mode on Mac OS. I was told that this is a better page to ask about Network Card related questions. I have ...
Sam Moldenha's user avatar
0 votes
1 answer
3k views

tshark how to count the number of returned packets

I am using tshark and i need to findout how many of my 10,0000 packets contain a HTTP URI Therefore, i have written the line of code that goes as followes: tshark -r tsharklab.pcap -Y "http....
JamesMcC's user avatar
0 votes
1 answer
348 views

TLS handshake to microsoft.com hangs

Two Linux machines (Ubuntu 20.04 & 18.04.4 running on vSphere) behind NAT are not able to complete the TLS handshake to https://microsoft.com and https://mcr.microsoft.com, while they are able to ...
278342304's user avatar
0 votes
1 answer
224 views

What are the specific requirements for libpcap directional capture support?

I'm using libpcap on Linux to capture network traffic from a wireless adapter (2.4 GHz). The pcap_setdirection seems to allow you to setup the capture device so that it ignores traffic originating ...
user's user avatar
  • 192
0 votes
1 answer
512 views

make a difference between pcap files

I have two pcap files and I want to make the difference between them. And store the difference in another pcap file. I tried diff command but it's not suitable with the binary files and I used also ...
salwa17's user avatar
  • 21
1 vote
1 answer
339 views

tcpdump: "packet exceeded snapshot"

I am using tcpdump to look into some pcap files, but in the output, I see the following error, instead of getting the header information: packet exceeded snapshot I googled it, but I couldn't find ...
Alex's user avatar
  • 121
1 vote
1 answer
227 views

Weird TCP re-transmission

My question is why a TCP flow make a re-transmission when a network has enough link bandwidth. For finding a cause, I used a wireshark. I got the below captured at a host side (10.0.0.1) 25434 50....
nimdrak's user avatar
  • 133
0 votes
1 answer
2k views

How to stream captured packets via UDP? tcpdump or other tool

I want to capture traffic or router and send it to remote host via tzcp or other udp proto. How to stream captured packets via UDP? tcpdump or other tool Use case: Linux box connected to internet ...
eri's user avatar
  • 369
0 votes
1 answer
9k views

Snort finding the alert file DATA with snort.logs.xxxxxxx

I'am working on task where my security team is asking me to provide a pcap file under the folder /var/log/snort. They have picked up a source IPADDRESS from an alert file and they need to do more ...
chandu's user avatar
  • 103
0 votes
1 answer
1k views

how to program tcpdump to only capture packets and nothing else

I am developing a program where a .pcap file is going to be an input. However, when I run tcpdump -w someFile.pcap ,in Terminal, the .pcap file captures extra data such as timestamp, microseconds, ...
Sam's user avatar
  • 243
2 votes
3 answers
16k views

How to filter packets with distinct source address in wireshark?

I have a pcap file and I want to wireshark shows me packets with distinct source address. How can I do this in wireshark?
Richard's user avatar
  • 117
1 vote
0 answers
2k views

ethernet interface on Linux drops packets

I'm trying to capture some Ethernet frames with Linux. Some of these packets/frames are invalid and contain corrupted data. For example an Ethernet frame contains the type 0x0800 which is IPv4, but ...
GNA's user avatar
  • 111
1 vote
1 answer
2k views

Wireshark/PCAP XML attributes explained

I'm generating XML-formatted output from a Wireshark dump using the following command: tshark -r my_wireshark_data.pcap -T pdml > my_wireshark_data.xml Looking at the XML file generated, I cannot ...
atreyu's user avatar
  • 362
0 votes
1 answer
486 views

Sngrep Unknown File Format Error

I am attempting to use the sngrep utility on a Mac OSX El Capitan 10.11.4 and getting an error when I try to open any pcap file. The error is as follows: Johns-MacBook-Pro:Downloads gojira$ sngrep -...
THE DOCTOR's user avatar
0 votes
1 answer
2k views

TCPDUMP Rotating Capture File using -G not working

I'm attempting to run a tcpdump for packet capture for the headers of encrypted traffic. I'm trying to do it with the rotating capture based off time. This is the command I'm running. sudo tcpdump -...
Brian's user avatar
  • 1
0 votes
1 answer
498 views

How to find 802.11 protocol variant, and decipher packet_payload_info in PcapNG files?

