Hot answers tagged

22 votes
Accepted

Can a router send ARP requests to hosts?

ARP is used by a host on a LAN to resolve a layer-3 address to a layer-2 address so that a frame can be built for the LAN. A router is just another host on a LAN, and it will need to resolve layer-3 ...
Ron Maupin's user avatar
  • 99.4k
12 votes
Accepted

What is the difference between tshark, dumpcap and others for collecting/sniffing traffic?

Wireshark is a graphical application. tshark is that application without the GUI. (i.e. command line.) dumpcap, per Wireshark's documentation, is "a small program whose only purpose is to capture ...
Ricky's user avatar
  • 32.1k
6 votes

Capturing LACP PDUs in an aggregated link on Juniper MX

show lacp interfaces <aeX> displays detailed state information for each member-link in a LAG. For example: user@router> show lacp interfaces ae0 extensive LACP state: Role Exp Def ...
Jeff Wheeler's user avatar
  • 5,449
5 votes
Accepted

How to use ICMP to send message

Ping doesn't send user messages. It generates an ICMP Echo Request that the destination is supposed to answer with an ICMP Echo Reply. Echo requests use a dummy payload data encapsulated within the ...
Zac67's user avatar
  • 83.9k
5 votes
Accepted

Network flooded with ICMPv6 Multicast Listener Report Packets

You wouldn't be looking for ARP entries with IPv6, since ARP doesn't exist with IPv6. You would be looking for IPv6 ICMP Neighbor Discovery cache. IPv6 MLD messages are used similarly to IPv4's IGMP ...
HostBits's user avatar
  • 636
4 votes

How can I filter out particular MAC addresses when running tshark on a pcap trace?

You can use not ether host 01:23:45:67:89:ab. To filter only source or destination address use not ether src or not ether dst. Check http://www.tcpdump.org/manpages/pcap-filter.7.html
Zac67's user avatar
  • 83.9k
4 votes

Circular tcpdump output

When you think about it, creating a circular buffer within an on-disk file is pretty complex, and not suited at all to typical disk I/O. The only way to make it even marginally feasible is to find a ...
Jeremy Gibbons's user avatar
4 votes
Accepted

Capture filter for vlan tagged packets and non vlan tagged packets of specific ethertype

You stumbled into the correct filter. If you dig into enough, you'll find the vlan directive changes the packet matching offsets from that point forward in the filter. So you need to have all your non-...
Ricky's user avatar
  • 32.1k
3 votes

Filter pcap file by layer and save to another format

Hi think you should have a look to https://scapy.net/, with not too much programming you can achieve the task of extract the packets and parsing as json, cvs or whatever.
camp0's user avatar
  • 294
3 votes

Problem with downloading pcap capture from Cisco ASA

As a workaround, it looks like you can manually copy the capture via CLI to any of the normal destinations: https://www.cisco.com/c/en/us/td/docs/security/asa/asa82/command/reference/cmd_ref/c4.html#...
boomi's user avatar
  • 993
3 votes

How to extract destination MAC from PCAP?

You don't see the ethernet header because you are not capturing traffic on an Ethernet interface. You are using the Linux cooked-mode capture. As per this answer on StackOverflow, which itself refers ...
JFL's user avatar
  • 19.6k
2 votes

Sniffing a Device's Traffic on LAN

If you are using a switch, i guess the only passive option to sniff the traffic for/from that machine is configuring port mirroring(on a capable switch) on the interface connected to that device. ...
Orlando Gaetano's user avatar
2 votes
Accepted

Where in PCAP-NG does the Source/Destination IP address information reside?

