Questions tagged [sniffing]

Sniffing is the act of passively collecting all network traffic that a machine hears, whether or not it is addressed to that machine. Commonly performed for network diagnostics, programming debugging and troubleshooting, and security analysis.

Filter by
Sorted by
Tagged with
0
votes
0answers
27 views

Is my wireless adapter supported for monitoring?

Ive recently bought a https://www.amazon.co.uk/AC1200Mbps-Wireless-Antennas-802-11ac-MacOS10-5-14/dp/B07PQJYLDH/ref=sr_1_1?keywords=high+gain+dual+antenna&qid=1562166711&s=gateway&sr=8-1 ...
0
votes
0answers
44 views

Obtaining the data from a tcp packet from a jq-200 air quality sensor

I have a cheap jq-200 air quality sensor that measures CO2 amongst other things. You can get them on Ebay or Aliexpress for around $20. It connects to a WIFI network and then sends data to a server in ...
0
votes
1answer
57 views

Sniffing communications not working

I am looking for a VirtualBox guru. I tried several settings without success and I don't know what should I try further. I have three virtual machines: Two Windows 7 machines (master-slave ...
0
votes
0answers
24 views

MITM attack error, no sniffing program works

I'm running a guest kali Linux OS with VMware Workstation (with a wireless adapter) and trying to learn how to use ethercap. I have followed strictly the orders of many tutorials and none of the ...
0
votes
1answer
30 views

How can I view the traffic of this application?

I have a mobile app which connects to my cars wifi and reports data on it. The app must be connected to the AP the car provides in order to work - I have tested whether the car connects to a public ...
0
votes
1answer
30 views

Sniffing multiple ports of USB Hub simultaneously

I want to send data to an upstream port of a USB hub and read it through all downstream ports of the hub, each connected to a different device i.e broadcasting USB data. Basically to observe & ...
0
votes
1answer
188 views

sending packet with scapy custom ethernet header

Why sending packet with different ethernet source Mac address never reach target? Note: I used scapy sendp for sending the packet and I have my friends laptop up and connected to network?
0
votes
0answers
191 views

sending ARP packet with fake source mac address scapy

i am trying to send ARP packet with fake Ether mac address with scapy. sniffing trafic with wireshark shows that the packet is sent to its destination. but no Response and the target machine shows no ...
3
votes
1answer
70 views

Profibus or MODBUS over RS485

We are operating old systems which have many modules we are not able to find on the market. So we are looking for replacements. S7-200 PLC with several sensors is communicating over RS485 pair cable. ...
0
votes
0answers
34 views

how to find Devices IP from monitor mode network card

i am trying to find my my friends laptop IP using my laptop without connecting to the AP ("using network card in monitor mode") but all i get is beacons and probes not include TCP or IP headers
-1
votes
1answer
38 views

Open website using IP, not domain

I wish to comment Loading a website using IP, but I can't because of reputation. I have question because I don't understand process of opening website hosted with virtual hosting. When I write https:/...
0
votes
0answers
22 views

How default Web Page is loaded with just TCP connection and no HTTP transaction?

Below is the packet capture from WireShark when a web request is made to the Google Server 172.217.26.228 is the IP address of the Google Server. Filter that I am using is (ip.dst == 172.217.26....
1
vote
1answer
44 views

Sniffing data on a network

I have a couple of GoPro's connected to a Smart Remote device. I am able to connect to the hidden wifi access point created by the Smart Remote. I want to observe the communication between the GoPro's ...
0
votes
0answers
44 views

Tracing how an HTTPS API server communicates with smart devices

I've been trying to work out for days how the TP-Link API communicates with the HS100 or any other TP-Link smart device. There is no official documentation, and it's been driving me mad. I use ...
2
votes
0answers
228 views

How can I capture and analyse LTE packets using Wireshark and LTE modem? [closed]

Is it possible to analyse LTE packets using Wireshark. I'm having trouble using Wireshark to capture mobile LTE traffic. I ma using a MacBook and a LTE modem. Do I need specific configuration to ...
0
votes
1answer
37 views

Sniff ethernet communication

I have a setup in which I'm connected to a switch and there are 2 more devices there. Just protocol converters ... that have recently stopped working. Since this equipment doesn't have any type of ...
0
votes
1answer
424 views

How to force Linux bridge to output frame on multiple interfaces?

