Stack Exchange Network

Stack Exchange network consists of 175 Q&A communities including Stack Overflow, the largest, most trusted online community for developers to learn, share their knowledge, and build their careers.

Visit Stack Exchange

Questions tagged [pcap]

For questions about the packet capturing dump file (pcap format) used in a variety of applications like Wireshark, tcpdump and WinPcap. Use this tag when you have questions about a capture from an on topic network device or need help troubleshooting it.

2
votes
1answer
21 views

Capture filter for vlan tagged packets and non vlan tagged packets of specific ethertype

I am trying to capture traffic of ethertype 0x88b8. Some of them may be vlan tagged and some of them might not be, but the and and or operators are not behaving in the way I expect. My first attempt ...
0
votes
1answer
73 views

How to use ICMP to send message

I was trying to send ICMP package with Payload/Message on server_A to server_B(10.1.1.5) as following: ping -p 12345 10.1.1.5. but when I use Tcpdump to capture the ICMP package from server_A, I ...
1
vote
1answer
322 views

Filter pcap file by layer and save to another format [closed]

I captured packets in wireshark, filtered for the protocol I'm interested in (DIS), then exported this to a pcap file. I'd like to do analysis on this data in Python. The only part I'm interested in ...
0
votes
2answers
263 views

Problem with downloading pcap capture from Cisco ASA

There is a problem with downloading pcap capture from Cisco ASA 5520 from https://<ip_of_asa>/admin/capture/<capture_name>/pcap - an empty file with size 24 bytes is downloaded while https:...
1
vote
0answers
68 views

What is an SSL debug file

What is an SSL debug file in wireshark? I am following the below tutorial and I am stuck at step 4 of this set of Citrix Netscaler instructions
1
vote
2answers
186 views

Wireshark expression filters for wireless capture

1) What Wireshark expression filter stack can I utilize to discover how many devices are transmitting in the 2GHz and 5GHz spectrum in a packet capture? 2) What Wireshark expression filter stack can ...
1
vote
2answers
75 views

tcpreplay packet flooding?

I have limited networking knowledge so bear with me here on this explanation... In my companies datacenter we have some devices that run tcpreplay traffic and usually, there are no issues as the ...
3
votes
1answer
646 views

Network flooded with ICMPv6 Multicast Listener Report Packets

I recently noticed that 3 out of 4 Unifi APs kept reaching 100% CPU usage. When I jumped onto the networks and took a Wireshark capture I noticed 1000s of these packets being sent in just a matter of ...
0
votes
1answer
88 views

How to prevent getting other machine traffic in LAN on interface

I capture traffic of VMware machine in LAN (host pc is in LAN) with Wireshark. But I see a lot of garbage traffic like LLMNR, NBNS, STP, ... . I know I cat prevent capturing such traffic by using ...
3
votes
1answer
2k views

How can I filter out particular MAC addresses when running tshark on a pcap trace?

I've tried a number of things, but none of them seem to do the trick. I want to run this command: tshark -r data.pcap -T fields -e frame.time_epoch -e frame.len but to have it ignore any packets ...
0
votes
1answer
415 views

Where in PCAP-NG does the Source/Destination IP address information reside?

I'm studying the pcapng file format, and I know that when wireshark reads a pcapng file, it tells you all sorts of information. I've been reading the pcap-ng format and I don't see anywhere in pcapng ...
1
vote
1answer
90 views

Wireshark PCAP file clarification

I need your support urgently as I've a problem in the connection between 2 servers. Here's the below when the connection became down, but this is from the other side so I can't identify what is it ? ...
13
votes
1answer
2k views

Can a router send ARP requests to hosts?

I play with libpcap in C recently to create an arp sniffer program that captures arp requests on the air. I came up with a strange effect. I captured arp requests from my router. I don't know if this ...
2
votes
1answer
284 views

Dell N2000: How to capture PCAP to NVRAM?

I have tried without success to capture to NVRAM on a Dell 2024. Here's what I have tried: enable configure monitor capture file size 512 monitor capture mode file exit monitor capture start <...
0
votes
4answers
874 views

how to send traffic from one network interface to another network interface through second computer?

I have two computers, each one with two network interfaces, both are ubuntu. I want to implement bellow architecture: I need to generate traffic from interface eth0:192.168.1.1 to interface 192.168.2....
1
vote
4answers
679 views

Sniffing a Device's Traffic on LAN

There is a device on my network connected via ethernet. Seeing as how hubs are hard to find or ridiculously expensive these days, what hardware can I use if I'm interested in sniffing the traffic to/...
2
votes
1answer
218 views

Why the pcap file always shows more bytes downloaded than the actual file size downloaded when using wireshark?

When capturing a dump using wireshark during download of a file and then exploring the total bytes downloaded in pcap is always greater than the actual file downloaded. for example 700000 bytes ...
4
votes
2answers
964 views

Circular tcpdump output

I have external hardware that continuously sends UDP data segments over a specified port. I would like to continuously store the last few received packets in a file (could also be time-based). If I ...
3
votes
1answer
106 views

Why does a smartphone include its very few past SSID history lists in a probe request?

When cell phone try to connect AP, it sends probe request and it include all past SSID history in it. Strangely enough, when I run a MAC-built-in data packet sniffing program, called Wifi-...
3
votes
1answer
2k views

Creating a Network Diagram with .pcap

I have a Wireshark .pcap Capture of around 500k packets and I would like to enumerate a Network Diagram with all the Routers, Switches, PCs etc. Is Wireshark capable of such procedure or is there any ...
3
votes
1answer
10k views

Converting PCAP to WAV

How would I go about converting a RTP stream from a pcap file to wav format with a command-line tool such as sox?
23
votes
2answers
28k views

Difference between sniffer tools

I am unsure what the following networking tools do. They all seem to do a similar thing. First some background. I am familiar with cisco IOS. I am doing some linux networking experimentation with ...
6
votes
2answers
2k views

How do I mcast multiple pcap files simultaneously with guaranteed ordering and controllable speed?

We capture many pcap files every day on many different multicast groups. For the purposes of testing & benchmarking, we wish to replay these files in an isolated environment and in a controlled ...
5
votes
1answer
1k views

Wireshark tcp.len and data.len missmatch

What is the difference between tcp.len and data.len filters? I thought that both mean data size traveling in the segment (not including TCP header). I have a problem related to MTU issue and I'm ...
1
vote
1answer
3k views

What is this UDP 5002 broadcast?

I hope this is an appropriate place to ask this. I'm confused because it's a broadcast at Layer 2 but it's UDP inside a VLAN with a destination to a unicast address (Y.Y.Y.Y). I was just wondering ...