Stack Overflow
Stack Overflow

Questions tagged [packet-capture]

is for questions about capturing packets of various protocols that are transmitted over a network.

A lot of computer network protocols transmit their contents in packets. Packet capture is the interception of these packets as they are moved over a network of some type.

A packet sniffer captures raw data traveling over a network segment and saves it to a file for analysis.

Software

A software sniffer can generally only capture network data either originating from or going to the computer running it, plus any "broadcast" messages, if the computer is connected to the network via a switch. If the computer is connected to the network via a router, it may be able to capture network data for any device on connected to the same router.

Hardware

A hardware packet sniffer is physically connected to the network by connecting it to a router or switch. Sometimes the router or switch has to be configured to allow the sniffer to capture traffic being routed through it; this is called port mirroring.

Analysis

The captured data can be analyzed by the software that captured it, or by a program specifically designed to analyze the network data.

See Also

  • Wikipedia Article on Packet Analyzers
  • The term packet sniffer is also common and can be considered a synonym.
659 questions
9
votes
1 answer

Scapy fails to sniff packets when using multiple threads

I'll try to demonstrate my problem with a simplified example. Following is a very simple (single threaded) packet sniffer (ICMP): from scapy.all import * m_iface = "wlan0" m_dst = "192.168.0.1" def print_summary(pkt): print pkt.summary() def…
Asiri Rathnayake
  • 1,138
  • 1
  • 11
  • 27
9
votes
2 answers

How to decode a packet received through WireShark & resolving some errors

We are capturing traffic using JN5148EK010 nodes via WireShark. The packets received are shown in the screenshot provided. I want to know how to decode the data An error occurs afer capturing a few packets, whose screen shot is also provided. How…
Hamra Rehan
  • 181
  • 2
  • 3
  • 7
8
votes
2 answers

tcpdump vs tcpflow (or "why isn't tcpdump ASCII packet data human readable?")

I have used both, and I conclude that I can read html data from webpages with tcpflow but cannot do so with tcpdump. The best I get is some ugly ASCII text with lots of period symbols. My understanding is that tcpdump doesn't reassemble packets,…
Sridhar Sarnobat
  • 25,183
  • 12
  • 93
  • 106
8
votes
2 answers

How to replay Wireshark captured packets?

I have captured some packets in Wireshark and need to replay those again in any way.
Some One
  • 103
  • 1
  • 1
  • 5
8
votes
2 answers

SO_ATTACH_REUSEPORT_CBPF socket option unexpected behavior

I am trying use a port from two applications and have each of them receive the packet from a different set of IP addresses. In order to achieve this, I use the SO_REUSEPORT and SO_ATTACH_REUSEPORT_CBPF socket options. My code is as…
user2424276
  • 591
  • 1
  • 5
  • 24
8
votes
3 answers

How is data divided into packets?

Hi sorry if this is a stupid question (I just started learning network programming), but I've been looking all over google about how files/data are divided into packets. I've read everywhere that somehow files are broken up into packets have…
Edgepad
  • 83
  • 1
  • 5
8
votes
2 answers

What is an ASN file and how do I use it?

I am trying to work with a communication protocol (S1AP to be specific) and I am trying to define messages to test. The LTE 36.413 specification details this protocol and also give an ASN.1 file definition at the bottom of the pdf. I have seen ASN…
Edwin
  • 797
  • 2
  • 14
  • 23
8
votes
1 answer

how wireshark marks some packets as "tcp segment of a reassembled pdu"

I opened a pcap in wireshark and it displays a lot of packets as "tcp segment of a reassembled pdu". How wireshark is able to determine which tcp packets are segments of a reassembled pdu ? I am not able to find any header field or anything else by…
mezda
  • 3,537
  • 6
  • 30
  • 37
8
votes
4 answers

Scapy and rdpcap function

I'm using rdpcap function of Scapy to read a PCAP file. I also use the module described in a link to HTTP support in Scapy which is needed in my case, as I have to retrieve all the HTTP requests and responses and their related packets. I noticed…
auino
  • 1,644
  • 5
  • 23
  • 43
7
votes
1 answer

Python raw socket listening for UDP packets; only half of the packets received

I am trying to create a raw socket in Python that listens for UDP packets only: import socket s = socket.socket(socket.AF_INET, socket.SOCK_RAW, socket.IPPROTO_UDP) s.bind(('0.0.0.0', 1337)) while True: print s.recvfrom(65535) This needs to be…
Etienne Perot
  • 4,764
  • 7
  • 40
  • 50
7
votes
2 answers

.net packet capture: pcap.net vs sharppcap

interested in any comments anyone has around the various .net tools which can be used for passive packet capture. In terms of winpcap the choice seems to be between pcap.net and sharppcap. Another potential offering is Microsoft's NetworkMonitor and…
Patrick
  • 8,175
  • 7
  • 56
  • 72
7
votes
0 answers

How to extract payload information and inbound/outbound ratio of packets from a pcap file?

I have a very large pcap file and I am looking to create a script to give me (in addition to the attributes that wireshark gives me), the payload and inbound/outbound ration of packets. I was thinking to use something like this below but I am not…
user3755632
  • 381
  • 1
  • 2
  • 20
7
votes
2 answers

Is it possible to use packet_mmap on linux without root access?

Linux has a feature to allow efficient capture of network packets by mmapping a shared buffer between the kernel and user. I'm trying to use this interface in a way that does not require root access (as I don't have it). Often packet_mmap is used…
charliehorse55
  • 1,940
  • 5
  • 24
  • 38
7
votes
1 answer

Scapy PcapReader and packets time

I'm reading a PCAP file using Scapy using a script such as the (semplified) following one: #! /usr/bin/env python from scapy.all import * # ... myreader = PcapReader(myinputfile) for p in myreader: pkt = p.payload print pkt.time In this…
auino
  • 1,644
  • 5
  • 23
  • 43
7
votes
1 answer

how to edit wireshark pcap to change the order of packets

i have a pcap file captured using wireshark. suppose the pcap has 6 packets numbered from 1 to 6 as shown below. now i want to edit this pcap file so that i get the packets in some different order. For eg, if original pcap packets are…
mezda
  • 3,537
  • 6
  • 30
  • 37
1 2
3
…
43 44