I have a Linksys E2500 router running Tomato v1.28 (Linux kernel 2.6.22.19, no USB drive capability) that is functioning in bridge mode to connect three interfaces: root@TomatoE2500Host:/# brctl show ...
0
votes
0answers
41 views

Iptables rules seem to be missing packets?

On my home network (192.168.1.0/24), I am trying to use iptables to silently clone all wifi TCP/UDP traffic to/from my Xbox One to my Windows 10 desktop, for packet sniffing via Wireshark. Due to ...
0
votes
1answer
38 views

tcpdump: (all BPF devices are busy) - How to solve this

I was running tcpdump and then after some time I got this error: tcpdump: (all BPF devices are busy) I am not sure why? I killed all tcpdump processes, in case that this had something to do with it, ...
0
votes
1answer
80 views

How to make Wireshark show http format instead of 802.11 or check if Wireshark is capturing it

First of all, this might look like a duplicate from this post, and it kind of is, but at the time writing my rep is not high enough to comment and I was walking in to some issues whilst applying that ...
-1
votes
1answer
75 views

can I sniff traffic with NIC connected to network and without having IP address

Is it possible to sniff network traffic by just connecting to network but without assigning IP address to NIC? If sniffing is not possible, how easy is to guess get valid IP address if DHCP is ...
0
votes
0answers
124 views

tshark: using frame contains and write to file

i want to filter out TCP packets that contain a specific string in the frame data (data.data) tshark -i 1 -f "tcp port 8800" -Y "frame contains FILE" -w "data.txt" This is exactly what i want. ...
0
votes
0answers
224 views

trying to enable monitor mode in Raspbian

I followed this tutorial in order to enable monitor mode in my Raspberry Pi 3, when I get to the step where I have to create the monitor interface, I've got the following error: iw phy iw dev wlan0 ...
1
vote
1answer
372 views

TcpDump capture stops after few minutes. (Windows)

I'm trying to capture all my networking with tcpdump. I'm using tcpdump.exe -i {} -W 5 -C 10 -w capfile. After 10 mints (+-) the capture stopped for some reason, and tcpdump is still running. Maybe ...
0
votes
1answer
136 views

Capturing Link layer frames

I've been trying to capture link layer frames. I've tried using wireshark (also tcpdump and airmon-ng) both in monitor mode and managed mode (/promiscuous mode), yet have been unable to see them. Put ...
0
votes
1answer
345 views

Configuring virtual network interface as sniffing interface

I have a Snort IDS running Ubuntu Server 16.04 with one physical ethernet interface (eno1). I have configured two virtual network interfaces using the eno1 interface: eno1:0 for the sniffing interface ...
1
vote
0answers
46 views

Configuring virtual network interface as sniffing interface

I have a Snort IDS running Ubuntu Server 16.04 with one physical ethernet interface (eno1). I have configured two virtual network interfaces using the eno1 interface: eno1:0 for the sniffing interface ...
0
votes
1answer
578 views

Decrypting Application Data with (Pre)-Master-Secret log file in Wireshark

I've read a few articles outlining a process for decrypting SSL/TLS traffic without a private key. Session keys are generated in a log file, which are then read from Wireshark by point to the log file....
0
votes
2answers
66 views

Packets sniffer and domain

I have a doubt about packets sniffer. I read that it can sniff only in local segment and often it is referred as collision domain. But... The collision domain for a switch is each single port ...
0
votes
2answers
239 views

Sniff packets seeing interface name and in/out flag

I'm trying to monitor my traffic and installed WireShark as found most recommended tool, on Linux. However, I found no sure way to see if packet is incoming or outgoing and display interface name (...
0
votes
1answer
36 views

Does FIlezilla (or FTP in general) have any sniffer protection?

Is possible track credentials of a normal Filezilla connection (no SFTP) in the same wifi with methods like "Man in the Middle", or the program have any security about this?
0
votes
0answers
655 views

Wireshark capture ARP traffic and EAPOL

I'm trying to capture only ARP traffic and EAPOL on wireshark. I'm using the following capture filter: ether proto 0x888e or arp But I only capture EAPOL traffic. On the other hand using the ...
0
votes
1answer
482 views

How to sniff all ARP traffic on a WiFi network?

I would like to know if it's possible to sniff all ARP traffic (even if I am not the intender destination) on a WiFi network. I've tried on Wireshark and Scapy neither works. Thank you.
-1
votes
1answer
62 views

Wireshark - what happened?

