Questions tagged [pcap]
The Packet Capture library provides a high level interface to packet capture systems.
34
questions
1
vote
1
answer
30
views
Can `tcpdump ether host` filter with a mask to get, for example, hosts with a specific OUI?
I'm trying to filter traffic by src ether host to see all devices with a specific MAC prefix. If this were like IP, it might filter with src ether host aa:bb:cc:00:00:00/24 to see OUI's matching aa:...
- 263
1
vote
1
answer
33
views
GeoIP not working when processing PCAP with tshark as su
I am working with lots of PCAP files and trying to convert them into .tsv files for tabular analysis. So I'm using tshark in a Ubuntu 22 VirtualBox machine to dissect each packet. I have a bash ...
- 113
1
vote
1
answer
122
views
How do I generate a Snort pcap file?
I am new to using snort and still learning in university. I am wondering after I find an intrusion how can I log it and save it as a pcap file? What would the syntax look like to do this? So I can ...
- 21
0
votes
1
answer
90
views
USB device shows nothing in dmesg when connected, disables port
I have an embedded linux USB host which refuses to detect a number of my USB devices. The host is running Ubutun 20.04LTS
Nothing shows up in dmesg during a failed detection and afterward the USB port ...
- 173
0
votes
1
answer
96
views
Error: Invalid output format: IVS and PCAP format cannot be used together
I'm using aircrack-ng to capture a handshake on a WPA2 access point. I would like to write the outfile in pcap format, but I keep getting errors. I've tried reinstalling aircrack-ng using versions ...
- 79
0
votes
0
answers
77
views
Reassembling fragments in PCAP file
We have PCAP files with long and heavily fragmented datagrams. We want to read them in Python but that avenue may not work out due to lack of PCAP reassembly support in feasible libraries. Our ...
- 582
1
vote
1
answer
359
views
How to send pcap file to ethernet
I have a pcap file and need to send it to specific interface.
How can I do it?
- 10.6k
0
votes
2
answers
19
views
extract application name from rawpacket
Sounds dumb, but can you extract application name from a packet/pcap.
For eg: If a packet destination is to chrome process, can you extract that information from packet?
1
vote
1
answer
194
views
TShark pcap filter command possibly simplified?
Object: to find the IP addresses of HTTP servers in a pcap file with a specific header string. Can or should the -l option to flush be used?
One way: the following was done but am wondering if it can ...
- 113
0
votes
0
answers
291
views
tc traffic shaping with HTB and CQB causes packet transmission gap inconsistencies
I am sorry if this is duplicate of https://serverfault.com/q/1076769/822163.
I created that first and then realized the Linux and Unix stack exchange is the right place.
Problem: When the tc HTB or ...
0
votes
0
answers
967
views
Installing the latest version of libpcap & libpcap-dev
In my docker container I run the following command to install the pcap lib: apt-get install -y libpcap-dev
When I run apt list --installed I see this weird output:
libpcap-dev/oldstable,now 1.8.1-6 ...
- 73
1
vote
0
answers
34
views
Turning ethernet on/off
I am porting a DOS application to linux and don't know a hell of a lot about linux. The application is a machine controller which uses ethernet as a high-speed serial port. Networking has nothing to ...
- 11
0
votes
1
answer
233
views
Is tcpdump a client of rpcpad and implemented in pcap?
https://www.tcpdump.org/index.html#documentation has manpages for pcap, tcpdump, and rpcapd, but I don't find what relation is between the three.
Is pcap a C library for implementing a client of ...
- 1
1
vote
1
answer
760
views
How to extract domains related to "Client Hello" in a pcap file
I have a tcpdump (pcap) capture file and want to extract all domains. I do it with the following command:
strings capture_file | grep -oiE '([a-zA-Z0-9][a-zA-Z0-9-]{1,61}\.){1,}(\.?[a-zA-Z]{2,}){1,}' |...
- 851
1
vote
2
answers
159
views
Listen to a folder and modify incoming files on change
I want to convert pcap files to json files using shell script (and tshark). As soon as one or more new pcap files are copied into a folder, the command tshark should be executed and the resulting json ...
- 11
1
vote
1
answer
3k
views
#include pcap.h make fails for hcxtools
I'm running the latest version of Kali on a VirtualBox, and I cannot get hcxtools installed. More specifically, I can not figure out how to get the dependency pcap.h. Running make in /hcxtools ...
- 117
1
vote
1
answer
342
views
Setting 'DF'-bit in IP-header inside pcap file
There is some .pcap-file with fragmented IP traffic. I replay this file with tcpreplay, but also I need to replay it with DF (don't fragment) bit set in some packets.
I supposed that tcprewrite will ...
