Questions tagged [pcap]
For questions about the packet capturing dump file (pcap format) used in a variety of applications like Wireshark, tcpdump and WinPcap. Use this tag when you have questions about a capture from an on topic network device or need help troubleshooting it.
37
questions
0
votes
0
answers
29
views
TCP blocked until the acknowledgment received
I am currently facing an issue in my application where the TCP messages seem to be blocked until an acknowledgment received. Specifically, the subsequent messages wait for the acknowledgment of the ...
0
votes
0
answers
18
views
RPCAP active mode usage or deployment example
This is in reference to https://www.winpcap.org/docs/docs_40_2/html/group__remote.html, the RPCAP protocol. Wireshark (on Windows) has support for connecting to passive mode deployment. And the RPCAP ...
- 101
0
votes
1
answer
51
views
Bittwiste unexpected behaviour when changing MAC address
bittwiste version 2.0 libpcap version 1.9.1 on Catalina vía Homebrew
I have a pcap file foo.pcap with conversation between MAC addresses a2:f6:51:d0:0e:13 and ac:93:c4:be:6b:8c
I run:
bittwiste -I ...
- 103
2
votes
1
answer
82
views
Is there a way to precompile data from pcap to speed up booting wireshark?
Is there a way to precompile/precalculate the data from a pcap file to speed up booting wireshark?
I have a big pcap file and wireshark is crashing when I try to open it.
I know it sums and computes a ...
- 141
4
votes
2
answers
1k
views
Capturing LACP PDUs in an aggregated link on Juniper MX
We need to capture LACP PDUs on a member link of an aggregated bundle link on Juniper MX connected with other router via DWDM link and save the output in .pcap format using write-file knob.
Can ...
- 1,110
1
vote
0
answers
179
views
What is the best way to match packets across pcap files from different capture points? [closed]
I have multiple pcap files which contain data from different capture points in the network.
Previously I thought that by using the IP-ID field I can match the packets across the capture files but I ...
- 226
5
votes
2
answers
6k
views
What is the difference between tshark, dumpcap and others for collecting/sniffing traffic?
Wireshark provides tshark and dumpcap, and I've also seen people using the wireshark binary or even tcpdump to collect/save network traffic.
Online it is claimed that tshark or dumpcap hardly make a ...
- 153
0
votes
1
answer
48
views
TCP protocol mystery [closed]
I am attempting to compile, with pcap-filter, the following string:
host yb-in-f91.1e100.n
Obtained from the following command:
netstat -t
output line: tcp 0 0 os-info:portnum yb-in-f91.1e100.n
...
- 103
0
votes
1
answer
565
views
What type of attack could this be ? (Wireshark pcap) [closed]
If I understand it correctly the "client" sent an unencrypted password to the pop3 server consisting of a long string of As. Is this a type of attack and if yes, how does it work?
- 1
0
votes
0
answers
122
views
Wireshark packet read starting from a custom protocol
Pardon the badly-framed question title, I am struggling with it but could not find the best way to frame it. I have a program in which I use libpcap for dumping packets at various points in the ...
0
votes
0
answers
48
views
Import Embedded Packet Capture output into Wireshark
I did packet capturing with cisco's Embedded Packet Capture and I would like to view the output in Wireshark.
The problem is that I only have CLI access to the device, so exporting via TFTP is not an ...
- 383
0
votes
1
answer
824
views
How to extract destination MAC from PCAP? [closed]
I have PCAPs collected at the Raspberry Pi (from this paper). I want to extract the following headers:
Ether header (3)
IP header (12)
TCP header (10)
UDP header (4)
Then convert the PCAP into csv....
2
votes
1
answer
342
views
Capture filter for vlan tagged packets and non vlan tagged packets of specific ethertype
I am trying to capture traffic of ethertype 0x88b8. Some of them may be vlan tagged and some of them might not be, but the and and or operators are not behaving in the way I expect.
My first attempt ...
- 123
1
vote
1
answer
3k
views
How to use ICMP to send message
I was trying to send ICMP package with Payload/Message on server_A to server_B(10.1.1.5) as following:
ping -p 12345 10.1.1.5.
but when I use Tcpdump to capture the ICMP package from server_A, I ...
- 317
1
vote
1
answer
798
views
Filter pcap file by layer and save to another format [closed]
I captured packets in wireshark, filtered for the protocol I'm interested in (DIS), then exported this to a pcap file. I'd like to do analysis on this data in Python. The only part I'm interested in ...
- 111
0
votes
2
answers
3k
views
Problem with downloading pcap capture from Cisco ASA
There is a problem with downloading pcap capture from Cisco ASA 5520 from https://<ip_of_asa>/admin/capture/<capture_name>/pcap - an empty file with size 24 bytes is downloaded while https:...
- 101
1
vote
0
answers
121
views
What is an SSL debug file [closed]
What is an SSL debug file in wireshark? I am following the below tutorial and I am stuck at step 4 of this set of Citrix Netscaler instructions
- 11
1
vote
2
answers
645
views
Wireshark expression filters for wireless capture
1) What Wireshark expression filter stack can I utilize to discover how many devices are transmitting in the 2GHz and 5GHz spectrum in a packet capture?
