Questions tagged [packet]
Network packet consisting of routing information and a payload. Most commonly an Internet Protocol (IP) packet. For questions about packet vulnerabilities, or tools like wireshark that directly manipulate packets. Related tag: [network].
161
questions
1
vote
1
answer
1k
views
Are packets processed by a proxy new or modified?
Client ---> First packet ---> Proxy ---> New packet? ---> Server
If we speak about proxy systems, does the first packet get discarded and a new packet gets created, or it's still the ...
- 1,578
1
vote
0
answers
443
views
Displaying a report of top visited websites per period (HTTP and HTTPS) [closed]
I have a MikroTik router that connects to a network with multiple endpoints. All the WAN traffic flows through this router and I would like to be able to monitor (not necessarily filter) the ...
4
votes
1
answer
18k
views
Proxying MetaSploit through BurpSuite
I was wondering how I would be able to proxy MetaSploit through BurpSuite.
I was to reverse engineer a packet being sent to my ChromeCast, but I have no way of viewing the packet.
Thanks.
- 121
0
votes
2
answers
348
views
Any way to know if a sniffed packet contains a downloaded file?
Is there any way, using TCPdump, Wireshark or any library based on that, to know if someone is downloading a specific file, for example abc.exe, by inspecting the http packet? http, not https
- 35
4
votes
1
answer
509
views
How to inspect TCP Header -> Optional Data with Snort?
I have been looking around for clues on how to define rules, decoders or preprocessors to be able to content-inspect the TCP Header's Optional Data ( The last 0-40 bytes of the TCP Header)
TCP Header
...
user145785
4
votes
1
answer
178
views
Would it be possible for an ISP to guess specific requests on an HTTPS site using package size? [duplicate]
In light of the recent senate decision in the US to allow ISPs to sell users' browsing history, I've been reading of recommendations on how users can retain their privacy. One of the common ...
- 204
4
votes
2
answers
1k
views
How does ndpi actually detect the HTTP protocol?
I have been digging the ndpi codebase and trying to understand how its actually detecting the HTTP protocol.
What I found so far is that they are searching the request type in the payload and if not ...
- 145
2
votes
1
answer
2k
views
Tracking a backdoor by recording packets
I am by no means very bright when it comes to networking. But I know a bit.
Let's say I suspect a backdoor is on my pc.
To counter it I setup a device between the router and my pc to log everything. ...
- 23
0
votes
2
answers
522
views
How much traffic can a firewall node handle? Any real examples? [closed]
As a part of my research, I need to determine the maximum packets (Internet traffic) can one instance of firewall/ IDS process. I am not sure where to begin though.
Your assistance and guidance in ...
- 19
18
votes
3
answers
5k
views
Is it possible to see a packet before encryption?
I mean, if I am, for example, on Facebook, every packet I send out of my NIC is encrypted. But there must be phase of that packet before it is encrypted. The browser (I think) must create that packet ...
- 792
2
votes
1
answer
618
views
Eavesdropping on a specific port of machine in the WLAN from a different machine, possible? (using arpspoof)
I'm using netcat -l 555 option to communicate between two computers(Linux) on port 555, is there any way I can eavesdrop to whats going on in that conversation from a 3rd computer?
After the second ...
- 131
0
votes
2
answers
241
views
RSSI of wifi device MITM detection
Let's say there is someone doing some malicious activity on your network and you want to track the packet's signal strength to catch the attacker.
Is this theory plausible?
- 3
3
votes
2
answers
1k
views
How can I tell which process is generating SYN traffic to localhost?
In Wireshark, on the loopback interface, I can see SYN requests from localhost to closed ports on localhost that are being responded to with RST, ACKS.
I'm curious what's generating the traffic. How ...
- 235
2
votes
3
answers
309
views
Who can sniff my packets?
If I make a call to some server who can sniff my packets?
Obviously anyone who is on my network can sniff, but on the server side also?
My call will make several hops to the destination server, can ...
- 21
4
votes
1
answer
2k
views
In TCP, what happens when two Data packets come in with the same sequential identifier, but different data (spoofed)
I'm trying to verify an answer I posted to a recent question:
Client A with real IP has connected ... Now, the attacker machine M sends a [data] packet [with a correct sequential identifier] ...
- 14k
2
votes
3
answers
3k
views
IP Spoofing with real IP when TCP 3-way handshake has been made
In a situation, where the spoofed IP is a real existing remote IP and it is found that the TCP 3-way handshake has been made with a server.