I'm building a (Python) parser of PcapNG files created by Wireshark. After reading https://www.winpcap.org/ntar/draft/PCAP-DumpFileFormat.html, I'm having the following problems: I'd like to ...
boardrider's user avatar
  • 1,145
2 votes
1 answer
1k views

How to split pcap files maintaining tcp sessions

I have a pcap file which contains tcp traces. I was wondering if there's a way to split these traces in order to maintain tcp flows, but also filtering the traffic on a src ip basis. For example, if ...
user3098549's user avatar
0 votes
0 answers
732 views

packet sniffing 3ds

I am trying to packet sniff my 3DS just to see what information is available. With Wireshark I noticed that I can only capture traffic which communicates with my computer directly, and not any device ...
user avatar
0 votes
1 answer
170 views

Config to make only pcap receive packet

I am trying to use pcap to modify the packet before sending it out. For example, I have a server (running Ubuntu) listening on port 8000. Before it sends out SYN-ACK for incoming SYN packet, I am ...
Groot's user avatar
  • 101
1 vote
2 answers
1k views

How do capture filters in Wireshark work internally?

I am wondering exactly what happens internally in TShark when I use a capture filter. Specifically, let's say I have the following filter to capture multicast data: host 224.0.26.3 && port ...
Chuu's user avatar
  • 763
1 vote
1 answer
3k views

Provide Session Master Key to Wireshark UI?

I'm working on an issue with HTTPS. I suspect its related to client certificates. I want to read some of the encrypted handshake messages that follows the ServerHelloDone message. (Once the ...
jww's user avatar
  • 12.1k
5 votes
1 answer
5k views

Why does tcpdump take so long to read pcap files?

I am using a third-party tool that captures network traffic as a pcap file during a network test. When I attempt to play these files back, I use the tcpdump tool with the -Aq -r options, and pipe the ...
Steve HHH's user avatar
  • 7,100
1 vote
2 answers
1k views

Compile Jnetpcap library for ARM platform?

I am trying to execute a java project on arm platform. my code use jnetpcap library. but when i execute the program it shows me an error "/usr/lib/jnetpcap.so: cannot open shared object: no such file ...
ALi's user avatar
  • 21
1 vote
1 answer
3k views

How do I flush Moloch?

I've installed Moloch and the documentation is a bit thin. Does anyone know how I can flush both the database and pcap logs to return the system to a freshly installed state? There is a script for ...
Simmo's user avatar
  • 113
5 votes
2 answers
3k views

Follow a .pcap file in wireshark like tail -f

I have a .pcap file on my android device, that I can access from my PC with wireshark via smb and wondering if it possible to get a 'Live view' of that file in wireshark. Is there any solution?
christophrus's user avatar
0 votes
1 answer
648 views

TCPReplay 3.4.4: Unable to find libpcap in /usr

I'm having a problem installing TCPReplay 3.4.4 for Ubuntu 12.04 LTS. I'm getting this error when I run configure checking for libpcap... configure: error: Unable to find libpcap in /usr I have ...
koralarts's user avatar
  • 101
1 vote
1 answer
597 views

How to differentiate between three different flavours of pcap files?

There appears to be 3 different file formats associated with the ".pcap" extension -- libpcap /w microsecond timestamps, libpcap /w nanosecond timestamps, and pcapng. Is there an easy way to ...
Chuu's user avatar
  • 763
1 vote
3 answers
3k views

Trouble with mergecap [ concatenation of pcap files ] - undesired info in output file

I hope somebody will be able to help me... The problem is with merging multiple .pcap files. Recently - like a week ago I've used a mergecap to merge mutiple pcap files into one. Everything worked ...
mnmnc's user avatar
  • 4,121
18 votes
2 answers
185k views

What's all this deploy.akamaitechnologies.com traffic?

I happened to do a tcpdump while leaving my Mac idle, and when I came back after a mere half-hour there were something like 5000 packets involving deploy.akamaitechnologies.com, in which my computer ...
Warren's user avatar
  • 269
1 vote
1 answer
350 views

How to enter pcap filter in Wireshark 1.8?

Previously in capture options window there was a very handy input field for pcap filter expression. But in 1.8.* this window looks different: So, how to set pcap filter expression before starting ...
gelraen's user avatar
  • 134
2 votes
2 answers
4k views

How to extract mpeg-1 stream from pcap in wireshark

I have a pcap network dump that has an MPEG-1 stream inside and I would like to play the mpeg stream. So far I've tried playing through the RTP analyzer but that plays without any sound. I've also ...
Jason Axelson's user avatar