- 615
8
votes
1
answer
8k
views
Find username and password in pcap file
I am completing an assignment where I am given a pcap file to extract data from. The question is, Find username and password in pcap file. This is what I have so far.
$ tshark -r assign1.pcap -R '...
- 83
1
vote
2
answers
853
views
Increase send buffer/rate of packet injection on a wireless device?
I've written a custom wireless system/driver which works on top of a wifi card with packet injection and is in monitor mode. My program is based upon libpcap and uses pcap_inject to send packets over ...
- 268
1
vote
0
answers
101
views
Reception of Frames with Destination MAC ALL ZERO
We are trying to implement GOOSE message (a multicast message, Generic Object Oriented Substation Event, part of IEC61850 protocol standard) subscription Module. In almost all cases, we are able to ...
- 11
1
vote
1
answer
2k
views
install failing for libpcap: recipe for target pcap-linux.o failed
Just finished installing ubuntu 16.04.1 desktop version. Now I am trying to install libpcap. So far performed the following steps:
Downloaded libpcap-1.8.1.tar.gz
tar -zxvf libpcap-1.8.1.tar.gz
cd ...
- 45
1
vote
1
answer
2k
views
How to split a pcap file based on IP Address on RedHat
On my linux server I have a huge pcap trace file. I need to split this file based on some specific IP Address. How can I do that?
- 113
7
votes
1
answer
6k
views
"tail -f" using "tcpdump -r"
To display content of pcap file , we use :
tcpdump -r /Path/to/syscontection.pcap;
However, this command line does not follow the pcap file on realtime , like tail -f which follows a plain text .
...
- 884
0
votes
1
answer
64
views
how to configure a linux machine to broadcast the incoming traffic
I want to configure a linux machine so that it can broadcast all the traffic received by it to other linux machine (in this case the connected nodes). Can someone help ?
- 1
2
votes
4
answers
12k
views
Why is tcpdump output file empty?
On my Red Hat Enterprise Linux Server release 6.5 when saving a tcpdump capture to a file with the -w option, the resulting file is empty:
[root@plop ~]# tcpdump -n -w tcpdump.cap
listening on eth0, ...
- 921
23
votes
2
answers
30k
views
How to passively capture from Unix domain sockets (AF_UNIX socket monitoring)?
TCP/IP and UDP captures can be made using tcpdump/dumpcap and produces a pcap/pcapng file which can be fed to Wireshark for further analysis. Does a similar tool exist for named Unix domain sockets? (...
- 19.8k
0
votes
2
answers
886
views
sum of all packets in pcap files
I'm trying to make a simple bash script to calculate packets captured in pcap files, I used tcpdump to get packets in each pcap file and add them using a bash script but it doesnt seem to work.
#!/...
- 1,451
2
votes
0
answers
1k
views
Replay pcap on local machine only
RHEL 6.5.
I have a capture of UDP packets, generated this way:
tcpdump -nnXs 0 -i eth1 udp port 26477 and dst 233.86.230.111 -w ITCH.pcap
I've moved this file over to a dev VM, and want to replay ...
- 2,100
4
votes
1
answer
7k
views
Snort PCAP file analysing doesn't write to alert file
I'm using snort in my ubuntu 14.04 virtual machine. This is how I installed snort.
sudo apt-get update
sudo apt-get install snort
I haven't change /etc/snort/snort.conf or rules file. They remain as ...
- 141
1
vote
1
answer
2k
views
How to use tshark or tcpdump to calculate bytes transmitted
I am using this command with tshark:
tshark -r pcapfile "tcp and ip.src==192.168.1.1" -T text -V -x | grep 'Total Length'
This essentially parses the pcap for only connections from the source ip and ...
- 2,675
2
votes
1
answer
1k
views
dsniff is unable to read wireshark pcap file
To try DSNIFF with -p (getting passwords with pcap) option
First i've captured packets of my Open access point with airodump-ng and saved them to a pcap file and dsniff worked easily with no error ...
- 21
1
vote
0
answers
454
views
TCPDump To Capture A Tracepath6 Datagram
I'm trying to use TCPDump to capture an IPv6 datagram using:
tcpdump -c 1 -i eth1 -vvvs0 ip6 and dst host H2.net2 & tracepath6 H2.net2
I'm running this script on H1.net1; R12.net1 is the ...
- 11
1
vote
0
answers
407
views
Break down a pcap file into individual flows and modify them
I have a pcap file and I want to:
separate every flow
separate responses and requests in each flow
modify ip and port in some packets
reply packets
Is there any utility in linux that helps me for do ...
- 41
1
vote
0
answers
163
views
How do I mcast multiple pcap files simultaneously with guaranteed ordering and controllable speed?
We capture many pcap files every day on many different multicast groups. For the purposes of testing & benchmarking, we wish to replay these files in an isolated environment and in a controlled ...
- 2,100