1

I have a packet sniffer that mean i can read all packets sent or received to the computer(with all headers like src & dst IP:PORT).

I want to filter packets that sent/received to/from internet (only remote hosts that doesn't exist in my network).

is there a solution for this?


P.S: i exclude packets that src or dst is in local range like "10.0.0.0/8" or "192.168.0.0/16" and other local ranges. Then result is better but not exact and i need more accurate result.

  • You have cross-posted this question on multiple SE sites. You need to pick one site and delete the question on the others. – Ron Maupin Dec 10 '17 at 17:54
0

IANA maintains the IANA IPv4 Special-Purpose Address Registry and IANA IPv6 Special-Purpose Address Registry pages. You can filter any ranges marked as False under Globally Reachable, plus the multicast ranges (224.0.0.0/4 for IPv4 and ff00::/8 for IPv6). Anything else is a valid, public IP address that can be used on the public Internet.

0

You need to exclude packets where the source and the destination address are in the local range.

0

The packets for internal (local) network are transmitted to the local hosts directly. The packets from/to internet are always passed through the router. So if you make a filter getting packet from/to the router, you can get the packets from/to the internet.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.