Server Fault Stack Exchange
Server Fault Stack Exchange

Questions tagged [pcap]

PCAP stands for Packet CAPture.

PCAP is a file format containing network-related packet-based data capture. PCAP is also a filetype.

81 questions
1
vote
1 answer

Possible to dump sflow data to pcap format?

I want to get the packet capture from fortiet/fortigate device, to capture all traffic from it on one of its interface. For it i have enabled sflow and sent it to another ntopng server. but on ntopng , i am able to see the sflow data but is there…
Farhan
  • 4,269
  • 11
  • 49
  • 80
1
vote
1 answer

Search all pcap files in a folder and sub-folders for a certain condition

I have a folder (containing many sub-folders) full of pcap files and I'd like to get all pcap files containing packets that match a certain condition, for example "have source IP 1.1.1.1". Do you know any tool that does that kind of search? I need…
Yuri Vladinsky
  • 27
  • 6
1
vote
2 answers

Is it possible to split PCAPS into multiple files bases on simple criteria

Is it possible to split PCAPS into multiple files bases on simple criteria Origional.pcap {split on port 80} which generates the 2 following files all_port_80.pcap everything_else.pcap Or would it be easier to create multiple different tcpdumps…
tkrabec
  • 300
  • 1
  • 8
1
vote
1 answer

How to leave promiscuous mode in dnscap?

How to leave promiscuous mode in dnscap? dnscap -a makes no difference.
mr-euro
  • 848
  • 3
  • 14
  • 31
1
vote
1 answer

email server delivers one message, but not another. no errors

i have sent two messages, one from the local server, one from the production environment. the message from the local server goes through, but the production message does not. both messages are identical in content. logs on server show both messages…
stoodfarback
  • 111
  • 1
1
vote
1 answer

How to split pcap per IRC channels

I wonder if there is a way how to split a pcap that contains (only) IRC per channels. I'm trying to compare accuracy of botnet detection in channels using existing IDS (suricata, snort). The only way how to check which IRC channel was detected seems…
preneond
  • 113
  • 3
1
vote
0 answers

How can I capture traffic for a daemon listening on a cloned loopback IP address?

I have a daemon listening on a virtual IP address attached to a cloned loopback interface (lo1) on FreeBSD 11.x. Inbound traffic for that daemon could arrive on several different physical interfaces, however running tcpdump on loopback only shows…
Alnitak
  • 21,191
  • 3
  • 52
  • 82
0
votes
1 answer

Retrieve data from wireshark (PCAPNG)

I have a PCAPNG file and I need to retrieve two files from it, one is a TXT and the other one is a PNG. The provided file does not have FTP-DATA, it only have ARP, DHCP, DNS, FTP, HTTP, IGMPv3, OCSP, SSDP, TCP, TLSv1.2, TLSv1.3 and UDP packets. This…
Mateo Gutierrez
  • 13
  • 2
0
votes
1 answer

Are TCP RTO value and RTT value influenced by the packet size?

I am doing troubleshooting in my network. I found some re-transmission by using wireshark. The segment 1400 bytes are well transmitted but The segment 800 bytes are lost and re-transmitted. I know RTO value is controlled by RTT and its variance. My…
nimdrak
  • 29
  • 1
  • 7
0
votes
1 answer

Capture packets on loopback

I'm running web service on my windows 10 machine. I decided to look at the packets between my service and client running on the same machine by using Wireshark. I know that it is not possible to get listen to packets on the same machine, but I found…
vico
  • 99
  • 1
  • 2
0
votes
1 answer

Filter pcap by subsecond detail?

I'm trying to export a subset of a pcap file given a start and an end message, this start and end message identification is currently done using ngrep on the raw data(because we have no dissector for the specific protocol) Ideally I would like to…
Kristofer
  • 113
  • 1
  • 7
0
votes
2 answers

Packet fragmentation confusion

I was playing around with dpkt in Python, trying to decode PPPoE - and the program was working just fine, till I noticed that the Offset in the encapsulation IP packets was always 0, even with clearly fragmented packets. As can be seen, the server…
jcoppens
  • 103
  • 1
0
votes
1 answer

ngrep output format clarification

I am trying to debug a connection that has been appearing in my environment from an unknown server. I want to find a PID if it is associated with one. Tried "netstat -anp" but it doesn't find anything. But the connection is sporadic, so I tried…
JDS
  • 2,598
  • 4
  • 30
  • 49
0
votes
1 answer

how can i export sflow data to be saved in pcap on other server in realtime?

I have a pfsense server, all of attacks will come to its WAN interface. i have setup another packet analysis tool on private network behind pfsense. i want to send realtime WAN traffic from pfsense WAN to backend private server, which is listening…
Farhan
  • 4,269
  • 11
  • 49
  • 80
0
votes
0 answers

http timing stats from tcp trace

I am trying to find a tool to extract HTTP timing stats from network traces; namely time to connect, time to first byte, total time to serve.I am talking about very large traces with millions of requests. Ideally I would like to generate Apache…
Azer H
  • 1
  • 2
1 2 3
4
5 6