1

I have a packet sniffer that mean i can read all packets sent or received to the computer(with all headers like src & dst IP:PORT).

I want to filter packets that sent/received to/from internet (only remote hosts that doesn't exist in my network).

is there a solution for this?

P.S: i exclude packets that src or dst is in local range like "10.0.0.0/8" or "192.168.0.0/16" and other local ranges. Then result is better but not exact and i need more accurate result.

Improve this question
1
  • You have cross-posted this question on multiple SE sites. You need to pick one site and delete the question on the others.
    – Ron Maupin ♦
    Commented Dec 10, 2017 at 17:54

3 Answers 3

Reset to default
0

IANA maintains the IANA IPv4 Special-Purpose Address Registry and IANA IPv6 Special-Purpose Address Registry pages. You can filter any ranges marked as False under Globally Reachable, plus the multicast ranges (224.0.0.0/4 for IPv4 and ff00::/8 for IPv6). Anything else is a valid, public IP address that can be used on the public Internet.

Improve this answer
0

You need to exclude packets where the source and the destination address are in the local range.

Improve this answer
0

The packets for internal (local) network are transmitted to the local hosts directly. The packets from/to internet are always passed through the router. So if you make a filter getting packet from/to the router, you can get the packets from/to the internet.

Improve this answer

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.