I created a scenario in VirtualBox (configured as internal network) with two machines: Windows XP and Kali Linux. I used ms08_067_netapi exploit from Metasploit and the payload windows/meterpreter/reverse_tcp. I tested the scenario two times (with 1 repetition) with exactly the same configurations, however I noticed the traffic generated is different.


Look at these traffic examples:

Attempt 1: enter image description here Attempt 2: enter image description here

Make sense for why network ports can be different. But, as it is possible to see, the packet length is variable, and i don't understand why.

What is the reason why traffic is different if the attack is exactly the same? What can be the possible root cause?

Note: In the link https://we.tl/t-hEVze7d0L4 is possible to check samples on pcap format (they are not the same from the pictures I mentioned, but the attacks are the same). I also included Snort IDS output for the different pcap files, and as it is possible to see were triggered alerts with different attributes for the same attacks.

  • it would be nice if you could upload both samples on pcap format, so every one can see exactly the traffic and the attack – camp0 Jun 20 at 15:21
  • @camp0 I have just included a link with the pcap files. – Mario Jun 20 at 15:51
  • I think your problem is described here osqa-ask.wireshark.org/questions/24501/… nothing related to the attack that you are making, I think. – camp0 Jun 20 at 19:46

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.