Stack Overflow
Stack Overflow

Questions tagged [packet-capture]

is for questions about capturing packets of various protocols that are transmitted over a network.

A lot of computer network protocols transmit their contents in packets. Packet capture is the interception of these packets as they are moved over a network of some type.

A packet sniffer captures raw data traveling over a network segment and saves it to a file for analysis.

Software

A software sniffer can generally only capture network data either originating from or going to the computer running it, plus any "broadcast" messages, if the computer is connected to the network via a switch. If the computer is connected to the network via a router, it may be able to capture network data for any device on connected to the same router.

Hardware

A hardware packet sniffer is physically connected to the network by connecting it to a router or switch. Sometimes the router or switch has to be configured to allow the sniffer to capture traffic being routed through it; this is called port mirroring.

Analysis

The captured data can be analyzed by the software that captured it, or by a program specifically designed to analyze the network data.

See Also

  • Wikipedia Article on Packet Analyzers
  • The term packet sniffer is also common and can be considered a synonym.
659 questions
2
votes
1 answer

Read pcapng file and get the headers in json format

I have a wireshark packet capture (.pcapng) and the file has to be read to memory of a python programme. It is desired to convert the packets to the JSON format like so: $ tshark -r cap.pcapng -T json > ip.json I need the write the json data back…
Rumesh Madhusanka
  • 1,105
  • 3
  • 12
  • 26
2
votes
2 answers

Capturing packets on Windows 7

I am trying to capture all of transferred packets on a computer. My code works fine in Windows XP but it only captures outgoing packets on Windows 7 and cannot see incoming packets. Here is a version of the code which just calculate the size of…
Isaac
  • 2,332
  • 6
  • 33
  • 59
2
votes
3 answers

I want to stop packet capture while sniffing continuously once a condition is met

Problem I have written a script that sniffs packet from a host, however, I am sniffing the packets in continuous mode and would like to stop sniffing on a timeout. I have written the following code to stop packet sniffing, but it doesn't seem to…
Sajan Maharjan
  • 118
  • 1
  • 10
2
votes
5 answers

How does jQuery Ajax know which reponse data goes with which success callback?

I have a web page with several jQuery ajax calls which fire asynchronously at the same time against .NET web methods. These web methods return data back to be processed by the success callbacks for each .ajax call. My question is probably low level.…
Tony_Henrich
  • 42,411
  • 75
  • 239
  • 374
2
votes
1 answer

How does work capturing packets (NPF; WinPcap)?

I read about how WinPcap filters packets here and examined ndis/filter project from GitHub (Microsoft/Windows-driver-samples). I provide the main figures from WinPcap page bellow because they are related to the question. My main question: if NPF…
slinkin
  • 375
  • 3
  • 15
2
votes
1 answer

Do not use proxy on android 9 pie

I just upgraded my Samsung Note 8 phone to Android OS 9.0 When I go to advanced wifi settings, I choose to use Proxy mode manually. Host: 192.168.1.8 Port: 8888 On the computer I turned on the Fiddler software to catch the packets. However, I could…
mincasoft
  • 311
  • 3
  • 10
2
votes
1 answer

Java "symbol lookup error" for JLI_InitArgProcessing when running with setcap capabilities

We installed Java 11 on a server that is meant to monitor a network interface for traffic. After the initial installation (yum install java-11-openjdk-devel.x86_64) the java command works properly for both root and a regular user. However, our Java…
Craig Otis
  • 31,257
  • 32
  • 136
  • 234
2
votes
0 answers

Tcpdump ctrl-c sigint in android terminal emulator is not working

I run tcpdump on my android phone using "Terminal Emulator app". My phone is rooted. I run tcpdump to sniff my wlan0 interface by #tcpdump -i wlan0 I have problem with how to end the tcpdump sniffing process. I already searched the answer, but none…
saesaria
  • 46
  • 6
2
votes
1 answer

proper tools for pcap file analysis in ELK stack?

I'm sure this is a softball for those who are familiar with the Elastic Stack, but the docs I've read havent left it super clear. I essentially am trying to push pcap files through the ELK stack to visualize packet information using Kibana. I am…
75inchpianist
  • 4,112
  • 1
  • 21
  • 39
2
votes
0 answers

Decoding socket.io based websocket payload

I have a socket.io server and during testing I captured all live traffic with wireshark. The server switched protocol to WebSocket and I have been getting this sort of packets (this is at the websocket layer): WebSocket 1... .... = Fin: True …
Haoxi Tan
  • 21
  • 2
2
votes
1 answer

appending int8_t array into larger int8_t array

I'm reading in pieces of a jpg captured from a udp stream and I have the following: #define BUF_SIZ 1066 int main(int argc, char *argv[]) { int ptr; uint8_t buf[BUF_SIZ]; uint8_t jpg[BUF_SIZ * 256]; repeat: //... Check if first…
John Smith
  • 3,493
  • 3
  • 25
  • 52
2
votes
2 answers

Wireshark Password Capture of MySQL Traffic

I'm in a test environment trying to use Wireshark to capture credentials being passed to MySQL. I've done some digging and I read that the MySQL client hashes the password before sending even when passing unencrypted. So, when I capture the packet…
Eric P
  • 151
  • 2
  • 6
2
votes
0 answers

Can't decode Instagram, Facebook HTTPS Packets with Burp Suite

According to the title, Install burp suite on my PC and install burp suite certification on my iPhone. I can decode HTTPS packets exclude large company app, But I can't decode HTTPS packets Instagram and Facebook app. I don't know why I can't decode…
rluisr
  • 341
  • 6
  • 16
2
votes
1 answer

Bits in XMAS Scan

I've seen conflicting data for exactly which flags are set in an xmas packet. nmap and other packet tools use PUF flags. However, I also see documentation that states all flags are set; and that the PUF flags are used for certain implementations…
Rob
  • 4,093
  • 5
  • 44
  • 54
2
votes
1 answer

How do I get Wireshark to read header-less pcap files without a UDP/IP/Ethernet header?

Does Wireshark support a format that doesn't require TCP/UDP/Ethernet headers in every packet? Any other (non-pcap) formats wireshark supports would be appreciated. I need to get header-less data into wireshark for further examination.
unixman83
  • 9,421
  • 10
  • 68
  • 102
1 2 3
…
43 44