The packet tag has no wiki summary.
1
vote
0answers
34 views
Can we send and receive uTorrent packets through TOR? [migrated]
I just started using pcapy python module to capture network packets. Is it possible to capture packets going out from uTorrent (on my own machine) with pcapy or scapy and sending them over the TOR ...
1
vote
0answers
34 views
Snort rule for outgoing attacks [closed]
I have a pcap file captured from a user PC. I need to analyze whether it has initialized a DOS attack to any server.
alert tcp any any -> any 8080 (msg:"DOS flood denial of service attempt"; ...
0
votes
1answer
63 views
How to run a snort rule over pcap file
I have a pcap file, and what I wanted to know is how can I apply the Snortrule below which I've already written within the rules folder in my log folder:
alert icmp any any -> any any (msg:"TCP ...
0
votes
0answers
30 views
What is a Packet Identifier (pid) used for?
I'm trying to analyze a pcap file using snort using the following command:
snort -r file.pcap
I got the output which had n number of packets and at the top i had this Packet Identifier pid=14782.
...
-1
votes
1answer
205 views
Interpreting anti-hacker-alliance analysis [closed]
One of security tools available for web browsing is (http://anti-hacker-alliance.com)
Please find below two readings:
a) Reading for IP 205.x.x.x that state among other-things "you are using proxy ...
-1
votes
2answers
248 views
How to make Reaver crack WPS faster [closed]
I have Reaver 1.4 on Ubuntu 14.10 with a Realtek RTL8187SE B/G adapter and it takes almost 5-10 minutes to get from 0.01% to 0.02%. I always have my TX-Power at 30 when I use Reaver, the network is ...
1
vote
2answers
49 views
Is it secure to split information into multiple packets?
I just stumbled upon this SO question.
I was wondering if it would be still secure to split the encrypted packet into multiple packets, which are then transferred over the wire separately.
Could ...
0
votes
0answers
31 views
Splitting a packet which has the size greater than MTU in PCAP
I have a pcap in which the length of packet is more than the MTU. There is a option in wireshark to export the object but that is for only http and smb. Is there a way to split the packet in MTU size ...
1
vote
3answers
96 views
Doesn't seem to be able to capture the packets I need [ANSWERED]
I've been trying to capture Telegram messaging application's packets (for my class project) but I couldn't get anything out of the punch of captured packets I got.
Telegram does AES-256 encryption ...
1
vote
0answers
75 views
Limit Packets Per Second
Since last week I have been seeing something fishy and it seems to be worsening. I tried many firewalls and they seem to be useless. I blocked all unwanted ports and only few ports are open so I found ...
1
vote
2answers
97 views
Send fake response(?packets) to a program [closed]
So my idea was.. There is a program that require login to be able to use(the program should work offline aswell not requiring any online data), so i want to make that program to be able to run offline ...
0
votes
1answer
65 views
Firewall with packet capture and inspection?
Is there such thing as a firewall with packet inspection? Most outbound firewalls simply prompt the user with "program.exe is trying to connect to the internet - allow or deny?". I find it impossible ...
1
vote
2answers
125 views
Force connected devices to use http rather than https
I am very new to MITM attacks and have been faffing around on my home network today..
When sniffing my iPhone trying to connect to some mail accounts I have noticed that it shows a message stating ...
0
votes
1answer
97 views
Firewall log entry: need help in interpretation
I recently setup an Hardware UTM Firewall. The firewall log shows the this entry every 20 seconds:
/var/log/packetfilter/2014/09/packetfilter-2014-09-30.log.gz:2014:09:30-12:06:15
utm ulogd[11342]:
...
0
votes
1answer
261 views
Why can't all wireless cards perform packet injection?
If a wireless card can send packets, why can't it inject packets?
All have to do to inject a packet is create a raw socket, construct a packet with the spoofed headers and then send the packet ...
3
votes
2answers
401 views
Packet Checksums
I recently learned that every packet includes checksum bytes and that the computer will request the packet again if the checksums don't match. How do the following attacks defeat such a safeguard?
...
0
votes
2answers
109 views
Wireshark displays sql calls - Prevention
So I was analysing a new application that is being written. I noticed that on the app server level there are sql calls that are being made from C# code. These calls can be seen in wireshark by ...
1
vote
2answers
40 views
Several processes are listening to the same interface: any problem?
I wonder if some processes may get less packets than others if they are all listening to the same wireless interface.
I'm running for example the basic mitm schema using arpspoof, sniffing packets ...
0
votes
2answers
215 views
Hacking machines using internet packets [closed]
I have a friend (X) who hacked the whatsapp account of someone (Y) using iphone. He told me that he sent a packet to the iphone of Y that appears as a normal whatsapp message but now he can see all ...
0
votes
1answer
57 views
Can I broadcast packet to a public ip? [closed]
I have seen that x.x.x.255 is reserved for broadcasting. Is it only work for broadcasting to the computer which connected to the same router? Can I broadcast to public IPs?
1
vote
2answers
424 views
How to remove tcp header of packets captured with dumpcap?
The traffic from Wireshark saved into a file with dumpcap.
In this file a have for example :
€ X `þ $À6
@ íëÃNxXÀ¨£ P&E»kKí¨<`PEà;
HTTP/1.1 200 OK
Cache-Control: private
And I ...
0
votes
1answer
146 views
Block specific packets/sequences of packets to remove disturbing client “feature”
Recently, one of my client-server application started to disturb me with some very annoying "notifications". Basically, what happens is that the remote server sends a few packets to my client, which ...
