Stack Exchange Network

Stack Exchange network consists of 174 Q&A communities including Stack Overflow, the largest, most trusted online community for developers to learn, share their knowledge, and build their careers.

Visit Stack Exchange

Questions tagged [sniffing]

Sniffing is the act of passively collecting all network traffic that a machine hears, whether or not it is addressed to that machine. Commonly performed for network diagnostics, programming debugging and troubleshooting, and security analysis.

0
votes
0answers
17 views

Iptables rules seem to be missing packets?

On my home network (192.168.1.0/24), I am trying to use iptables to silently clone all wifi TCP/UDP traffic to/from my Xbox One to my Windows 10 desktop, for packet sniffing via Wireshark. Due to ...
0
votes
1answer
12 views

tcpdump: (all BPF devices are busy) - How to solve this

I was running tcpdump and then after some time I got this error: tcpdump: (all BPF devices are busy) I am not sure why? I killed all tcpdump processes, in case that this had something to do with it, ...
0
votes
1answer
45 views

How to make Wireshark show http format instead of 802.11 or check if Wireshark is capturing it

First of all, this might look like a duplicate from this post, and it kind of is, but at the time writing my rep is not high enough to comment and I was walking in to some issues whilst applying that ...
-1
votes
1answer
28 views

can I sniff traffic with NIC connected to network and without having IP address

Is it possible to sniff network traffic by just connecting to network but without assigning IP address to NIC? If sniffing is not possible, how easy is to guess get valid IP address if DHCP is ...
0
votes
0answers
22 views

tshark: using frame contains and write to file

i want to filter out TCP packets that contain a specific string in the frame data (data.data) tshark -i 1 -f "tcp port 8800" -Y "frame contains FILE" -w "data.txt" This is exactly what i want. ...
0
votes
0answers
55 views

trying to enable monitor mode in Raspbian

I followed this tutorial in order to enable monitor mode in my Raspberry Pi 3, when I get to the step where I have to create the monitor interface, I've got the following error: iw phy iw dev wlan0 ...
0
votes
0answers
102 views

Different TLS versions in the ClientHello from the same client

I have a python client. Using ssl.SSLContext() (documentation here) and set_ciphers(myciphers) (where myciphers is my list of ciphersuites that I change with every handshake, i.e., with every socket ...
0
votes
0answers
144 views

Visualizing Packet Captures in Grafana

What is the best way to import a pcap into Grafana? Is there a particular data source or process that should be followed?
0
votes
1answer
129 views

TcpDump capture stops after few minutes. (Windows)

I'm trying to capture all my networking with tcpdump. I'm using tcpdump.exe -i {} -W 5 -C 10 -w capfile. After 10 mints (+-) the capture stopped for some reason, and tcpdump is still running. Maybe ...
0
votes
1answer
44 views

Capturing Link layer frames

I've been trying to capture link layer frames. I've tried using wireshark (also tcpdump and airmon-ng) both in monitor mode and managed mode (/promiscuous mode), yet have been unable to see them. Put ...
0
votes
1answer
174 views

Configuring virtual network interface as sniffing interface

I have a Snort IDS running Ubuntu Server 16.04 with one physical ethernet interface (eno1). I have configured two virtual network interfaces using the eno1 interface: eno1:0 for the sniffing interface ...
1
vote
0answers
19 views

Configuring virtual network interface as sniffing interface

I have a Snort IDS running Ubuntu Server 16.04 with one physical ethernet interface (eno1). I have configured two virtual network interfaces using the eno1 interface: eno1:0 for the sniffing interface ...
0
votes
1answer
198 views

Decrypting Application Data with (Pre)-Master-Secret log file in Wireshark

I've read a few articles outlining a process for decrypting SSL/TLS traffic without a private key. Session keys are generated in a log file, which are then read from Wireshark by point to the log file....
0
votes
2answers
35 views

Packets sniffer and domain

I have a doubt about packets sniffer. I read that it can sniff only in local segment and often it is referred as collision domain. But... The collision domain for a switch is each single port ...
0
votes
2answers
105 views

Sniff packets seeing interface name and in/out flag

I'm trying to monitor my traffic and installed WireShark as found most recommended tool, on Linux. However, I found no sure way to see if packet is incoming or outgoing and display interface name (...
0
votes
1answer
29 views

Does FIlezilla (or FTP in general) have any sniffer protection?

