Questions tagged [packet]

Network packet consisting of routing information and a payload. Most commonly an Internet Protocol (IP) packet. For questions about packet vulnerabilities, or tools like wireshark that directly manipulate packets. Related tag: [network].

Filter by
Sorted by
Tagged with
0 votes
0 answers
73 views

Wireshark Output | [Malformed Packet: Laplink: length of contained item exceeds length of containing item] from Russian IP

While running some traces for one of our production servers, an interesting item kept popping up in our Wireshark: [Malformed Packet: Laplink: length of contained item exceeds length of containing ...
user avatar
  • 1,227
1 vote
1 answer
268 views

How to extract Kerberos ticket from Wireshark?

I'm running a pentest and I've managed to get man-in-the-middle access between a machine and a domain controller. A process on the machine will log into the DC, as a domain admin, to get a Kerberos ...
user avatar
  • 79
0 votes
0 answers
74 views

Listening to other network traffic on a known WiFi network using libpcap

I want to use libpcap to listen to the network traffic on another server on my home WiFi network. In this scenario i already know the password and ssid. I have already changed my network adaptor to be ...
user avatar
  • 101
0 votes
1 answer
178 views

Is it possible to prevent packet capturing on Android for sent TCP/IP packets?

I'd like to know if some measure is possible to prevent the capturing of packets that are being sent on Android. I'd need the solution to work via code (cannot rely on external tools). Packets are ...
user avatar
0 votes
3 answers
209 views

Nextgen firewalls - encrypted traffic inspection

I read recently about next generation firewalls that use deep-packet-inspection, intrusion-prevention and something the manufacturers call encrypted-traffic-inspection, encrypted-traffic-analytics. ...
user avatar
1 vote
0 answers
107 views

IPSec MTU DDos attack

I have this configuration: HOST-A <---> GAT-A <---> MiTM <---> GAT-B <---> HOST-B I'm doing a security project on MTU-IPsec vulnerabilities and following this guide of Hal-...
user avatar
  • 23
0 votes
0 answers
84 views

Is every packet of a hostile network flow hostile?

We are building a packet based anomaly detection system and I'm trying to find labeled packets. Such dataset doesn't exist based on my search, but I can find labeled flows. Can we say that every ...
user avatar
1 vote
2 answers
192 views

Is every packet in a home Wi-Fi which has say, AES password for connection, encrypted using the same password?

If there is an intruder in a LAN who knows the encryption type and password, will he be able to monitor all the packets which are in the LAN? Suppose someone on the LAN is visiting HTTP sites, which ...
user avatar
4 votes
1 answer
513 views

Why do I need root privileges to send a raw packet from a UNIX machine?

I was recently reading through the nmap port scanning documentation and it points out that to perform a SYN scan (-sS) you require root privileges because an unprivileged user cannot send raw packets. ...
user avatar
  • 98
1 vote
0 answers
113 views

Snort doesn't capture raw packets

I have a python code on Linux to create a raw packet: import socket s = socket.socket(socket.AF_INET, socket.SOCK_RAW, socket.IPPROTO_TCP) s.setsockopt(socket.IPPROTO_IP, socket.IP_HDRINCL, 1) ...
user avatar
  • 113
1 vote
0 answers
524 views

How to fix TCP stream in Wireshark with spurious retransmission?

This was for a CTF (it ended yesterday, so I'm not cheating), but I've spent so many hours on it that I really just want to understand what I should have done. Here is the PasteBin Hex Dump. I ...
user avatar
1 vote
0 answers
155 views

How do I prevent against man-in-the-middle, specifically the packet injection attack? [closed]

I suspect that I am being targeted in a man-in-the-middle attack from the ISP or in-between of the fiber cable transit or the node by sniffer hardware that detects and injects the malicious packets. I ...
user avatar
0 votes
2 answers
351 views

Does HSTS prevent packet capturing in Wireshark

If a site is enforcing HSTS, does that prevent packet capturing of a GET requests in Wireshark? If it prevents it, is it possible to achieve the same using Bettercap or any other alternatives? ...
user avatar
1 vote
2 answers
208 views

Does HTTPS protect mobile internet connections against "network injection"?

The Star recently published an article describing an alleged attack against a Moroccan journalist. The article describes the attack as such: Forensic evidence gathered by Amnesty International on ...
user avatar
  • 163
1 vote
2 answers
187 views

What is the most powerful type of DDOS/DOS attack? [closed]

What I mean is what protocol are best to DOS something like TCP, UDP, HTTP?
user avatar
1 vote
2 answers
6k views

tcpdump packets have bad and incorrect checksums on localhost, how to investigate further?