0
votes
2answers
174 views
Solution for traffic capturing from router
i'm a newbie and i'm having a problem that i can't find it by google.
I'm researching abbout DDoS detecting method now. As we can see that nowadays people often analyze networking traffic from router ...
2
votes
1answer
259 views
Understanding Hearthbleed attacks [duplicate]
In order for a Heartbleed attack to happen and for someone to grab the SSL private key and even spy they have to be on the local network with a router, switch or server, correct?
Or can this be done ...
23
votes
1answer
1k views
Does TCP/IP protocol offer a reliable way of determining who the actual sender was?
So I'm just poking around the TCP/IP protocol using a Ruby library called PacketFu, and it seems to me that in each packet, it is possible to set all of the following
Source IP
Destination IP
Source ...
0
votes
1answer
66 views
How to log packets which are allowed by SNORT?
Suppose i have not written rule for a type of attack in SNORT; It is obvious that it wont show any alerts. I wanna develop a system wherein i capture packets that SNORT allows n do further processing ...
1
vote
3answers
158 views
Is there a way to get information out of the router [closed]
Is there any way (directly from a computer or device) to see the packets that pass the router from the different devices.
Thanks.
1
vote
0answers
188 views
Suggestions on how to capture network connections/traffic for determining browser/SSL versions?
I've started thinking about how to approach analyzing my network traffic for information relating to SSL and browser usage for my web server farm. I also suspect there are some shadow (legacy, ...
0
votes
4answers
505 views
If you connect through a website via a proxy, and the proxy doesn't save information, can you still be linked back?
Say I connect to a specific proxy that I know will not keep information/data about who connected to it, and I go to a website and do something deliberately illegal. If the "middle-server" doesn't have ...
1
vote
4answers
684 views
Can Your ISP use a Packet Sniffer? [closed]
Can ISPs presumably use packet sniffing applications such as wireshark and monitor my unencrypted data? Are they "allowed" to do so?
0
votes
1answer
119 views
Packet filtering firewall - (Network Layer) [closed]
I would like to know what does this particular rule of the packet filtering firewall ruleset do:
Source Address: Any
Source Port: Any
Destination Address: 192.168.1.0
Destination Port: 1023 and above
...
-1
votes
1answer
1k views
IP packet generate manually? [closed]
I have heard that we can create ip-packets by our own and send it to a network or a host.
How this Can Be Done ?Please Explain step by step??
3
votes
3answers
3k views
How to capture wireless data from an intruder using a home router
After my house mate experienced consistent ping spikes whilst gaming, he asked me to check/set the wireless router password. I did and I found two intruders from obviously nearby. How can the data ...
2
votes
1answer
506 views
Protect an application that uses internet from packet sniffing
I developed a stand alone application such a way that, application use a remote service (using SOAP/REST) which available WWW. I am using HTTPS though out the application calls. It was perfectly ...
-3
votes
1answer
494 views
How to convert some packets in a readable format [closed]
I am looking for a tool for osx, that can convert this raw data in some readable format. Testing my wifi network, I began sniffing my packets, and ran
tcpflow -i en1 -c
I want to get the sniffed ...
0
votes
1answer
905 views
What's the best route to watch network traffic on our networks?
We have a single switch that routes all our different offices around the country using Meraki VPN. We have a VM on the switch (to the extent it can see all subdomains and different IP addresses in our ...
2
votes
1answer
606 views
Reassemble sniffed packets [closed]
I am attempting to analyse my WiFi network with on Mac OS X, is there a tool to reassemble TCP stream from Wireshark capture. I would like to see the entire HTML pages that are passing through the ...
3
votes
2answers
3k views
What's the difference between an application-level and circuit-level gateway?
From Wikipedia, I understand that circuit level gateways look at TCP handshakes to filter illegitimate traffic and that application level gateways somehow filter application specific traffic.
But I ...
1
vote
1answer
306 views
Configure Wireshark to capture preformatted data from pseudo-device
So, for a research project, I'm trying to use the HONE project on github, which creates during its module installation two pseudo-devices in the /dev folder. These are called hone and honet, the ...
7
votes
1answer
607 views
Reconstructing bittorrent data from PCAP
I am doing a CTF flag for my school project with a PCAP flag based on this CTF write-up: eindbazen.net - Plaid CTF 2012 - Torrent
I setup a local torrent file containing an .mp3 (the audio is my ...
9
votes
5answers
15k views
Can Skype chat be protected from snooping? Are there safe alternatives?
I use Skype a lot. With all of my clients, staff, contractors and friends, however, the acquisition by Microsoft worries me, as two of my clients are direct MS competitors, and I often work on long ...
1
vote
3answers
2k views
How to encrypt packets in network?
I have a simple wireless router to share the internet with single access username/password.
I was wondering if it is possible somehow to set packet encryption so that other people on the LAN cannot ...
2
votes
1answer
301 views
isaac random number generator and the type of encryption it is used for (game packet encryption)?
I recently found isaac but I'm not sure what type of encryption is possible using it. Does the random number generator itself become the message somehow or does it get used as a seed for an encryption ...
2
votes
1answer
669 views
snort ignores packets with matching src/dest IP address
This is my rule:
alert udp 192.168.1.1 4000 -> 192.168.1.1 7000 (msg:"This rule doesn't work"; sid:1234567;)
I am running snort against a precaptured packet file where there are UDP packets that ...
1
vote
1answer
931 views
Snort, add TCP retransmission rule
Can somebody help me with adding rule for packet retransmission.
I found some documentation about the snort rules, but I am confused how to use it. The rules which catches the packet retransmission ...