Is possible track credentials of a normal Filezilla connection (no SFTP) in the same wifi with methods like "Man in the Middle", or the program have any security about this?
0
votes
0answers
749 views

tcpdump: How can I detect the end of a packet in realtime captures?

I am capturing packets using tcpdump for real-time processing. I'm using the IEEE_80211_RADIO headers and processing the output in a python 3 script. My invocation currently looks like this: tcpdump -...
0
votes
0answers
367 views

Wireshark capture ARP traffic and EAPOL

I'm trying to capture only ARP traffic and EAPOL on wireshark. I'm using the following capture filter: ether proto 0x888e or arp But I only capture EAPOL traffic. On the other hand using the ...
0
votes
1answer
326 views

How to sniff all ARP traffic on a WiFi network?

I would like to know if it's possible to sniff all ARP traffic (even if I am not the intender destination) on a WiFi network. I've tried on Wireshark and Scapy neither works. Thank you.
-1
votes
1answer
56 views

Wireshark - what happened?

This Wireshark issue has been driving my crazy for a few hours. What's happening here? 192.168.2.100 is an Apache server that is serving a static file. 192.168.2.196 is an embedded client ...
0
votes
1answer
131 views

How to inspect particular DHCP server response by IP (linux)?

I have following setup: ISP -> junk-isp-router -> MikroTik RB2011 -> ... Yesterday I enabled rogue DHCP server alerting on RB2011 and today I received alert that it somehow got DHCP ...
0
votes
1answer
588 views

How do I sniff traffic from a vm using another vm using Wireshark in the same network?

I have setup 2 virtual machines. Ubuntu16.04 - 10.10.130.10 Kali-rolling with wireshark 2.2.7 - 10.10.130.13 Both have access to the internet. I'm trying to understand how the flows look like when ...
0
votes
1answer
560 views

How To Sniff Modem's Traffic

Every time my Modem (Sagem F@ST 3284, which is also a router) reboots it sends a request to the ISP with the current OS version. If it's not updated it will download the firmware from the ISP and ...
0
votes
0answers
51 views

Only outputting plain text from TShark

I was wondering if there was a feature like follow TCP stream for TShark. I have a got a NetCat IRC server setup with the following command: nc -lnvp 1234. My android phone connects with netcat 10.0....
0
votes
1answer
233 views

ESP8266 TCPDump only arp but no tcp

I have a problem with sniffing a ESP8266. I use a raspberry pi 3 as wifi access point (no wpa in use), a laptop as a server and the esp to communicate to the server. When I use tcpdump on my ...
1
vote
2answers
183 views

How to sniff a virsh virtual bridge from a virtual machine

So I want to sniff the traffic from a virtual bridge (virbr2) from a virtual machine. I can successfully sniff virbr2 directly from the host machine, but when setting that interface to the virtual ...
0
votes
1answer
497 views

iptables -L not showing all rules?

I've added this rule with iptables: iptables -t mangle -I PREROUTING -j TEE --gateway 192.162.122.62 I've checked it with iptables -L or iptables -S but I can't see anything. Is that normal? how can ...
0
votes
2answers
102 views

How can one send packets or files on a LAN IP without it being wanted by the receiving computer

I don't know if it is possible but I want to know if someone connected on your LAN can send a file to you by just knowing your LAN IP addresses. I mean without you putting the computer in listening ...
0
votes
2answers
2k views

How to decrypt 802.11 packets manually?

Without using Wireshark, how are 802.11 meant to be decrypted? I know the EAPOL and passphrase are required, but what are the steps required to perform the decryption? Another way to put it is, how ...
0
votes
1answer
335 views

how to program tcpdump to only capture packets and nothing else

I am developing a program where a .pcap file is going to be an input. However, when I run tcpdump -w someFile.pcap ,in Terminal, the .pcap file captures extra data such as timestamp, microseconds, ...
0
votes
1answer
110 views

Packet sniffer in Network?

