Questions tagged [packet]
Network packet consisting of routing information and a payload. Most commonly an Internet Protocol (IP) packet. For questions about packet vulnerabilities, or tools like wireshark that directly manipulate packets. Related tag: [network].
0
votes
0answers
32 views
Meterpreter Over HTTPS Proxy
I have a proxy server on the WAN as well as my box open to the WAN. I want this proxy server to (when it receives a shell), route it to my host so it can be the "man in the middle" between my ...
0
votes
1answer
40 views
Can Snort or Suricata *edit* packet on the fly?
I know that they can detect traffic by rules, but can they modify packets on the go?
For example, not only detecting HTTP GET but also adding headers to the GET packet.
If they can't, is there an ...
-1
votes
1answer
31 views
IP suite packet integrity [closed]
Finally, while the IP header contains a noncryptographic checksum for
verifying the integrity of the header, there is no attempt to do the
same for the payload.
Source(Introduction to Computer ...
25
votes
2answers
7k views
Why is my computer making requests to my Roku about spotify?
I'm new to inspecting packets with Wireshark so this might be something very stupid on my part. That said, I don't really understand the transaction between my computer and my Roku.
17 1.129097 ...
0
votes
0answers
29 views
Distributed network with one host behind dmz and the other without
Context:
This a question from my homework assignment.
There is a company with two sites A and B.
B is behind DMZ (firewall - proxy mail server - firewall)
and A is just behind a firewall
Network A ...
0
votes
2answers
98 views
Please help diagnose multiple incoming packets
We have an internet-facing router and it is significantly slowed down. We investigated the network traffic and came up with following information:
All the packet size is same (i.e. 40 bytes)
All ...
1
vote
2answers
345 views
How to intercept http/https requests done by an Android app in plain text? [duplicate]
When I give an android app internet permission and read access to my files, malicious software can send my personal data (pictures and video) to a remote server without me being aware of it.
Is ...
3
votes
2answers
635 views
How wireshark capture packets in LAN without arpspoof?
I created a lab environment which has Windows 7 and Kali Linux in VMware.
In Kali Linux, I opened Wireshark and started to listen to traffic on eth0. After that, in my Windows 7 machine, I opened an ...
0
votes
0answers
44 views
Detecting network attacks by processing individual or multiple network packets?
I am trying to create a tool that identifies network attacks using machine learning, something like a small intrusion detection system. I have collected benign traffic from the network and then ...
1
vote
1answer
150 views
How to pass a localhost check for an incoming request?
I'm trying to send a request to an http server hosted on a machine. The http server is in C# and drops any packets that are not from localhost:
public void Request(HttpListenerContext context) {
...
1
vote
1answer
26 views
How harmfull might be predictable bytes when using AES-CTR
I use AES-CTR to perform on the fly encryption of packets. Each packet is 16 bytes long, however, depending on what is being transferred, the 16 bytes may not be used.
So far, unused bytes are left to ...
2
votes
0answers
192 views
How can I get Suricata to alert on 1 packet every time
I am trying to write a Suricata signature for testing purposes to alert every time it is triggered with a single PCAP file containing a single packet, but this is proving to be harder than I thought.
...
0
votes
1answer
117 views
Are Routers Liken to a Firewall? [closed]
When my ISP came to set up my fiber internet, I told the technician I didn't want a router included within my wired network. He successfully managed setting up the ONT(Optical Network Terminal) ...
1
vote
0answers
24 views
Decrypting 802.11 packets captured through wireshark [duplicate]
I created my own network with security of WPA2-PSK, so I know the SSID, and password.
I then connected 2 devices (A and B) to this network and started capturing B's traffic from A using wireshark in ...
1
vote
2answers
69 views
What is this address I received from wireshark?
______source____________destination___
41:9c:7f:78:b1:0c | 08:00:d0:58:59:4c
I am trying to identify those addresses, the source and the destination, I thought it was IPv6 but then I realized it'...
-1
votes
1answer
53 views
Why would the amount of packets received be greater than the amount of packets sent? [closed]
I am new to wifi, and as I was looking at .pcap files, I noticed that one connection took an absurdly large amount of time. Another thing that stood out is that the amount of packets received was so ...
