34
votes
Accepted
Can I detect sniffers in monitor mode on my Wi-Fi?
No, they're just getting the radio waves out of the air. As long as they're not sending anything, you can't tell that they're receiving. (It's like how FM radio stations can't tell who or how many ...
- 40.4k
10
votes
Capture traffic for specific application
It is possible to capture all network traffic for a given application by intercepting Windows Sockets API calls. These are the tools that may help.
Proxocket written by Luigi Auriemma. It intercepts ...
- 366
8
votes
Capturing traffic by HTTP host name, not by IP, via WireShark
Capture filters cannot do what you want. Display filters however, can. Using the HTTP filters, you can do this: http.host == "example.com".
- 61.6k
6
votes
Accepted
How to get the URL from a internet radio station so I can stream it from VLC
This question has been already been answered:
https://stackoverflow.com/questions/28314897/how-to-get-direct-streaming-url-from-this-flash-online-streaming-radio-station
To answer your question, ...
6
votes
How do I return just the Http header from tshark?
In fact you can! All previous answers were very close. All you need is -O flag which filters out all the information but HTTP.
tshark -O http -R http.request tcp port 80 or tcp port 443
- 196
4
votes
How do I put my wireless interface back into managed mode from monitor mode in Mac OS X without rebooting?
There is no way for any process leave the interface in monitor mode after exit.
While this holds true most of the time when we run (on El Capitan):
# sudo tcpdump -p -I -i enX -y IEEE802_11
The ...
- 41
4
votes
Accepted
Wireshark to capture all IP devices on a network
The ethernet ports on the Asus RT-AC68U must be switch ports, so a device connected to any of those ports will see only traffic directed to it and broadcasts, therefore your sniffing device must be on ...
- 17.4k
4
votes
How to ensure, that firewall does not pass any external packets into LAN?
NAT doesn’t necessarily mean it’s performed on all interfaces. It could, but on consumer routers there’s usually just two types of translations (simplified):
Replace source address on outgoing ...
- 61.6k
4
votes
Can I determine where a signal is coming from if I have two wifi receivers
No, not from mere signal strength. There are many reasons this won't work.
The most obvious problem: That won't describe a unique location. For example, if the signal strength was the same at both ...
- 61.6k
4
votes
Retrieving MAC address via tunnel
MAC addresses are only ever seen or relevant on the local layer-2 LAN. Also, not all layer-2 networks use MAC addresses, some use other addressing, and some use no addressing. Of those that do use MAC ...
- 3,395
3
votes
Wireshark to capture all IP devices on a network
As @jcbermu said, your router's ports are like a switch, and switched networks only send replies to the "correct" port rather than flooding the entire net. (In this case they aren't even sent to ...
- 436k
3
votes
Accepted
How do I capture device specific USB packets with tshark?
How do I capture device specific USB packets with tshark?
I know the Device ID(0x0009), and Vendor ID(0x08f7) how can I specify the exact device I want to capture, via tshark?
You might want to ...
3
votes
Sniff packets seeing interface name and in/out flag
Wireshark and its command-line companion capture tools tshark and dumpcap allow you to specify multiple interfaces to capture on. So for example, rather than specify -i any and end up with a Linux ...
3
votes
Wireshark : unable to catch network traffic to/from a device
You can’t see traffic of other devices on your network unless it is directly between your device and the other device. The only traffic you will see are broadcasts.
All modern Ethernet networks are ...
- 11.6k
2
votes
Accepted
Listing all devices connected to a simple router remotely
Getting that kind of data from the router itself might be tricky, if the router doesn't have a good interface for you to do it on.
Failing that, I'd say just fire up nmap and do either a ping scan or ...
- 746
2
votes
Accepted
promiscuous mode not working
Promiscious mode will not always allow you to see traffic while Client isolation is in play. Promiscuous mode just means that your PC will process all frames received and decoded. On many APs/wnics/...
- 35.4k
2
votes
Blocking Virtual Machine (VMWare) IP on host PC
That is happening because most probably you are applying firewall rules to some other profile rather than applying it on the profile in which VM interface is.
To select the profile for your interface ...
- 674
2
votes
Accepted
NetFlow packet analyze
You need a Netflow collector, which receives the Netflow records generated by the 7200, organizes them and displays the data in a meaningful format. You can find commercial and freeware collectors ...
- 621
2
votes
Accepted
How to sniff packages of the entire network (not only broadcast)?
On a modern switched Ethernet network, you need to somehow convince the switch to send the packets to your port, not to the recipient's. This can be done with:
Manual configuration: managed switches ...
2
votes
Accepted
Interpreting wireshark output
What info do these dots imply?
They represent non-printable characters - things like newlines, carriage feeds, EOF, NUL, etc. etc. You can look at the corresponding hex code (to the left) to figure ...
- 1,777
2
votes
Port mirroring Vs. Network Sniffer?
Port mirroring allows you to do network sniffing.
Port mirroring refers to the concept of duplication traffic.
Network sniffing refers to the concept of paying attention to the packet's contents. (An ...
- 15.5k
2
votes
How to get the URL from a internet radio station so I can stream it from VLC
In my review of the guides above, none worked for me, but we all know how often the internet changes.
This example is based on iHeartRadio Smooth Jazz station
Using Apple's Safari Browser v15.2
Find ...
- 21
2
votes
Port mirroring Vs. Network Sniffer?
If you want a more in-depth look at capturing, I would highly recommend the 5-part "Network Capture Playbook" series, by Jasper Bongertz. Jasper has done an excellent job in presenting the ...
2
votes
Accepted
Capture traffic over https in work area
As with most things, that depends...
In an enterprise environment, you will likely have some sort of security appliance that your connection will have to use. When your https connection passes that ...
- 171
2
votes
Accepted
How to inspect particular DHCP server response by IP (linux)?
How to inspect particular DHCP server response by IP (linux)?
tcpdump -i eth0 -w log.pcap -n "src net 1.2.3.4/18 or 9.8.7.6/20"
Will log all traffic and/or you can apply filters like source,...
- 13.8k
2
votes
Accepted
Decrypting Application Data with (Pre)-Master-Secret log file in Wireshark
No, probably not, unless the key was logged later in the same session. Each session uses its own key.
Per MSDN:
session
An exchange of messages under the protection of a single piece of
keying ...
- 35.4k
2
votes
How to force Linux bridge to output frame on multiple interfaces?
The forwarding database only supports mapping unicast addresses to one port (which is apropriate for 'unicast' having one destination). There are other methods:
You can use iptables' TEE target, as ...
- 436k
2
votes
Accepted
Sniff ethernet communication
Yes, there are ways to sniff Ethernet traffic. Pretty much any managed switch, even a little 5-port (~US$40) or 8-port (~US$60) one, will usually have a way to do port mirroring so that any traffic ...
- 103k
2
votes
Open website using IP, not domain
No, when you open url this happens
DNS Resolution - from stackoverflow.com you get ip 151.101.129.69
TCP Connection - your os create connection to this ip and port
Browser - browser then uses the ...
- 419
2
votes
Accepted
How to capture packets at the "DSL side"?
The type of product you're looking for is called a DSL protocol analyzer. Plug that term into your favorite search engine.
There have been many flavors of DSL over the years, so it would probably help ...
- 103k
Only top scored, non community-wiki answers of a minimum length are eligible