Stack Overflow
Stack Overflow

Questions tagged [pcap]

pcap (packet capture) consists of an application programming interface (API) for capturing network traffic. The pcap file format is a binary format, and is the de facto standard format for network packet capture.

pcap (packet capture) consists of an application programming interface (API) for capturing network traffic. Unix-like systems implement pcap in the libpcap library; Windows uses a port of libpcap known as .

Source: Wikipedia

pcap also refers to the file format originally generated by the libpcap library. This binary format has become a de facto standard format for packet capture, and is now generated by other network analyzer tools, such as Wireshark.

Source: https://www.lesliesikos.com/pcap

1410 questions
7
votes
3 answers

How to prevent Windows from sending RST packet when trying to connect to somebody via Pcap.net?

I'm trying to use Pcap.Net to open a tcp connection. I'm sending following package: The server is responding with: After this, Windows on its own sends the reset packet: Why is this happening, and how do I block this behavior? I'm doing this on…
Arsen Zahray
  • 24,367
  • 48
  • 131
  • 224
7
votes
1 answer

Issue in pcap_set_buffer_size()

#include #include #include #define BUFFER_SIZE 65535 char errbuf[PCAP_ERRBUF_SIZE]; int main(int argc, char **argv) { int d; pcap_if_t *alldevsp; pcap_t *pkt_handle; …
bengaluriga
  • 319
  • 2
  • 5
  • 9
7
votes
2 answers

Creating a pcap file

I need to save UDP packets to a file and would like to use the pcap format to reuse the various tools available (wireshark, tcpdump, ...). There are some information in this thread but I can't find how to write the global file header 'struct…
Robert Kubrick
  • 8,413
  • 13
  • 59
  • 91
6
votes
7 answers

How to stream pcap file to RTP/RTCP stream?

I have captured three different stream as pcap file with meta datas. How can I stream back to RTP/RTCP stream?
Swaminathan
  • 61
  • 1
  • 1
  • 3
6
votes
1 answer

How to write PCAP capture file header?

Without using libpcap I am trying to write a log file that adheres to the pcap file format (format). This file needs to be readable by WireShark. So far I've written this in C++: struct pcapFileHeader { uint32_t magic_number; /* magic number…
Scott
  • 61
  • 1
  • 2
6
votes
1 answer

Continuously feeding pcap files to tshark/wireshark

I have pcap files continuously generated to me. It want to continuously feed them to a "ever-running" tshark/wireshark. Here is what I have tried (OSX) mkfifo tsharkin tail -f -c +0 tsharkin | tshark -l -i - > tsharkout 2>stderr & cat file1.pcap >…
Per Steffensen
  • 613
  • 2
  • 7
  • 19
6
votes
2 answers

Get first and last times from pcap file with Wireshark command line tools (like tshark)

I have a huge collection of PCAP files, some of which have been "touched" since they were captured. This means the system timestamp on the file may not equate to the time of the data capture. Additionally, most of the files are autosaves from…
Trashman
  • 1,424
  • 18
  • 27
6
votes
2 answers

How to remove Ethernet layer from a pcap file?

I have a pcap captured with Wireshark. Is there any function in Wireshark that will strip Ethernet layer from the result? Or any command line tool to do it?
mcv
  • 175
  • 2
  • 7
6
votes
2 answers

Sniffing wifi using libpcap in monitor mode

Problem Statement Calling pcap_activate() results in PCAP_ERR_RFMON_NOTSUP error, i.e. RF monitor mode is not supported. Context I'm writing small C program whose job is to listen on my laptop's wifi card in monitor mode. The laptop is running…
user108879
  • 63
  • 1
  • 5
6
votes
1 answer

Detect ARP poisoning using scapy

I have captured some traffic and stored on a .pcap file. In there, an ARP poisoning attack occured. Is there a way of detecting the attacker's IP and MAC adress and victim's IP and MAC adress using scapy in a python script?
Dimitris S
  • 135
  • 1
  • 13
6
votes
4 answers

How to send pcap file packets on NIC?

I have some network traffic captured pcap file and want to send its packets on NIC; is it possible? Is there any application to do this?
salman
  • 1,966
  • 3
  • 15
  • 18
6
votes
3 answers

pcap files and endianness

Running the file command against a pcap file will print out something along the lines of - $ file pcap.pcap pcap.pcap: tcpdump capture file (little-endian) - version 2.4 .... I've been looking for a way to create a big-endian capture file, or…
RyPeck
  • 7,830
  • 3
  • 38
  • 58
6
votes
2 answers

RawCap sniffer results in empty pcap file

So... I'm attempting to use RawCap to capture traffic to localhost When I run rawcap, it reports packets in the cmd prompt - but the dump file is always empty. Any ideas (I've tried running with admin privs)
iasksillyquestions
  • 5,558
  • 12
  • 53
  • 75
5
votes
2 answers

"Replay" tcpdump file

I am writing a program for analyzing certain type of packets. I got the dump file containing test packets in tcpdump format. is there any way to send this dump into one of the interfaces? I thought tcpdump would be able to do this on its own…
Blackie123
  • 1,271
  • 4
  • 16
  • 22
5
votes
4 answers

How to capture traffic from multiple interfaces using pcap

In order to sniff from multiple interfaces using pcap, I would do the following (in pseudocode): foreach interface: open a file descriptor using pcap_open_live() set the file descriptor to non-blocking while true: check for a ready file…
ziu
  • 2,634
  • 2
  • 24
  • 39
1 2 3
…
93 94