1
vote
1answer
55 views
Identify Network of Wireless Packet
When sniffing wireless packets from multiple networks, how do you tell which network a packet belongs to?
The best guess I have right now is that you need to see the handshakes and get the mac addr ...
2
votes
1answer
125 views
Security implications of setting the broadcast flag on a UDP socket
Are there any negative security effects of setting the SO_BROADCAST option in a C UDP socket? I'm writing a C program and if I just set the broadcast option to 1 then all IP addresses work as intended,...
1
vote
0answers
82 views
Small data exfiltration protocol?
I have a small amount of data I want to send at regular intervals, such as from an IoT device. How would I design a network protocol or use existing protocols in such a way that my ISP cannot block ...
2
votes
1answer
111 views
From a PCAP file determine if the address has been spoofed?
Reading about the tool hPing, it is possible to spoof an internal address, on the detection side of this how would one go about detecting this? are there tell-tail signs?
EDIT: thinking about it, ...
1
vote
2answers
317 views
Is there a way to tell, when looking at a packet, that an aircrack-ng attack happened?
I'm trying to understand how to find these attacks when using a packet sniffer (specifically using Omnipeek). Is there a way to look at a packet and know that this type attack happened? I want to find ...
2
votes
2answers
2k views
Stopping, editing, then sending packets in Windows 10
I was wondering if there was a way to stop a packet, edit what you want, then send it, like a MiTM attack.
Example:
10.0.0.1 has a ncat listener (ncat -lnvp 1234)
10.0.0.2 connects to 10.0.0.1 (nc ...
5
votes
1answer
898 views
Why is the SSH maximum packet size 32k?
My question has two parts.
First, why must an SSH server have at least a maximum packet size of 32678 bits? It seems a bit excessive for most uses of SSH, excluding file transfer. Is it common for ...
1
vote
1answer
331 views
Why doesn't nmap return open port info when I fragment packets?
I'm performing a scan on a remote host and playing around with the -f flag for nmap when I noticed something I hadn't expected. In amongst the other data, when I type nmap -v -O <hostname> I get ...
1
vote
1answer
255 views
Are packets processed by a proxy new or modified?
Client ---> First packet ---> Proxy ---> New packet? ---> Server
If we speak about proxy systems, does the first packet get discarded and a new packet gets created, or it's still the ...
1
vote
0answers
218 views
Displaying a report of top visited websites per period (HTTP and HTTPS) [closed]
I have a MikroTik router that connects to a network with multiple endpoints. All the WAN traffic flows through this router and I would like to be able to monitor (not necessarily filter) the ...
1
vote
1answer
2k views
Proxying MetaSploit through BurpSuite
I was wondering how I would be able to proxy MetaSploit through BurpSuite.
I was to reverse engineer a packet being sent to my ChromeCast, but I have no way of viewing the packet.
Thanks.
0
votes
1answer
63 views
Any way to know if a sniffed packet contains a downloaded file?
Is there any way, using TCPdump, Wireshark or any library based on that, to know if someone is downloading a specific file, for example abc.exe, by inspecting the http packet? http, not https
4
votes
1answer
271 views
How to inspect TCP Header -> Optional Data with Snort?
I have been looking around for clues on how to define rules, decoders or preprocessors to be able to content-inspect the TCP Header's Optional Data ( The last 0-40 bytes of the TCP Header)
TCP ...
4
votes
1answer
86 views
Would it be possible for an ISP to guess specific requests on an HTTPS site using package size? [duplicate]
In light of the recent senate decision in the US to allow ISPs to sell users' browsing history, I've been reading of recommendations on how users can retain their privacy. One of the common ...
4
votes
2answers
572 views
How does ndpi actually detect the HTTP protocol?
I have been digging the ndpi codebase and trying to understand how its actually detecting the HTTP protocol.
What I found so far is that they are searching the request type in the payload and if not ...
2
votes
1answer
430 views
Tracking a backdoor by recording packets
I am by no means very bright when it comes to networking. But I know a bit.
Let's say I suspect a backdoor is on my pc.
To counter it I setup a device between the router and my pc to log everything. ...
0
votes
0answers
26 views
Can someone without router password sniff packets of all device connected on it? [duplicate]
I am right now connected to a public wifi that I trust because it's the Wifi of my college. But I am worried that other students connected on the same network can see my browser history using packet ...
