Stack Overflow
Stack Overflow

Questions tagged [packet-capture]

is for questions about capturing packets of various protocols that are transmitted over a network.

A lot of computer network protocols transmit their contents in packets. Packet capture is the interception of these packets as they are moved over a network of some type.

A packet sniffer captures raw data traveling over a network segment and saves it to a file for analysis.

Software

A software sniffer can generally only capture network data either originating from or going to the computer running it, plus any "broadcast" messages, if the computer is connected to the network via a switch. If the computer is connected to the network via a router, it may be able to capture network data for any device on connected to the same router.

Hardware

A hardware packet sniffer is physically connected to the network by connecting it to a router or switch. Sometimes the router or switch has to be configured to allow the sniffer to capture traffic being routed through it; this is called port mirroring.

Analysis

The captured data can be analyzed by the software that captured it, or by a program specifically designed to analyze the network data.

See Also

  • Wikipedia Article on Packet Analyzers
  • The term packet sniffer is also common and can be considered a synonym.
659 questions
146
votes
9 answers

Wireshark localhost traffic capture

I wrote a simple server app in C which runs on localhost. How to capture localhost traffic using Wireshark?
Udara S.S Liyanage
  • 6,189
  • 9
  • 33
  • 34
76
votes
9 answers

Sniffing an Android app to find API URL

I'm curious as to how I could figure out the API URL an Android application (any app I have installed) uses if it makes API calls to some online server (a RESTful service for example). I presume I have to capture packets on the device and maybe…
derpyderp
  • 926
  • 1
  • 10
  • 15
69
votes
10 answers

iPhone and WireShark

How can I sniff packets from my iPhone on my network? can someone give me some instructions? I tried Googling, but nothing teaches how to sniff iPhone packets、 I am on windows.
Strawberry
  • 66,024
  • 56
  • 149
  • 197
57
votes
6 answers

Bluetooth sniffer - preferably mac osx

I am trying to find a bluetooth packet sniffer to capture bluetooth signals from close by devices. I would like for this application to work on mac osx. I have had difficulty finding anything at all so my requirements are low right now - something…
Jim
  • 571
  • 1
  • 5
  • 3
39
votes
3 answers

Capture incoming traffic in tcpdump

In tcpdump, how can I capture all incoming IP traffic destined to my machine? I don't care about my local traffic. Should I just say: tcpdump ip dst $MyIpAddress and not src net $myIpAddress/$myNetworkBytes ... or am I missing something?
Ricky Robinson
  • 21,798
  • 42
  • 129
  • 185
33
votes
2 answers

Android firewall with VpnService

I'm trying to implement a simple firewall for android with VpnService for BS project. I choose VpnService because it will be working on non-rooted devices. It will log connections and let you filter connection. (Based on IP) There is an application…
fatihdurmus
  • 333
  • 1
  • 3
  • 5
29
votes
2 answers

How can I capture packets in Android?

I would like to capture TCP packets as well as protocol data such as HTTP and HTTPS in Android, similar to Wireshark in Windows. How can I do this in Android?
Avinesh
  • 584
  • 3
  • 13
  • 31
28
votes
1 answer

Capture LLDP packets using tcpdump

What is the format to capture LLDP packets on an interface using tcpdump? I tried the following format but it dint work: tcpdump -w test.pcap -i eth0 lldp -vv
udaya
  • 407
  • 1
  • 4
  • 9
20
votes
4 answers

How to filter wireshark to see only dns queries that are sent/received from/by my computer?

I am new to wireshark and trying to write simple queries. To see the dns queries that are only sent from my computer or received by my computer, i tried the following: dns and ip.addr==159.25.78.7 where 159.25.78.7 is my ip address. It looks like i…
yrazlik
  • 10,411
  • 33
  • 99
  • 165
18
votes
4 answers

Layered Service Provider in C#

I'm looking to write a LSP in C# to capture and re-direct UDP packets.. I have little experience with LSP's but I've heard they can do this sort of thing, please correct me if I'm wrong, but is this possible? I would love some example code but I…
caesay
  • 16,932
  • 15
  • 95
  • 160
18
votes
1 answer

How to filter MAC addresses using tcpdump?

I am running tcpdump on DD-WRT routers in order to capture uplink data from mobile phones. I would like to listen only to some mac addresses. To do this I tried to run the command using a syntax similar to Wireshark: tcpdump -i prism0 ether src[0:3]…
Giovanni Soldi
  • 385
  • 1
  • 4
  • 12
16
votes
2 answers

RawCap error:"Unable to enter promiscuous mode (RCVALL_ON), using RCVALL_SOCKETLEVELONLY."

I am attempting to capture localhost(loopback 127.0.0.1) TCP traffic between master-slave (server-client) programs on my PC. Wireshark cannot do this, but I understand that RawCap does. When I try to run the program, RawCap says "Unable to enter…
bdrudolph
  • 179
  • 1
  • 6
16
votes
3 answers

Follow tcp stream - Where does field "Stream index" come from?

Wireshark has a that feature called "follow tcp stream", under the menu item "Analyze". When I use it, a screen capture filter is generated, something like: tcp.stream eq 1 Where does this index come from? I can't find any field in the packet that…
pcent
  • 1,929
  • 2
  • 14
  • 17
16
votes
4 answers

Get TCP Flags with Scapy

I'm parsing a PCAP file and I need to extract TCP flags (SYN, ACK, PSH, URG, ...). I'm using the packet['TCP'].flags value to obtain all the flags at once. pkts = PcapReader(infile) for p in pkts: F = bin(p['TCP'].flags) print F,…
auino
  • 1,644
  • 5
  • 23
  • 43
16
votes
1 answer

how to capture package at a specific port on any interface using tshark

I want to capture the package on a specific port on any interface of my machine. I know how to capture the package on a specific port with a specific interface. And the command is tshark -f "udp port 162" -i bond0 And if no interface is…
zhaojing
  • 585
  • 3
  • 11
  • 33
1
2 3
…
43 44