The MiTM machine sends the packet with spoofed IP to the ...
- 121
2
votes
0
answers
169
views
Trying to reproduce MiTM attack
Firstly, I would like to clarifiy 2 points:
I have hesitated between posting here or on stackoverflow. I don't really understand if it is my code or some kind of security on my router. So, if you ...
- 2,924
1
vote
1
answer
1k
views
Do network packets capture what gets encrypted in a device?
Do network packets capture what gets encrypted in my device before it gets sent to the host? For instance.
In instagram when you log in from a mobile device. You submit a post request. In that post ...
- 13
1
vote
1
answer
6k
views
How to identify a machine by its IP address in wireshark?
I'm new to the world of security and I'm trying to figure out how to analyze the network traffic on my home wifi network. I've been watching a lot of tutorials and reading about how to use wireshark. ...
- 113
6
votes
1
answer
3k
views
When should I generate new public & private keys using RSA?
I'm creating a huge, online mobile game. I have a few questions for you guys because my knowledge in cryptography and sending data across the network securely is kinda poor.
Some details:
Each user ...
- 212
1
vote
1
answer
1k
views
UDP replay "attack"
Suppose that there is a client-server application using UDP and you have full control over client. The task is to automate few known actions on the client and make them very fast.(Possibly bypass ...
- 13
3
votes
1
answer
2k
views
Network packet obfuscation
Suppose I am wirelessly transmitting network traffic between a computer and a router. As I understand it, even though the traffic is encrypted, it is possible for a third party attacker to intercept ...
- 133
2
votes
2
answers
4k
views
Iterate through and decode Dot11Elt layers -- Scapy
OBJECTIVE
I want to iterate through the Dot11Elt layers of a beacon frame that I captured with Scapy. I also want to decode the .info of each ID layer.
def packet_handler(packet) :
if packet....
- 345
0
votes
2
answers
742
views
Does wireless card need to be on same channel as AP to sniff beacon frames?
OBJECTIVE
Essentially, my goal is to emulate something like airodump-ng wlan0
Here is a link just in case ... airodump-ng
Collects raw 802.11 frames
Displays nearby access points and data
GAMEPLAN ...
- 345
5
votes
1
answer
6k
views
Sending Probe Request Frames | Receving Probe Response -- Scapy
OBJECTIVE
Send probe request frame subtype=4 and receive probe response subtype=5 with Scapy
Ultimate goal is to detect access points nearby via Scapy ( not by sniffing beacon frames )
The object ...
- 345
2
votes
3
answers
513
views
Receiving packets from Amazon
I ran a Wireshark packet capture on my home Windows PC, as there was some suspicion that I was infected (although I notice nothing out of the ordinary and both Avast and Malwarebytes detect nothing).
...
0
votes
2
answers
146
views
How do Malware Analysts detect spoofed information?
Although I am fairly new to the industry (3rd internship at a financial institution), I am sure most people have heard and understand the concept of spoofing information, like a sender IP, or MAC ...
- 1,595
0
votes
1
answer
5k
views
does openssh have a maximum packet size?
RFC 4253 says of SSH:
6.1. Maximum Packet Length
All implementations MUST be able to process packets with an uncompressed payload length of 32768 bytes or less and a total packet size of 35000 ...
- 203
2
votes
1
answer
2k
views
Man-in-the-middle packet injection
I'm currently studying the possibility of a man-in-the-middle attack in a network consisting of a switch and 3 computers:
Server/Host
Client
Man In The Middle
The server and the client will change ...
- 123
1
vote
2
answers
5k
views
Packet Filter vs Application proxy
http://postimg.org/image/b1w3bujnv/
I don't understand the highlighted part in red.
Firstly,Why is a packet filter is enough in a situation where traffic is busy?
Secondly,Isn't application proxy ...
- 145
1
vote
2
answers
118
views
Application proxy structure & functions
http://postimg.org/image/76newirnv/
For application proxy,
Firstly, what does it mean "A proxy is something that acts on your behalf"? Can anyone give a more detail explanation about proxy? I read ...
- 145
0
votes
2
answers
510
views
Stateful Packet Filter structure
http://postimg.org/image/o1ojanqq3/
For stateful packet filter,
Firstly, why is cannot see application data being one of the disadvantages of Stateful Packet Filter?
Secondly, how can stateful ...
- 145
0
votes
1
answer
282
views
Packet Filter with Access Control List
Can anyone explain how to read and understand row 1,2 and 3?
