Questions tagged [pcap]

For questions about the packet capturing dump file (pcap format) used in a variety of applications like Wireshark, tcpdump and WinPcap. Use this tag when you have questions about a capture from an on topic network device or need help troubleshooting it.

Filter by
Sorted by
Tagged with
3
votes
2answers
180 views

Capturing LACP PDUs in an aggregated link on Juniper MX

We need to capture LACP PDUs on a member link of an aggregated bundle link on Juniper MX connected with other router via DWDM link and save the output in .pcap format using write-file knob. Can ...
26
votes
2answers
32k views

Difference between sniffer tools

I am unsure what the following networking tools do. They all seem to do a similar thing. First some background. I am familiar with cisco IOS. I am doing some linux networking experimentation with ...
4
votes
1answer
3k views

Creating a Network Diagram with .pcap

I have a Wireshark .pcap Capture of around 500k packets and I would like to enumerate a Network Diagram with all the Routers, Switches, PCs etc. Is Wireshark capable of such procedure or is there any ...
1
vote
0answers
19 views

What is the best way to match packets across pcap files from different capture points? [closed]

I have multiple pcap files which contain data from different capture points in the network. Previously I thought that by using the IP-ID field I can match the packets across the capture files but I ...
1
vote
1answer
227 views

What is the difference between tshark, dumpcap and others for collecting/sniffing traffic?

Wireshark provides tshark and dumpcap, and I've also seen people using the wireshark binary or even tcpdump to collect/save network traffic. Online it is claimed that tshark or dumpcap hardly make a ...
0
votes
1answer
29 views

TCP protocol mystery [closed]

I am attempting to compile, with pcap-filter, the following string: host yb-in-f91.1e100.n Obtained from the following command: netstat -t output line: tcp 0 0 os-info:portnum yb-in-f91.1e100.n ...
0
votes
1answer
26 views

What type of attack could this be ? (Wireshark pcap) [closed]

If I understand it correctly the "client" sent an unencrypted password to the pop3 server consisting of a long string of As. Is this a type of attack and if yes, how does it work?
0
votes
0answers
30 views

Wireshark packet read starting from a custom protocol

Pardon the badly-framed question title, I am struggling with it but could not find the best way to frame it. I have a program in which I use libpcap for dumping packets at various points in the ...
0
votes
0answers
18 views

Import Embedded Packet Capture output into Wireshark

I did packet capturing with cisco's Embedded Packet Capture and I would like to view the output in Wireshark. The problem is that I only have CLI access to the device, so exporting via TFTP is not an ...
0
votes
1answer
82 views

How to extract destination MAC from PCAP? [closed]

I have PCAPs collected at the Raspberry Pi (from this paper). I want to extract the following headers: Ether header (3) IP header (12) TCP header (10) UDP header (4) Then convert the PCAP into csv....
1
vote
2answers
395 views

Wireshark expression filters for wireless capture

1) What Wireshark expression filter stack can I utilize to discover how many devices are transmitting in the 2GHz and 5GHz spectrum in a packet capture? 2) What Wireshark expression filter stack can ...
2
votes
1answer
151 views

Capture filter for vlan tagged packets and non vlan tagged packets of specific ethertype

I am trying to capture traffic of ethertype 0x88b8. Some of them may be vlan tagged and some of them might not be, but the and and or operators are not behaving in the way I expect. My first attempt ...
0
votes
1answer
1k views

How to use ICMP to send message

I was trying to send ICMP package with Payload/Message on server_A to server_B(10.1.1.5) as following: ping -p 12345 10.1.1.5. but when I use Tcpdump to capture the ICMP package from server_A, I ...
1
vote
2answers
145 views

tcpreplay packet flooding?