2) What Wireshark expression filter stack can ...
1
vote
2
answers
199
views
tcpreplay packet flooding?
I have limited networking knowledge so bear with me here on this explanation...
In my companies datacenter we have some devices that run tcpreplay traffic and usually, there are no issues as the ...
3
votes
1
answer
3k
views
Network flooded with ICMPv6 Multicast Listener Report Packets
I recently noticed that 3 out of 4 Unifi APs kept reaching 100% CPU usage. When I jumped onto the networks and took a Wireshark capture I noticed 1000s of these packets being sent in just a matter of ...
- 133
0
votes
1
answer
117
views
How to prevent getting other machine traffic in LAN on interface
I capture traffic of VMware machine in LAN (host pc is in LAN) with Wireshark.
But I see a lot of garbage traffic like LLMNR, NBNS, STP, ... .
I know I cat prevent capturing such traffic by using ...
3
votes
1
answer
8k
views
How can I filter out particular MAC addresses when running tshark on a pcap trace?
I've tried a number of things, but none of them seem to do the trick. I want to run this command:
tshark -r data.pcap -T fields -e frame.time_epoch -e frame.len
but to have it ignore any packets ...
- 163
0
votes
1
answer
1k
views
Where in PCAP-NG does the Source/Destination IP address information reside?
I'm studying the pcapng file format, and I know that when wireshark reads a pcapng file, it tells you all sorts of information. I've been reading the pcap-ng format and I don't see anywhere in pcapng ...
- 103
1
vote
1
answer
102
views
Wireshark PCAP file clarification
I need your support urgently as I've a problem in the connection between 2 servers.
Here's the below when the connection became down, but this is from the other side so I can't identify what is it ?
...
- 19
13
votes
1
answer
2k
views
Can a router send ARP requests to hosts?
I play with libpcap in C recently to create an arp sniffer program that captures arp requests on the air. I came up with a strange effect. I captured arp requests from my router. I don't know if this ...
user33076
2
votes
1
answer
591
views
Dell N2000: How to capture PCAP to NVRAM?
I have tried without success to capture to NVRAM on a Dell 2024. Here's what I have tried:
enable
configure
monitor capture file size 512
monitor capture mode file
exit
monitor capture start
<...
- 175
0
votes
4
answers
2k
views
how to send traffic from one network interface to another network interface through second computer?
I have two computers, each one with two network interfaces, both are ubuntu.
I want to implement bellow architecture:
I need to generate traffic from interface eth0:192.168.1.1 to interface 192.168.2....
- 13
1
vote
4
answers
971
views
Sniffing a Device's Traffic on LAN
There is a device on my network connected via ethernet. Seeing as how hubs are hard to find or ridiculously expensive these days, what hardware can I use if I'm interested in sniffing the traffic to/...
- 963
3
votes
1
answer
580
views
Why the pcap file always shows more bytes downloaded than the actual file size downloaded when using wireshark?
When capturing a dump using wireshark during download of a file and then exploring the total bytes downloaded in pcap is always greater than the actual file downloaded.
for example
700000 bytes ...
- 33
5
votes
2
answers
2k
views
Circular tcpdump output
I have external hardware that continuously sends UDP data segments over a specified port. I would like to continuously store the last few received packets in a file (could also be time-based).
If I ...
- 151
3
votes
1
answer
141
views
Why does a smartphone include its very few past SSID history lists in a probe request?
When cell phone try to connect AP, it sends probe request and it include all past SSID history in it. Strangely enough, when I run a MAC-built-in data packet sniffing program, called Wifi-...
- 133
4
votes
1
answer
4k
views
Creating a Network Diagram with .pcap
I have a Wireshark .pcap Capture of around 500k packets and I would like to enumerate a Network Diagram with all the Routers, Switches, PCs etc.
Is Wireshark capable of such procedure or is there any ...
- 143
5
votes
2
answers
20k
views
Converting PCAP to WAV [closed]
How would I go about converting a RTP stream from a pcap file to wav format with a command-line tool such as sox?
- 963
27
votes
2
answers
34k
views
Difference between sniffer tools
I am unsure what the following networking tools do. They all seem to do a similar thing.
First some background. I am familiar with cisco IOS. I am doing some linux networking experimentation with ...
- 373
6
votes
2
answers
4k
views
How do I mcast multiple pcap files simultaneously with guaranteed ordering and controllable speed?
We capture many pcap files every day on many different multicast groups. For the purposes of testing & benchmarking, we wish to replay these files in an isolated environment and in a controlled ...
- 163
6
votes
1
answer
3k
views
Wireshark tcp.len and data.len missmatch
What is the difference between tcp.len and data.len filters? I thought that both mean data size traveling in the segment (not including TCP header). I have a problem related to MTU issue and I'm ...
- 238
1
vote
1
answer
3k
views
What is this UDP 5002 broadcast?
I hope this is an appropriate place to ask this.
I'm confused because it's a broadcast at Layer 2 but it's UDP inside a VLAN with a destination to a unicast address (Y.Y.Y.Y).
I was just wondering ...
- 153