My understanding for row 1 is : If any inside packets want to go to outside via any source port to destination port number 80 using HTTP ...
- 145
9
votes
4
answers
73k
views
How can I extract the certificate from this pcap file?
I have a pcap file of 14 sniffed SSL packets. I uploaded it here:
ssl.pcap
I opened it with wireshark. I see the 14 packets. The largest of seems to contain a self signed certificate (as it is made ...
0
votes
4
answers
877
views
Human readable SSL/TLS packets
If I have a protocol-analyzer/packet-sniffer, such as wireshark installed on a particular device..
(or in this case; tcpdump & tshark etc. on my smartphone..)
..should I be able to read ...
- 1,779
1
vote
1
answer
204
views
Nemesis packets not detected in wireshark/tcpdump
I have been using nemesis for forging fake DHCP request packets on my Ubuntu machine. I get a "packet injected" message each time I inject it. However I was not able to analyze it on wireshark as my ...
- 155
1
vote
1
answer
1k
views
How to modify UDP packets in checksum field?
Stephen Northcutt, SANS Director, make a pcap contest (see here) where the .pcap file had a hidden information in checksum field. I solved it using wireshark and it was an interesting activity.
So, I ...
- 313
13
votes
1
answer
9k
views
Wireshark tcp filter: tcp[((tcp[12:1] & 0xf0) >> 2):4]
While reading this doc https://wiki.wireshark.org/CaptureFilters I found this line:
tcp[((tcp[12:1] & 0xf0) >> 2):4]
which figures out the TCP Header Length, but I can't find out how it ...
- 133
2
votes
2
answers
129
views
Is my computer getting attacked? [closed]
Would anyone be able to have a look at the pcap from my computer? I am thinking my computer get attacked by a process and keeps sending out packets from my computer to DoS my network.
I get errors ...
- 21
2
votes
1
answer
2k
views
Tap-mode IPS vs IDS
It is my understanding that tap mode IPS, unlike in-line mode, is passive and cannot prevent attacks.
In that case, what is the difference between an IDS and a tap mode IPS? I've checked out several ...
- 739
2
votes
2
answers
1k
views
Code injection using packet modification
Is code injection possible through packet modification?
For example, if a game sent a packet declaring score=99 could I then modify the packet to score=*code* or something similar?
I guess a ...
- 21
5
votes
2
answers
273
views
Malicious packet that attacks packet sniffers?
Is it possible to crash a packet sniffer through a specially-formed packet to stop website administrators from tracking down the source? If it is possible, has it been done before? Or is it just not ...
- 53
2
votes
2
answers
415
views
Sniff network packets that don't talk to my computer?
How would one sniff wireless network packets that do not pass directly through my computer- without access the the AP or router?
I want to be able to sniff for network traffic (even while ...
- 93
4
votes
1
answer
164
views
Basic question about how an IDS works
Would the location of an Intrusion Detection (or Packet Analysis) sensor on an internal network impact whether the external host's Source IP (assuming inbound TCP traffic) is retrievable from a packet?...
- 324
0
votes
1
answer
306
views
Decrypting packets sent from a server to a client, how to figure out the key, having both decoded packets and encoded packets
I have written a packet sniffer which succesfully intercepts all the packets sent from a server to my computer.
The problem is that the packets are encrypted(of course) and i need to decrypt them.
An ...
- 13
1
vote
2
answers
1k
views
How eavesdropping attack takes place in network
I am learning some concepts of network security and I have the following question:
One case of eavesdropping attack is that an adversary somehow places himself inside a network to order to capture ...
- 423
0
votes
1
answer
3k
views
Transfer of packets in a VPN connection
I am trying to figure out how a computer communicates with a website when using a VPN connection (specifically, how packets are transferred) as compared to a computer that's not using a VPN connection....
1
vote
1
answer
507
views
How can I put in relation http timestamp with country time zone of the IP?
I have a series of packets within a PCAP files,
among them I'm getting packet with HTTP protocol.
starting from IP address I get the timestamp in GMT format and the time zone, for example:
Source IP:...
- 167
1
vote
1
answer
878
views
Scapy WPA2 packet forging
Can I use scapy to forge custom packets on WPA2 network? Can I even pack the IEEE 802.11 headers?
- 155
2
votes
3
answers
4k
views
Deep Packet Inspection SSL : How DPI appliances prevent certificates warnings?
How Deep packet inspection (DPI) tools prevent from certificates warnings through decrypt and re encrypting packets ?
- 41