Am investigating a macOS Catalina machine that is believed to be infected with malware. Have been viewing packets with tcpdump and noticed, on connecting to any web address, there are legit packet ...
user avatar
1 vote
2 answers
212 views

Detect and optionally block a certain string in network traffic on Windows 10

Suppose I have some important text data on my computer, like a plain text password y5278dhk28ds and I have malware on my PC that periodically searches for sensitive data and sends that data to ...
user avatar
  • 111
1 vote
2 answers
183 views

How far is my Access Point BSSID sent in my internet packets?

My question relates to this question: How does Google know where I am? and ask a similar question to this (but that accepted answer doesn't pertain to BSSIDs). The chosen answer in my first linked ...
user avatar
1 vote
1 answer
824 views

What kind of attack? [closed]

I was able to find the Teardrop Attack. However, there is another one but I couldn't explain it. It keeps getting the warning: Source MAC must not be a group address. Is this some sort of ARP spoofing ...
user avatar
2 votes
3 answers
4k views

I can't figure out the abnormal behaviour from this Wireshark capture file

The capture file if needed There is supposed to be abnormal behaviour here, and I see that there is. But I can't figure out what it is. There is no response from the ICMP requests. Furthermore some ...
user avatar
  • 21
0 votes
1 answer
130 views

Can you cut up frames/packets and combine them anonymously?

Is it possible to somehow cut up a packet and send it from multiple IPs into parts and send them to one IP address to reconstruct a semi-anonymous packet/frame? Can frames have their source faked? ...
user avatar
0 votes
0 answers
1k views

Intercept TCP traffic using Python

Situation: I am trying to intercept TCP (not HTTP) traffic on a Windows machine using Python. I am posting this question as most answers I was able to find teaches how to sniff traffic. Normal ...
user avatar
1 vote
2 answers
2k views

Capture wireless traffic in PROMISCUOUS mode (not monitor mode)

I am trying to capture packets from other devices that are connected to the same network as I am. I know the difference between monitor mode and promiscuous mode (explained in this question), but for ...
user avatar
  • 15
1 vote
1 answer
141 views

How can one read the time in GPG's Literal Data Packet?

RFC 4880 says that the Literal Data Packet's time stamp is four octets long. Listing packets shows that it is five octets long, at least in GnuPG 2.2.6. The time stamp comes after the word "created", ...
user avatar
  • 269
0 votes
1 answer
155 views

Intercept network traffic with a hub [closed]

If I plugged a hub inbetween a switch and firewall, that also had a device running wireshark or similar capture software connected, due to the way a hub operates, would I be able to read ALL of the ...
user avatar
  • 103
2 votes
2 answers
152 views

Is using a network sniffer for host discovery a viable option?

Would a packet sniffer like tcpdump be effective for network host discovery and if so how effective is it compared to more active methods such as the infamous network mapper nmap?
user avatar
0 votes
1 answer
419 views

Can Snort or Suricata *edit* packet on the fly?

I know that they can detect traffic by rules, but can they modify packets on the go? For example, not only detecting HTTP GET but also adding headers to the GET packet. If they can't, is there an ...
user avatar
  • 1
-1 votes
1 answer
238 views

IP suite packet integrity [closed]

Finally, while the IP header contains a noncryptographic checksum for verifying the integrity of the header, there is no attempt to do the same for the payload. Source(Introduction to Computer ...
user avatar
25 votes
2 answers
7k views

Why is my computer making requests to my Roku about spotify?

I'm new to inspecting packets with Wireshark so this might be something very stupid on my part. That said, I don't really understand the transaction between my computer and my Roku. 17 1.129097 ...
user avatar
  • 343
1 vote
2 answers
256 views

Please help diagnose multiple incoming packets

We have an internet-facing router and it is significantly slowed down. We investigated the network traffic and came up with following information: All the packet size is same (i.e. 40 bytes) All ...
user avatar
  • 13
4 votes
2 answers
8k views

How to intercept http/https requests done by an Android app in plain text? [duplicate]

When I give an android app internet permission and read access to my files, malicious software can send my personal data (pictures and video) to a remote server without me being aware of it. Is ...
user avatar
  • 185
3 votes
2 answers
2k views

How wireshark capture packets in LAN without arpspoof?

I created a lab environment which has Windows 7 and Kali Linux in VMware. In Kali Linux, I opened Wireshark and started to listen to traffic on eth0. After that, in my Windows 7 machine, I opened an ...
user avatar
0 votes
0 answers
92 views

Detecting network attacks by processing individual or multiple network packets?

I am trying to create a tool that identifies network attacks using machine learning, something like a small intrusion detection system. I have collected benign traffic from the network and then ...
user avatar
  • 659
1 vote
1 answer
2k views

How to pass a localhost check for an incoming request?