0
votes
0answers
53 views
Tracking someone using packet type/frequency/size?
I want to know if it is possible to track someone using their packet type/frequency/size etc.
There is a site that always tracks me down even if I connect to it using RDP or VPN. No matter what I ...
0
votes
2answers
189 views
How much traffic can a firewall node handle? Any real examples? [closed]
As a part of my research, I need to determine the maximum packets (Internet traffic) can one instance of firewall/ IDS process. I am not sure where to begin though.
Your assistance and guidance in ...
17
votes
3answers
3k views
Is it possible to see a packet before encryption?
I mean, if I am, for example, on Facebook, every packet I send out of my NIC is encrypted. But there must be phase of that packet before it is encrypted. The browser (I think) must create that packet ...
2
votes
1answer
197 views
Eavesdropping on a specific port of machine in the WLAN from a different machine, possible? (using arpspoof)
I'm using netcat -l 555 option to communicate between two computers(Linux) on port 555, is there any way I can eavesdrop to whats going on in that conversation from a 3rd computer?
After the second ...
0
votes
2answers
142 views
RSSI of wifi device MITM detection
Let's say there is someone doing some malicious activity on your network and you want to track the packet's signal strength to catch the attacker.
Is this theory plausible?
-1
votes
0answers
19 views
is a packetlogger useful in case of https packets? [duplicate]
from what i understand a packet logger makes a copy of the transmitted packets.
suppose my isp installs somewhere a packet logger.
suppose also i log to only to a site using https like facebook.
...
4
votes
2answers
402 views
How can I tell which process is generating SYN traffic to localhost?
In Wireshark, on the loopback interface, I can see SYN requests from localhost to closed ports on localhost that are being responded to with RST, ACKS.
I'm curious what's generating the traffic. How ...
3
votes
3answers
163 views
Who can sniff my packets?
If I make a call to some server who can sniff my packets?
Obviously anyone who is on my network can sniff, but on the server side also?
My call will make several hops to the destination server, can ...
3
votes
1answer
339 views
In TCP, what happens when two Data packets come in with the same sequential identifier, but different data (spoofed)
I'm trying to verify an answer I posted to a recent question:
Client A with real IP has connected ... Now, the attacker machine M sends a [data] packet [with a correct sequential identifier] ...
2
votes
3answers
1k views
IP Spoofing with real IP when TCP 3-way handshake has been made
In a situation, where the spoofed IP is a real existing remote IP and it is found that the TCP 3-way handshake has been made with a server.
The MiTM machine sends the packet with spoofed IP to the ...
2
votes
0answers
84 views
Trying to reproduce MiTM attack
Firstly, I would like to clarifiy 2 points:
I have hesitated between posting here or on stackoverflow. I don't really understand if it is my code or some kind of security on my router. So, if you ...
1
vote
1answer
311 views
Do network packets capture what gets encrypted in a device?
Do network packets capture what gets encrypted in my device before it gets sent to the host? For instance.
In instagram when you log in from a mobile device. You submit a post request. In that post ...
0
votes
0answers
654 views
How can I sniff packets from my iphone to my wifi
I'm just trying to capture packets from my iphone device to my wifi before it gets send to the actual host. I'm trying Mitm attack but I'm trying to intercept the packets from my client modify it and ...
1
vote
1answer
4k views
How to identify a machine by its IP address in wireshark?
I'm new to the world of security and I'm trying to figure out how to analyze the network traffic on my home wifi network. I've been watching a lot of tutorials and reading about how to use wireshark. ...
4
votes
1answer
935 views
When should I generate new public & private keys using RSA?
I'm creating a huge, online mobile game. I have a few questions for you guys because my knowledge in cryptography and sending data across the network securely is kinda poor.
Some details:
Each user ...
1
vote
1answer
431 views
UDP replay “attack”
Suppose that there is a client-server application using UDP and you have full control over client. The task is to automate few known actions on the client and make them very fast.(Possibly bypass ...
3
votes
1answer
1k views
Network packet obfuscation
Suppose I am wirelessly transmitting network traffic between a computer and a router. As I understand it, even though the traffic is encrypted, it is possible for a third party attacker to intercept ...
