Questions tagged [packet-capture]

is for questions about capturing packets of various protocols that are transmitted over a network.

A lot of computer network protocols transmit their contents in packets. Packet capture is the interception of these packets as they are moved over a network of some type.

A packet sniffer captures raw data traveling over a network segment and saves it to a file for analysis.

Software

A software sniffer can generally only capture network data either originating from or going to the computer running it, plus any "broadcast" messages, if the computer is connected to the network via a switch. If the computer is connected to the network via a router, it may be able to capture network data for any device on connected to the same router.

Hardware

A hardware packet sniffer is physically connected to the network by connecting it to a router or switch. Sometimes the router or switch has to be configured to allow the sniffer to capture traffic being routed through it; this is called port mirroring.

Analysis

The captured data can be analyzed by the software that captured it, or by a program specifically designed to analyze the network data.

See Also

  • Wikipedia Article on Packet Analyzers
  • The term packet sniffer is also common and can be considered a synonym.
659 questions
2
votes
1 answer

How to see what data a windows application send through my network?

I want to see what a application send to network and if is possible to edit or stop them. thanks ;)
Totty.js
  • 15,563
  • 31
  • 103
  • 175
2
votes
0 answers

How can i link hadoop with snort?

I'm trying to process snort packets by hadoop, I captured packet using snort by typing: snort -v and then logging them in snort log file by: snort -l /var/log/snort -b I want to process them by hadoop platform to analyze them to match specific…
Dalya
  • 374
  • 1
  • 3
  • 15
2
votes
2 answers

What's the best way to capture packets sent and received by my own android app?

I'm a developer of a VOIP calling app who's trying to troubleshoot connectivity issues. I'd like to ship something in production that uploads pcap traces of it's own calls - particularly ones that drop, have high amounts of noise, or other…
Li Pi
  • 486
  • 5
  • 10
2
votes
1 answer

How to add a fake ethernet header to a capture

I have a decrypted VPN pcap file. What I am trying to do is to read the pcap using tcptrace in linux. But, tcptrace does not seem to get this format that I have. So here is the snapshot of the pcap. This is the pcap So, what I want to do is to…
2
votes
1 answer

Search for unicode string (UTF-16) in PCap file captured by WireShark

I try to search for string in Pcap file captured by Wireshark tool. All string from/to sql server is formatted as Unicode String (UTF-16). When the frame contains a Unicode string like "select", it is displayed as "s e l e c t", the space between…
M.Hassan
  • 10,282
  • 5
  • 65
  • 84
2
votes
1 answer

DNS packet (response answer and DNS query)

I'm coding a program by C language in order to analyze DNS packet. Specifically, I have to capture DNS packet and I need to know the domain name after capturing DNS packets. How can a access to the answer section? My code is using pcap…
LHh
  • 31
  • 3
2
votes
1 answer

iOS Swift capture network packets

For a testing App i need to get network information from iOS. In Android there are API's available to obtain packets sent, received, size of them in bytes, and some other information. Is there anything similar in Apple iOS? More deep information…
Ricardo Gomes
  • 120
  • 1
  • 7
2
votes
0 answers

Windows IPS or a way to drop packets

Does anyone know a way to drop packets using Windows, cause I already tried it in many ways. First I tried it with Snort but there is way to get it inline for Windows use. My second solution was to use Suricata but also here I ended up the same way…
2
votes
1 answer

Get IP packet data from ByteBuffer

I'm trying to get the source and destination address from a packet. This is how i am reading the packet: private void debugPacket(ByteBuffer packet) { int buffer = packet.get(); int ipVersion = buffer >> 4; int headerLength = buffer &…
TychoTheTaco
  • 664
  • 1
  • 7
  • 28
2
votes
0 answers

I've captured a packet in Smartsniff and would like to resend it in Python

Packet captured between localhost:23150 and localhost:6010 ================================================== Index : 5 Protocol : TCP Local Address : 127.0.0.1 Remote Address : 127.0.0.1 Local Port : 23150 Remote…
2
votes
3 answers

How to debug a DPDK app that uses hugepages

I am working with an application written using DPDK-1.6.0r0 and I want to debug it. My first idea was to use gdb, but I got this error: EAL: No free hugepages reported in hugepages-2048kB I compiled the environment ih this way: make install…
phil91
  • 81
  • 3
  • 14
2
votes
1 answer

Packet sniffer in C for all VM

I have 3 Ubuntu VM that represent client/server/attacker. I created an application that connect client and server in TCP and I have a packet sniffer in the attacker machine. However, the code only manage to sniff packet going from the attacker…
Arwa
  • 23
  • 6
2
votes
1 answer

How to forward wireless packet to ethernet interface in windows?

How to forward wireless packet to ethernet interface in windows?
M.Rezaei
  • 992
  • 3
  • 11
  • 28
2
votes
1 answer

Sniffing network traffic using a script from OS X

I come from a linux background and recently acquired a mac. In linux I had a lot of scripts written in python that were used to do specific packet sniffing and capturing. Dedicated deauthentication packet capturing or other wireless probes. For that…
or3stis
  • 273
  • 1
  • 3
  • 10
2
votes
0 answers

kernel module does not print packet info

I would like to use a c kernel module to capture all the network packets coming to an interface.. My topology is something like A--->B--->C, which means A sends a UDP packet to C's IP, but the packet will go through B. My problem is that: at B side,…
Luc
  • 21
  • 2