I'm trying to send a request to an http server hosted on a machine. The http server is in C# and drops any packets that are not from localhost: public void Request(HttpListenerContext context) { ...
user avatar
  • 239
1 vote
1 answer
69 views

How harmfull might be predictable bytes when using AES-CTR

I use AES-CTR to perform on the fly encryption of packets. Each packet is 16 bytes long, however, depending on what is being transferred, the 16 bytes may not be used. So far, unused bytes are left to ...
user avatar
4 votes
0 answers
922 views

How can I get Suricata to alert on 1 packet every time

I am trying to write a Suricata signature for testing purposes to alert every time it is triggered with a single PCAP file containing a single packet, but this is proving to be harder than I thought. ...
user avatar
  • 2,266
0 votes
1 answer
183 views

Are Routers Liken to a Firewall? [closed]

When my ISP came to set up my fiber internet, I told the technician I didn't want a router included within my wired network. He successfully managed setting up the ONT(Optical Network Terminal) ...
user avatar
  • 33
1 vote
0 answers
42 views

Decrypting 802.11 packets captured through wireshark [duplicate]

I created my own network with security of WPA2-PSK, so I know the SSID, and password. I then connected 2 devices (A and B) to this network and started capturing B's traffic from A using wireshark in ...
user avatar
  • 11
1 vote
2 answers
118 views

What is this address I received from wireshark?

______source____________destination___ 41:9c:7f:78:b1:0c | 08:00:d0:58:59:4c I am trying to identify those addresses, the source and the destination, I thought it was IPv6 but then I realized it'...
user avatar
  • 133
-1 votes
1 answer
462 views

Why would the amount of packets received be greater than the amount of packets sent? [closed]

I am new to wifi, and as I was looking at .pcap files, I noticed that one connection took an absurdly large amount of time. Another thing that stood out is that the amount of packets received was so ...
user avatar
  • 1
1 vote
1 answer
140 views

Identify Network of Wireless Packet

When sniffing wireless packets from multiple networks, how do you tell which network a packet belongs to? The best guess I have right now is that you need to see the handshakes and get the mac addr ...
user avatar
  • 113
2 votes
1 answer
447 views

Security implications of setting the broadcast flag on a UDP socket

Are there any negative security effects of setting the SO_BROADCAST option in a C UDP socket? I'm writing a C program and if I just set the broadcast option to 1 then all IP addresses work as intended,...
user avatar
  • 602
1 vote
0 answers
144 views

Small data exfiltration protocol?

I have a small amount of data I want to send at regular intervals, such as from an IoT device. How would I design a network protocol or use existing protocols in such a way that my ISP cannot block ...
user avatar
  • 111
2 votes
1 answer
420 views

From a PCAP file determine if the address has been spoofed?

Reading about the tool hPing, it is possible to spoof an internal address, on the detection side of this how would one go about detecting this? are there tell-tail signs? EDIT: thinking about it, ...
user avatar
  • 1,155
1 vote
2 answers
706 views

Is there a way to tell, when looking at a packet, that an aircrack-ng attack happened?

I'm trying to understand how to find these attacks when using a packet sniffer (specifically using Omnipeek). Is there a way to look at a packet and know that this type attack happened? I want to find ...
user avatar
3 votes
2 answers
7k views

Stopping, editing, then sending packets in Windows 10

I was wondering if there was a way to stop a packet, edit what you want, then send it, like a MiTM attack. Example: 10.0.0.1 has a ncat listener (ncat -lnvp 1234) 10.0.0.2 connects to 10.0.0.1 (nc ...
user avatar
5 votes
1 answer
3k views

Why is the SSH maximum packet size 32k?

My question has two parts. First, why must an SSH server have at least a maximum packet size of 32678 bits? It seems a bit excessive for most uses of SSH, excluding file transfer. Is it common for ...
user avatar
1 vote
1 answer
642 views

Why doesn't nmap return open port info when I fragment packets?

I'm performing a scan on a remote host and playing around with the -f flag for nmap when I noticed something I hadn't expected. In amongst the other data, when I type nmap -v -O <hostname> I get ...
user avatar
1 vote
1 answer
874 views

Are packets processed by a proxy new or modified?

Client ---> First packet ---> Proxy ---> New packet? ---> Server If we speak about proxy systems, does the first packet get discarded and a new packet gets created, or it's still the ...
user avatar
  • 1,498
1 vote
0 answers
328 views

Displaying a report of top visited websites per period (HTTP and HTTPS) [closed]

I have a MikroTik router that connects to a network with multiple endpoints. All the WAN traffic flows through this router and I would like to be able to monitor (not necessarily filter) the ...
user avatar