I found a blocked MAC address (00-1A-B6-00-64-00) in MAC access list and after disabling the MAC filtering show this detail in Wireshark : Frame 112389: 342 bytes on wire (2736 bits), 342 bytes ...
1
vote
1answer
342 views

Battlefield: Inspect packet-loss and packet-return-time of multiplayer game

I'm aware that this is an unusual question, but it seems the people here are very likely the ones who can help. I'm trying to debug with my ISP why I'm having extreme lags during gameplay. Question: ...
0
votes
0answers
370 views

Auomtatically capture and analyze IP traffic with netsh on Windows

I'm looking to capture all IP traffic on a Windows machine to/from all interfaces. I must be able to capture the process ID which generated the outgoing traffic. I need to be able to trigger ...
1
vote
2answers
1k views

Sniff wireless traffic between two machines via Wireshark

Foreword: I am woefully inexperienced with this. As in, this is literally my first time encountering something like this. Please bear with me. Hello everyone, The situation is as follows. We (as in, ...
0
votes
1answer
2k views

how to capture only SMTP using latest Wireshark 2.2.6 or later

I am debugging a problem with my Azure VM Windows server receiving SMTP from the Internet, and want to use Wireshark to show ONLY SMTP. I would also like to use Wireshark to show the contents of the ...
1
vote
0answers
235 views

Tcpdump or similar - How can I only capture one instance of each packet destination and port?

I want to leave something like tcpdump running for up to a week and therefore make its output as concise as possible to reduce file size and speed up post-capture analysis. All I need to to do is log ...
0
votes
1answer
98 views

How to capture network traffic periodically, with every capture file containing full network flows

I need to dump network flow periodically on a Linux platform, ideally using the command line interface (i.e., non-GUI tools), and I want every capture file (pcap files) to contain complete flows. How ...
1
vote
0answers
64 views

Can't see mirrored packets from dd-wrt flashed router

I have a Linksys/Cisco wrt610n v1 router running dd-wrt. I have port mirroring enabled on my primary switch and it is mirroring the packets that I need to monitor into port 2 on my dd-wrt router. I ...
0
votes
1answer
63 views

Why does a chromebook call out to these non existent domains?

Is this one of their forms of checking for a captive portal or what?
0
votes
2answers
77 views

Capture traffic over https in work area

I'm working in an enterprise. I was wondering when I visit websites that support https protocol, is it possible for anyone who accesses network of the enterprise(e.g. Network owner) to capture what ...
0
votes
1answer
665 views

Wireshark highlight missing sequence number

I run Iperf over wifi sending udp packets from a client to a server and I capture the traffic with Wireshark. The total number of datagrams captured in Wireshark is less than sent with Iperf. Based on ...
0
votes
2answers
1k views

Port mirroring Vs. Network Sniffer?

What's the difference between capturing the internet traffic using Port mirroring hub installed on router and simply running a Wireshark on the computer on which you want to capture the packets? I ...
0
votes
1answer
263 views

tcpreplay does not work

I have a problem with tcpreplay and hostapd, this is my scenario: a client connects to 172.24.1.91/OPEN and /CLOSE and processes a GET request to a server that lights up or down a Led. I made a Java ...
0
votes
1answer
46 views

Inspect/sniff unencyrpted packets on my local network between 2 devices

Long story short I'm trying to reverse engineer an app that makes http (not ssl) requests to my TV to tinker with some home automation. I spoofed my TVs mac address and switched to it's IP while the ...
0
votes
0answers
875 views

Enterprise Wireless 5GHz Deauth

I am running blackbox pentests on an enterprise wireless setup. My area of attack consists of multiple APs that have both a 2.4GHz and a 5GHz radio. I have successfully deauthenticated users from the ...
1
vote
2answers
21k views

How to get the URL from a internet radio station so I can stream it from VLC

How do I could get the embedded URL from this internet radio? http://wp.1045radiolatina.com/escucha-en-vivo/ What I meaning by URL from where is the radio is streamed. I have been trying to use URL ...
0
votes
1answer
474 views

Why isn't wireshark capturing/displaying all traffic to/from my laptop

I'm currently using Wireshark 2.2.1 on my MBP (running OSX 10.9.5). I'm trying to look at packets when I visit/log into our Jenkins server to prove something. Our Jenkins server is not running SSL, ...
1
vote
0answers
89 views

Wireshark can't see cellular activity on Win10 tablet

I'm running Windows 10 Enterprise x64 on an HP Pro x2 612 G1 Tablet, with a Verizon SIM card to allow cellular data connectivity. I've installed Wireshark 2.2.1 and can't see any activity on any of ...
0
votes
2answers
142 views

Can I determine where a signal is coming from if I have two wifi receivers

I've been rolling this around in my head for a while, and I know there are a lot of variables that can effect this, but.... If I have two wifi receivers that I set in monitor mode, that will log ...
0
votes
1answer
209 views

Blocking Virtual Machine (VMWare) IP on host PC

I have a packet sniffer/analyzer running on my host machine which reads packets sent and received between two virtual machines (using VMWare). Both virtual machines' networks are NAT. The packet ...