I have limited networking knowledge so bear with me here on this explanation... In my companies datacenter we have some devices that run tcpreplay traffic and usually, there are no issues as the ...
0
votes
2answers
1k views

Problem with downloading pcap capture from Cisco ASA

There is a problem with downloading pcap capture from Cisco ASA 5520 from https://<ip_of_asa>/admin/capture/<capture_name>/pcap - an empty file with size 24 bytes is downloaded while https:...
1
vote
1answer
606 views

Filter pcap file by layer and save to another format [closed]

I captured packets in wireshark, filtered for the protocol I'm interested in (DIS), then exported this to a pcap file. I'd like to do analysis on this data in Python. The only part I'm interested in ...
4
votes
1answer
15k views

Converting PCAP to WAV

How would I go about converting a RTP stream from a pcap file to wav format with a command-line tool such as sox?
1
vote
0answers
111 views

What is an SSL debug file [closed]

What is an SSL debug file in wireshark? I am following the below tutorial and I am stuck at step 4 of this set of Citrix Netscaler instructions
3
votes
1answer
1k views

Network flooded with ICMPv6 Multicast Listener Report Packets

I recently noticed that 3 out of 4 Unifi APs kept reaching 100% CPU usage. When I jumped onto the networks and took a Wireshark capture I noticed 1000s of these packets being sent in just a matter of ...
12
votes
1answer
2k views

Can a router send ARP requests to hosts?

I play with libpcap in C recently to create an arp sniffer program that captures arp requests on the air. I came up with a strange effect. I captured arp requests from my router. I don't know if this ...
3
votes
1answer
5k views

How can I filter out particular MAC addresses when running tshark on a pcap trace?

I've tried a number of things, but none of them seem to do the trick. I want to run this command: tshark -r data.pcap -T fields -e frame.time_epoch -e frame.len but to have it ignore any packets ...
0
votes
1answer
110 views

How to prevent getting other machine traffic in LAN on interface

I capture traffic of VMware machine in LAN (host pc is in LAN) with Wireshark. But I see a lot of garbage traffic like LLMNR, NBNS, STP, ... . I know I cat prevent capturing such traffic by using ...
6
votes
1answer
2k views

Wireshark tcp.len and data.len missmatch

What is the difference between tcp.len and data.len filters? I thought that both mean data size traveling in the segment (not including TCP header). I have a problem related to MTU issue and I'm ...
1
vote
4answers
774 views

Sniffing a Device's Traffic on LAN

There is a device on my network connected via ethernet. Seeing as how hubs are hard to find or ridiculously expensive these days, what hardware can I use if I'm interested in sniffing the traffic to/...
0
votes
1answer
596 views

Where in PCAP-NG does the Source/Destination IP address information reside?

I'm studying the pcapng file format, and I know that when wireshark reads a pcapng file, it tells you all sorts of information. I've been reading the pcap-ng format and I don't see anywhere in pcapng ...
1
vote
1answer
97 views

Wireshark PCAP file clarification

I need your support urgently as I've a problem in the connection between 2 servers. Here's the below when the connection became down, but this is from the other side so I can't identify what is it ? ...
0
votes
4answers
1k views

how to send traffic from one network interface to another network interface through second computer?

I have two computers, each one with two network interfaces, both are ubuntu. I want to implement bellow architecture: I need to generate traffic from interface eth0:192.168.1.1 to interface 192.168.2....
5
votes
2answers
1k views

Circular tcpdump output

I have external hardware that continuously sends UDP data segments over a specified port. I would like to continuously store the last few received packets in a file (could also be time-based). If I ...
2
votes
1answer
497 views

Dell N2000: How to capture PCAP to NVRAM?

I have tried without success to capture to NVRAM on a Dell 2024. Here's what I have tried: enable configure monitor capture file size 512 monitor capture mode file exit monitor capture start <...
3
votes
1answer
309 views

Why the pcap file always shows more bytes downloaded than the actual file size downloaded when using wireshark?

When capturing a dump using wireshark during download of a file and then exploring the total bytes downloaded in pcap is always greater than the actual file downloaded. for example 700000 bytes ...
3
votes
1answer
127 views

Why does a smartphone include its very few past SSID history lists in a probe request?

When cell phone try to connect AP, it sends probe request and it include all past SSID history in it. Strangely enough, when I run a MAC-built-in data packet sniffing program, called Wifi-...
6
votes
2answers
3k views

How do I mcast multiple pcap files simultaneously with guaranteed ordering and controllable speed?

We capture many pcap files every day on many different multicast groups. For the purposes of testing & benchmarking, we wish to replay these files in an isolated environment and in a controlled ...
1
vote
1answer
3k views

What is this UDP 5002 broadcast?

I hope this is an appropriate place to ask this. I'm confused because it's a broadcast at Layer 2 but it's UDP inside a VLAN with a destination to a unicast address (Y.Y.Y.Y). I was just wondering ...