Questions tagged [pcap]

The Packet Capture library provides a high level interface to packet capture systems.

Filter by
Sorted by
Tagged with
0
votes
0answers
21 views

How to use TCPREPLAY to decrypt a PCAPNG file?

I have a pcapng (wireshark) file encrypted with cryptcat. I also have the password. Just not sure how to decipher the packet. The following pcapng: Source IP - 172.16.0.37 Port Source - 40986 ...
0
votes
0answers
96 views

Streaming video file to capture it as RTP pcap? (gstreamer/wireshark)

I have the following task that I am not sure how to approach, any help would be appreciated. I need to generate network traffic data in the following way: Take a video file, say MPEG4, stream it using ...
0
votes
0answers
79 views

How do I force kismet wireless to rotate pcap log file?

I want to make Kismet Wireless rotate the pcap log files every X packets, since the file will grow very large if Kismet is left running for a while. I've found the -m option, but it doesn't work. I ...
1
vote
2answers
78 views

Listen to a folder and modify incoming files on change

I want to convert pcap files to json files using shell script (and tshark). As soon as one or more new pcap files are copied into a folder, the command tshark should be executed and the resulting json ...
1
vote
1answer
1k views

#include pcap.h make fails for hcxtools

I'm running the latest version of Kali on a VirtualBox, and I cannot get hcxtools installed. More specifically, I can not figure out how to get the dependency pcap.h. Running make in /hcxtools ...
1
vote
1answer
110 views

Setting 'DF'-bit in IP-header inside pcap file

There is some .pcap-file with fragmented IP traffic. I replay this file with tcpreplay, but also I need to replay it with DF (don't fragment) bit set in some packets. I supposed that tcprewrite will ...
7
votes
1answer
4k views

Find username and password in pcap file

I am completing an assignment where I am given a pcap file to extract data from. The question is, Find username and password in pcap file. This is what I have so far. $ tshark -r assign1.pcap -R '...
1
vote
2answers
430 views

Increase send buffer/rate of packet injection on a wireless device?

I've written a custom wireless system/driver which works on top of a wifi card with packet injection and is in monitor mode. My program is based upon libpcap and uses pcap_inject to send packets over ...
1
vote
0answers
88 views

Reception of Frames with Destination MAC ALL ZERO

We are trying to implement GOOSE message (a multicast message, Generic Object Oriented Substation Event, part of IEC61850 protocol standard) subscription Module. In almost all cases, we are able to ...
1
vote
1answer
1k views

install failing for libpcap: recipe for target pcap-linux.o failed

Just finished installing ubuntu 16.04.1 desktop version. Now I am trying to install libpcap. So far performed the following steps: Downloaded libpcap-1.8.1.tar.gz tar -zxvf libpcap-1.8.1.tar.gz cd ...
1
vote
1answer
1k views

How to split a pcap file based on IP Address on RedHat

On my linux server I have a huge pcap trace file. I need to split this file based on some specific IP Address. How can I do that?
4
votes
1answer
4k views

“tail -f” using “tcpdump -r”

To display content of pcap file , we use : tcpdump -r /Path/to/syscontection.pcap; However, this command line does not follow the pcap file on realtime , like tail -f which follows a plain text . ...
0
votes
1answer
59 views

how to configure a linux machine to broadcast the incoming traffic

I want to configure a linux machine so that it can broadcast all the traffic received by it to other linux machine (in this case the connected nodes). Can someone help ?
2
votes
4answers
7k views

Why is tcpdump output file empty?

On my Red Hat Enterprise Linux Server release 6.5 when saving a tcpdump capture to a file with the -w option, the resulting file is empty: [root@plop ~]# tcpdump -n -w tcpdump.cap listening on eth0, ...
14
votes
2answers
18k views

How to passively capture from Unix domain sockets (AF_UNIX socket monitoring)?

TCP/IP and UDP captures can be made using tcpdump/dumpcap and produces a pcap/pcapng file which can be fed to Wireshark for further analysis. Does a similar tool exist for named Unix domain sockets? (...
0
votes
2answers
748 views

sum of all packets in pcap files

I'm trying to make a simple bash script to calculate packets captured in pcap files, I used tcpdump to get packets in each pcap file and add them using a bash script but it doesnt seem to work. #!/...
2
votes
0answers
931 views

Replay pcap on local machine only

RHEL 6.5. I have a capture of UDP packets, generated this way: tcpdump -nnXs 0 -i eth1 udp port 26477 and dst 233.86.230.111 -w ITCH.pcap I've moved this file over to a dev VM, and want to replay ...
4
votes
1answer
4k views

Snort PCAP file analysing doesn't write to alert file

I'm using snort in my ubuntu 14.04 virtual machine. This is how I installed snort. sudo apt-get update sudo apt-get install snort I haven't change /etc/snort/snort.conf or rules file. They remain as ...
1
vote
1answer
1k views

How to use tshark or tcpdump to calculate bytes transmitted

I am using this command with tshark: tshark -r pcapfile "tcp and ip.src==192.168.1.1" -T text -V -x | grep 'Total Length' This essentially parses the pcap for only connections from the source ip and ...
2
votes
1answer
1k views

dsniff is unable to read wireshark pcap file

To try DSNIFF with -p (getting passwords with pcap) option First i've captured packets of my Open access point with airodump-ng and saved them to a pcap file and dsniff worked easily with no error ...
1
vote
0answers
437 views

TCPDump To Capture A Tracepath6 Datagram

I'm trying to use TCPDump to capture an IPv6 datagram using: tcpdump -c 1 -i eth1 -vvvs0 ip6 and dst host H2.net2 & tracepath6 H2.net2 I'm running this script on H1.net1; R12.net1 is the ...
1
vote
0answers
378 views

Break down a pcap file into individual flows and modify them

I have a pcap file and I want to: separate every flow separate responses and requests in each flow modify ip and port in some packets reply packets Is there any utility in linux that helps me for do ...
1
vote
0answers
150 views

How do I mcast multiple pcap files simultaneously with guaranteed ordering and controllable speed?

We capture many pcap files every day on many different multicast groups. For the purposes of testing & benchmarking, we wish to replay these files in an isolated environment and in a controlled ...