The pcap-ng format just describes the container format which encapsulates the captured packets. It does not describe the content of the captured packet. Thus if you have captured an IP packet you need ...
Steffen Ullrich's user avatar
2 votes
Accepted

How to prevent getting other machine traffic in LAN on interface

Wireshark's capturing engine pcap is designed to capture everything received on an interface. In addition to broadcasts and subscribed multicasts, this includes all link-layer protocols that the ...
Zac67's user avatar
  • 83.9k
2 votes

Capturing LACP PDUs in an aggregated link on Juniper MX

You need to filter for Ethertype 0x8809 frames (for Slow Protocols) with subtype 0x01 (for LACP). You need to run the capture on the physical interfaces, ie. xe. The aggregated, logical ae link doesn'...
Zac67's user avatar
  • 83.9k
2 votes
Accepted

Bittwiste unexpected behaviour when changing MAC address

You are trying to manipulate an Ethernet header, when really you've got an 802.11 frame which is not at all the same. An 802.11 frame doesn't only carry source and destination addresses but also ...
Zac67's user avatar
  • 83.9k
2 votes

Is there a way to precompile data from pcap to speed up booting wireshark?

I found some solutions to my problems. But before that, thank you all for the comments. I found pcapinfo to print a summary of the pcap file. It had the information that I needed (throughput). But my ...
Bruno Lebtag's user avatar
1 vote
Accepted

VoIP SIP PCAP issue

Given the situation described, you are correct that you will not capture a useful amount of SIP traffic since it will not be destined for your laptop (unless you spoof the IP address of the SIP ...
FrameHowitzer's user avatar
1 vote

What is the difference between tshark, dumpcap and others for collecting/sniffing traffic?

What people will use it depends on their knowledge but also on tool availability on the system. Because of graphical user interface I prefer to use wireshark. Also it has a lot of knowledge about ...
Claudiu Cruceanu's user avatar
1 vote
Accepted

TCP protocol mystery

There aren't any special options to libpcap to understand the address because it's very unlikely that it's a valid one. However if you use netstat -tW so that you don't truncate the address in the ...
richardb's user avatar
  • 1,578
1 vote

What type of attack could this be ? (Wireshark pcap)

The attacker attempts to cause a buffer overflow, where the excessively long password is supposed to overflow out of the password buffer into adjacent memory where it's possibly executed as machine ...
Zac67's user avatar
  • 83.9k
1 vote

Wireshark expression filters for wireless capture

for 1 & 2, well, you've got the wrong application for such a job. You can always capture packets with Wireshark. It hooks to an active interface and gives you insight about packets in transit. ...
MTG's user avatar
  • 211
1 vote

Wireshark expression filters for wireless capture

You may be better off with something like airodump-ng specifying a channel and optionally a bssid airodump-ng -w file.pcap --channel 6 --bssid 00:11:22:33:44 wlan0
Bennett's user avatar
  • 11
1 vote
Accepted

tcpreplay packet flooding?

A TCP socket is uniquely identified by the four values (remote IP, local IP, remote port, local port). Right, so use a tool like wireshark to identify the culprit! Best of luck!
Boschko's user avatar
  • 171
1 vote

Wireshark PCAP file clarification

All the packets in your capture are SYN packets. It is the first step of the process of establishing a TCP connection. It seems one one device try to establish a connection with a server, and the ...
JFL's user avatar
  • 19.6k
1 vote
Accepted

Dell N2000: How to capture PCAP to NVRAM?

Trying dir seems to have solved your problem, showing you the real file name.
Ron Maupin's user avatar
  • 99.4k
1 vote

how to send traffic from one network interface to another network interface through second computer?

One possible soloution is network namespaces (basically the linux equivilent of what router vendors call VRFs). Each network namespace is logically a seperate instance of the network stack. so if you ...
Peter Green's user avatar
  • 13.3k
1 vote

how to send traffic from one network interface to another network interface through second computer?

In this configuration the client machine will have directly connected route in its routing table, for both networks. Those route are of kernel type and will always be preferred over other routes you ...
JFL's user avatar
  • 19.6k
1 vote

Sniffing a Device's Traffic on LAN

As you suggested, it sounds like you should mirror the traffic. You can capture traffic specific to the port where that device is connected. You will need a switch with that capability.
Ron Maupin's user avatar
  • 99.4k

Only top scored, non community-wiki answers of a minimum length are eligible