This Wireshark issue has been driving my crazy for a few hours. What's happening here? 192.168.2.100 is an Apache server that is serving a static file. 192.168.2.196 is an embedded client ...
0
votes
1answer
247 views

How to inspect particular DHCP server response by IP (linux)?

I have following setup: ISP -> junk-isp-router -> MikroTik RB2011 -> ... Yesterday I enabled rogue DHCP server alerting on RB2011 and today I received alert that it somehow got DHCP ...
0
votes
1answer
897 views

How do I sniff traffic from a vm using another vm using Wireshark in the same network?

I have setup 2 virtual machines. Ubuntu16.04 - 10.10.130.10 Kali-rolling with wireshark 2.2.7 - 10.10.130.13 Both have access to the internet. I'm trying to understand how the flows look like when ...
0
votes
1answer
747 views

How To Sniff Modem's Traffic

Every time my Modem (Sagem F@ST 3284, which is also a router) reboots it sends a request to the ISP with the current OS version. If it's not updated it will download the firmware from the ISP and ...
0
votes
0answers
78 views

Only outputting plain text from TShark

I was wondering if there was a feature like follow TCP stream for TShark. I have a got a NetCat IRC server setup with the following command: nc -lnvp 1234. My android phone connects with netcat 10.0....
0
votes
1answer
278 views

ESP8266 TCPDump only arp but no tcp

I have a problem with sniffing a ESP8266. I use a raspberry pi 3 as wifi access point (no wpa in use), a laptop as a server and the esp to communicate to the server. When I use tcpdump on my ...
1
vote
2answers
336 views

How to sniff a virsh virtual bridge from a virtual machine

So I want to sniff the traffic from a virtual bridge (virbr2) from a virtual machine. I can successfully sniff virbr2 directly from the host machine, but when setting that interface to the virtual ...
1
vote
1answer
783 views

iptables -L not showing all rules?

I've added this rule with iptables: iptables -t mangle -I PREROUTING -j TEE --gateway 192.162.122.62 I've checked it with iptables -L or iptables -S but I can't see anything. Is that normal? how can ...
0
votes
2answers
131 views

How can one send packets or files on a LAN IP without it being wanted by the receiving computer

I don't know if it is possible but I want to know if someone connected on your LAN can send a file to you by just knowing your LAN IP addresses. I mean without you putting the computer in listening ...
0
votes
2answers
3k views

How to decrypt 802.11 packets manually?

Without using Wireshark, how are 802.11 meant to be decrypted? I know the EAPOL and passphrase are required, but what are the steps required to perform the decryption? Another way to put it is, how ...
0
votes
1answer
412 views

how to program tcpdump to only capture packets and nothing else

I am developing a program where a .pcap file is going to be an input. However, when I run tcpdump -w someFile.pcap ,in Terminal, the .pcap file captures extra data such as timestamp, microseconds, ...
0
votes
1answer
135 views

Packet sniffer in Network?

I found a blocked MAC address (00-1A-B6-00-64-00) in MAC access list and after disabling the MAC filtering show this detail in Wireshark : Frame 112389: 342 bytes on wire (2736 bits), 342 bytes ...
2
votes
1answer
527 views

Battlefield: Inspect packet-loss and packet-return-time of multiplayer game

I'm aware that this is an unusual question, but it seems the people here are very likely the ones who can help. I'm trying to debug with my ISP why I'm having extreme lags during gameplay. Question: ...
0
votes
0answers
477 views

Auomtatically capture and analyze IP traffic with netsh on Windows

I'm looking to capture all IP traffic on a Windows machine to/from all interfaces. I must be able to capture the process ID which generated the outgoing traffic. I need to be able to trigger ...
2
votes
2answers
2k views

Sniff wireless traffic between two machines via Wireshark

Foreword: I am woefully inexperienced with this. As in, this is literally my first time encountering something like this. Please bear with me. Hello everyone, The situation is as follows. We (as in, ...
0
votes
1answer
5k views

how to capture only SMTP using latest Wireshark 2.2.6 or later

I am debugging a problem with my Azure VM Windows server receiving SMTP from the Internet, and want to use Wireshark to show ONLY SMTP. I would also like to use Wireshark to show the contents of the ...
1
vote
0answers
336 views

Tcpdump or similar - How can I only capture one instance of each packet destination and port?

I want to leave something like tcpdump running for up to a week and therefore make its output as concise as possible to reduce file size and speed up post-capture analysis. All I need to to do is log ...