Questions tagged [sniffing]

Sniffing is the act of passively collecting all network traffic that a machine hears, whether or not it is addressed to that machine. Commonly performed for network diagnostics, programming debugging and troubleshooting, and security analysis.

Filter by
Sorted by
Tagged with
0
votes
0answers
21 views

Monitor HTTP Login Page/Form?

So I'm wondering a bit of an odd question, but got to ask to find out! We've currently created a login page, which deliberately uses HTTP. I was wondering if it would be possible to, from an "external ...
1
vote
0answers
19 views

Openvpn L2/tap losing packets

I'm observing Openvpn consistently dropping certain packets... Scenario: I set up a wide area Layer-2 network (using OpenVPN) to support Minecraft pocket-edition (MCPE) players (just family) to see ...
0
votes
0answers
21 views

Sniffing out the 802.11 protocol version supported(b/g/n)

Is there a way to find out if the Wi-Fi network is running in b/g/n, g/n on n only mode by passive sniffing? Most of the information I have found so far can be seen in this table. However, when I ...
0
votes
0answers
9 views

Use systemctl / systemd to sniff network traffic for the logged in user

I have an agent running as a systemd service which a user installs. Is there a way for this systemd service to be notified of outgoing http traffic? Perhaps to certain domains? This is all with the ...
1
vote
0answers
36 views

How to intercept a flash game's network traffic that doesn't show up in chrome's developer tools

Go to fairgocasino.com in chrome and open any game (let's take for example the first slot in alphabetical order, "5 Wishes"). Open the network tab of developer tools with rightclick -> Inspect -> ...
0
votes
1answer
132 views

What are the specific requirements for libpcap directional capture support?

I'm using libpcap on Linux to capture network traffic from a wireless adapter (2.4 GHz). The pcap_setdirection seems to allow you to setup the capture device so that it ignores traffic originating ...
0
votes
0answers
49 views

Wireshark causing blue screen of death

After researching for weeks on how to get monitor mode to work on Wireshark (it usually unchecks itself), I tried running with admin privileges. This finally let me check the monitor mode box, but ...
0
votes
0answers
117 views

Wireshark can't enable monitor mode

I'm running Wireshark on windows, and when I'm trying to capture in monitor mode. When I click the checkbox to enable monitor mode, it instantly unchecks itself. I've heard about this happening but ...
-2
votes
1answer
91 views

Finding windows computer hardware model from sniffing

Do any of you know a way to find out a computer specific model (eg: Lenovo ThinkPad e490, Dell XPS 13 9380) running windows os, passively, only by sniffing the data the computer sends and receives?
2
votes
1answer
118 views

Can you capture/sniff traffic from LCOW?

Is it possible for a Linux container running on Windows (LCOW) to capture network traffic from the underlying Windows Container Host? I.E. could tcpdump in the Linux container see the network traffic ...
-2
votes
1answer
64 views

How can I sniff the traffic used to set options on the router?

I'm sorry if this ends up being a duplicate; I have read a number of similar questions on here, but none seems to quite fit what I'm asking. My broadband provider, Vodafone, gives my the ability to '...
1
vote
0answers
103 views

Figuring out the direct stream url of an internet station

I enjoy listening to a station called Gone Up radio, but for some reason I can't access it with my Imperial i150 internet radio. It seems to be an aac stream, according to the sniffers I've tried (...
0
votes
0answers
48 views

Capture full trace of HTTPS protocol in firefox/chrome

When I make a request in a browser like firefox or chrome, I would like to view a full trace of the HTTPS protocol, including the http version negotiation, the TLS negotiation, the headers, etc. The ...
0
votes
0answers
77 views

ISP Blocking SNI Extension (Server Name Identifier) In Windows 10 But Not Server 2016

Out of curiosity I noticed my ISP (talktalk - UK) was able to block certain websites by the SNI Extention, however only from Windows 10. When attempting to access the same website from Server 2016, it ...
1
vote
2answers
98 views

Wireshark : unable to catch network traffic to/from a device

I would like to use Wireshark to catch data to/from a device on my network. I have a connected devices (all based on a ESP8266) which have trouble getting out the sleep mode (I think it's that). So I ...
0
votes
0answers
32 views

Is it possible to sniff input traffic after iptables

Normally, tshark sniff traffic like this : before iptables for input traffic after iptables for output traffic is it possible to sniff the traffic ? after iptables for input traffic before iptables ...
0
votes
1answer
49 views

Want to monitor 802.11mc Fine time measurement packets . Is there any packet sniffer that allows me to get all packets/frames from link layer?

