Server Fault Stack Exchange
Server Fault Stack Exchange

Questions tagged [sniffing]

31 questions
1
vote
2 answers

Thomson TG585v7 router - promiscuous mode

I have a TG585v7 as a router with several machines plugged into it. In the default setup, the packets are only delivered to the specific machine but I want to be able to setup to monitor all network traffic on one of the machines, i.e. I need those…
0x4B1D
  • 141
  • 7
1
vote
2 answers

Can't decrypt imaps traffic in Wireshark

I have currently problems to decrypt IMAPS Traffic in Wireshark. I set up the SSL Key with the correct IP Address, Port 993 and Protocol imap. The Key is the correct one. That is what I see in the SSL log: dissect_ssl enter frame #136 (already…
reox
  • 165
  • 2
  • 10
1
vote
1 answer

Is it possible to capture traffic to the remote web server

I noticed that my user name and password is sent bare text to the remote server inside HTTP POST request. This is a sniffed packed from Wireshark POST /***URL*** HTTP/1.1 Host: ***DNS NAME*** Content-Length:…
oleksii
  • 266
  • 1
  • 3
  • 11
1
vote
0 answers

Sniffing packets over a wifi network, with or without monitor mode using wireshark

So, I am actually confused, there are some guides that say you can't just capture traffic on wireless LAN with promiscuous mode and you need to setup monitor mode, also enter the wifi password to be able to decrypt the data. But then there are some…
Hormoz
  • 111
  • 1
1
vote
0 answers

What's the meaning of this binary sequence arriving at my http server?

I'm running a http server written in Rebol and sometimes I see that the server is woken by data like this arriving at port 80 0300002F2AE00000000000436F6F6B69653A206D737473686173683D41646D696E697374720D0A0100080003000000 In the logs I see that over…
Graham Chiu
  • 111
  • 5
0
votes
2 answers

Is it possible to sniff packets of other users on connected over LAN in a workspace or college lab?

I am asking this (for educational purposes) to be alert if this kind of thing happens to me.
Saurav
  • 101
0
votes
0 answers

Error 10061: No connection could be made because the target machine actively refused it

I have recently installed a (cross platform) client server application consisting of a web server backend and a thick (dumb) desktop client. I have been able to connect to the server and run the Ubuntu desktop client successfully, however, when a…
Homunculus Reticulli
  • 133
  • 2
  • 10
0
votes
0 answers

In the output of Chaosreader, where are the source and destination port numbers and IP addresses for each packet?

I used this tutorial to use Chaosreader on an output file of WinDump. My purpose was to get the HTTP payload, which I got. But I'd also like to extract other information, like source IP and destination IP, source port and destination port, for each…
Jesss
  • 23
  • 1
  • 4
0
votes
1 answer

How to perform Wiresharks File->Extract Objects->HTTP through Tshark commandline interface?

Using TShark, I want to be able to extract the payload in HTTP response from packets data captured through tshark in a .pcap file. In the Wireshark GUI, I was able to do that by File > Extract Objects > HTTP, and then choosing a file from the HTTP…
Jesss
  • 23
  • 1
  • 4
0
votes
1 answer

How to trigger DHCP request and inspect the reply from DHCP server

Is it possible to trigger a DHCP request from my DHCP server and then sniff and inspect the whole DHCP reply from the server to see what options/parameters it sends to the clients?
tox
  • 3
  • 1
  • 2
0
votes
1 answer

Outgoing IP Packet Capture and Logging with iptables

My goal is to use ipset lists in iptables to log outbound traffic to certain IP addresses. I intend to monitor an entire network passively. I have port mirroring enabled and the port mirrored traffic is broadcasting to a server with two network…
Trevor
  • 1
  • 1
  • 1
0
votes
1 answer

Log http data in unique files using tcpick

I'm trying to use tcpick to log http data in unique files (client and server mixed together). This is one of the examples from tcpick's man page: $ tcpick -i eth0 "port 80" -wRub I expected this to write the tcp stream to a file named…
otto.poellath
  • 545
  • 1
  • 5
  • 9
0
votes
2 answers

Problem with WireShark (MySQL sniffing)

How can I snif MySQL data using WireShark? Also I used «mysqlsniffer» and have no results. There are no any packets from MySQL. I've filtered by «MySQL.isPresent» in WireShark but nothing happened. MySQL installed on Ubuntu 10.10 from…
Clark
  • 347
  • 2
  • 5
  • 13
-1
votes
1 answer

Suspicious redirection to russian pages. Is government spying us?

Recently when I browse some multi-language websites, the default language becomes Russian. An example is www.amd.com which redirects me to http://www.amd.com/ru/Pages/AMDHomePage.aspx I am sure I don't specified any change to my browser/computer…
Isaac
  • 581
  • 2
  • 12
  • 25
-3
votes
1 answer

Why can't I "decode" packets using Wireshark and some wireless network?

Re, I have no problem capturing packets on various wireless hotspots but there are a couple in my town that I just cannot understand why packets aren't being captured, other than those of my own. These are "open" networks (i.e., no WEP/WPA/etc.…
MarkieL
  • 1
  • 1
  • 1
1
2
3