I am doing a project with new fine time measurement capability introduced with 802.11mc (2016). I would like to monitor the frames for that. Is it possible to get it using Wireshark or any other ...
0
votes
0answers
32 views

Is my wireless adapter supported for monitoring?

Ive recently bought a https://www.amazon.co.uk/AC1200Mbps-Wireless-Antennas-802-11ac-MacOS10-5-14/dp/B07PQJYLDH/ref=sr_1_1?keywords=high+gain+dual+antenna&qid=1562166711&s=gateway&sr=8-1 ...
0
votes
1answer
64 views

Sniffing communications not working

I am looking for a VirtualBox guru. I tried several settings without success and I don't know what should I try further. I have three virtual machines: Two Windows 7 machines (master-slave ...
0
votes
1answer
36 views

How can I view the traffic of this application?

I have a mobile app which connects to my cars wifi and reports data on it. The app must be connected to the AP the car provides in order to work - I have tested whether the car connects to a public ...
0
votes
1answer
50 views

Sniffing multiple ports of USB Hub simultaneously

I want to send data to an upstream port of a USB hub and read it through all downstream ports of the hub, each connected to a different device i.e broadcasting USB data. Basically to observe & ...
0
votes
1answer
400 views

sending packet with scapy custom ethernet header

Why sending packet with different ethernet source Mac address never reach target? Note: I used scapy sendp for sending the packet and I have my friends laptop up and connected to network?
3
votes
1answer
238 views

Profibus or MODBUS over RS485

We are operating old systems which have many modules we are not able to find on the market. So we are looking for replacements. S7-200 PLC with several sensors is communicating over RS485 pair cable. ...
-1
votes
1answer
44 views

Open website using IP, not domain

I wish to comment Loading a website using IP, but I can't because of reputation. I have question because I don't understand process of opening website hosted with virtual hosting. When I write https:/...
0
votes
0answers
45 views

How default Web Page is loaded with just TCP connection and no HTTP transaction?

Below is the packet capture from WireShark when a web request is made to the Google Server 172.217.26.228 is the IP address of the Google Server. Filter that I am using is (ip.dst == 172.217.26....
1
vote
1answer
69 views

Sniffing data on a network

I have a couple of GoPro's connected to a Smart Remote device. I am able to connect to the hidden wifi access point created by the Smart Remote. I want to observe the communication between the GoPro's ...
2
votes
0answers
306 views

How can I capture and analyse LTE packets using Wireshark and LTE modem? [closed]

Is it possible to analyse LTE packets using Wireshark. I'm having trouble using Wireshark to capture mobile LTE traffic. I ma using a MacBook and a LTE modem. Do I need specific configuration to ...
0
votes
1answer
45 views

Sniff ethernet communication

I have a setup in which I'm connected to a switch and there are 2 more devices there. Just protocol converters ... that have recently stopped working. Since this equipment doesn't have any type of ...
0
votes
1answer
802 views

How to force Linux bridge to output frame on multiple interfaces?

I have a Linksys E2500 router running Tomato v1.28 (Linux kernel 2.6.22.19, no USB drive capability) that is functioning in bridge mode to connect three interfaces: root@TomatoE2500Host:/# brctl show ...
0
votes
0answers
51 views

Iptables rules seem to be missing packets?

On my home network (192.168.1.0/24), I am trying to use iptables to silently clone all wifi TCP/UDP traffic to/from my Xbox One to my Windows 10 desktop, for packet sniffing via Wireshark. Due to ...
0
votes
1answer
88 views

tcpdump: (all BPF devices are busy) - How to solve this

I was running tcpdump and then after some time I got this error: tcpdump: (all BPF devices are busy) I am not sure why? I killed all tcpdump processes, in case that this had something to do with it, ...
0
votes
1answer
158 views

How to make Wireshark show http format instead of 802.11 or check if Wireshark is capturing it

First of all, this might look like a duplicate from this post, and it kind of is, but at the time writing my rep is not high enough to comment and I was walking in to some issues whilst applying that ...
0
votes
1answer
108 views

can I sniff traffic with NIC connected to network and without having IP address

Is it possible to sniff network traffic by just connecting to network but without assigning IP address to NIC? If sniffing is not possible, how easy is to guess get valid IP address if DHCP is ...
0
votes
1answer
199 views

tshark: using frame contains and write to file

i want to filter out TCP packets that contain a specific string in the frame data (data.data) tshark -i 1 -f "tcp port 8800" -Y "frame contains FILE" -w "data.txt" This is exactly what i want. ...
0
votes
0answers
325 views

trying to enable monitor mode in Raspbian

I followed this tutorial in order to enable monitor mode in my Raspberry Pi 3, when I get to the step where I have to create the monitor interface, I've got the following error: iw phy iw dev wlan0 ...
1
vote
1answer
575 views

TcpDump capture stops after few minutes. (Windows)

I'm trying to capture all my networking with tcpdump. I'm using tcpdump.exe -i {} -W 5 -C 10 -w capfile. After 10 mints (+-) the capture stopped for some reason, and tcpdump is still running. Maybe ...
0
votes
1answer
206 views

Capturing Link layer frames

I've been trying to capture link layer frames. I've tried using wireshark (also tcpdump and airmon-ng) both in monitor mode and managed mode (/promiscuous mode), yet have been unable to see them. Put ...
0
votes
1answer
529 views

Configuring virtual network interface as sniffing interface

I have a Snort IDS running Ubuntu Server 16.04 with one physical ethernet interface (eno1). I have configured two virtual network interfaces using the eno1 interface: eno1:0 for the sniffing interface ...
1
vote
0answers
78 views

Configuring virtual network interface as sniffing interface

I have a Snort IDS running Ubuntu Server 16.04 with one physical ethernet interface (eno1). I have configured two virtual network interfaces using the eno1 interface: eno1:0 for the sniffing interface ...
0
votes
1answer
777 views

Decrypting Application Data with (Pre)-Master-Secret log file in Wireshark

I've read a few articles outlining a process for decrypting SSL/TLS traffic without a private key. Session keys are generated in a log file, which are then read from Wireshark by point to the log file....
0
votes
2answers
78 views

Packets sniffer and domain

I have a doubt about packets sniffer. I read that it can sniff only in local segment and often it is referred as collision domain. But... The collision domain for a switch is each single port ...
0
votes
2answers
323 views

Sniff packets seeing interface name and in/out flag

I'm trying to monitor my traffic and installed WireShark as found most recommended tool, on Linux. However, I found no sure way to see if packet is incoming or outgoing and display interface name (...
0
votes
1answer
50 views

Does FIlezilla (or FTP in general) have any sniffer protection?

Is possible track credentials of a normal Filezilla connection (no SFTP) in the same wifi with methods like "Man in the Middle", or the program have any security about this?
0
votes
0answers
847 views

Wireshark capture ARP traffic and EAPOL

I'm trying to capture only ARP traffic and EAPOL on wireshark. I'm using the following capture filter: ether proto 0x888e or arp But I only capture EAPOL traffic. On the other hand using the ...
0
votes
1answer
539 views

How to sniff all ARP traffic on a WiFi network?

I would like to know if it's possible to sniff all ARP traffic (even if I am not the intender destination) on a WiFi network. I've tried on Wireshark and Scapy neither works. Thank you.
-1
votes
1answer
67 views

Wireshark - what happened?

This Wireshark issue has been driving my crazy for a few hours. What's happening here? 192.168.2.100 is an Apache server that is serving a static file. 192.168.2.196 is an embedded client ...
0
votes
1answer
292 views

How to inspect particular DHCP server response by IP (linux)?

I have following setup: ISP -> junk-isp-router -> MikroTik RB2011 -> ... Yesterday I enabled rogue DHCP server alerting on RB2011 and today I received alert that it somehow got DHCP ...
0
votes
1answer
1k views

How do I sniff traffic from a vm using another vm using Wireshark in the same network?

I have setup 2 virtual machines. Ubuntu16.04 - 10.10.130.10 Kali-rolling with wireshark 2.2.7 - 10.10.130.13 Both have access to the internet. I'm trying to understand how the flows look like when ...
0
votes
1answer
956 views

How To Sniff Modem's Traffic

Every time my Modem (Sagem F@ST 3284, which is also a router) reboots it sends a request to the ISP with the current OS version. If it's not updated it will download the firmware from the ISP and ...
0
votes
0answers
105 views

Only outputting plain text from TShark

I was wondering if there was a feature like follow TCP stream for TShark. I have a got a NetCat IRC server setup with the following command: nc -lnvp 1234. My android phone connects with netcat 10.0....

1
2 3 4 5 6