Questions tagged [tcpdump]

Tcpdump prints out a description of the contents of packets on a network interface that match the boolean expression; the description is preceded by a time stamp, printed, by default, as hours, minutes, seconds, and fractions of a second since midnight.

Filter by
Sorted by
Tagged with
0
votes
0answers
105 views

Kioptrix 2: Why netcat reverse shell executed in web browser via command injection bug doesn't work?

I've completed kioptrix level 2 challenge via sql injection, command injection, bash reverse shell, and local privilege escalation as part of my OSCP preparation. https://www.vulnhub.com/entry/...
0
votes
0answers
72 views

Replay pcap with tcpreplay

I'm trying to replay a pcap file recorded from my first server online. In order to make some tests , i successfully changed the IP source and destination, mac source and destination. The pcap file ...
1
vote
2answers
724 views

tcpdump packets have bad and incorrect checksums on localhost, how to investigate further?

Am investigating a macOS Catalina machine that is believed to be infected with malware. Have been viewing packets with tcpdump and noticed, on connecting to any web address, there are legit packet ...
1
vote
0answers
14 views

Capture Packets of other devices in network [duplicate]

I'm challenged to capture packets sent from a client to the gateway in a network. is it even possible to see the packets between client and gateway for me?
1
vote
1answer
257 views

Public Availability of a good Dataset in PCAP (TCPDUMP) format for IDS/IPS testing [closed]

I am trying to pass good reputable malicious traffic from an IPS. There are several sources on internet to explore datasets like the oldest I think DARPA set (not available in pcap format and not that ...
12
votes
4answers
5k views

Eavesdropping vs. sniffing

I'm taking a coursera course, and they take pains when talking about network security to distinguish between eavesdropping and sniffing. According to their definitions, sniffing involves reading or ...
9
votes
1answer
4k views

Wireshark tcp filter: tcp[((tcp[12:1] & 0xf0) >> 2):4]

While reading this doc https://wiki.wireshark.org/CaptureFilters I found this line: tcp[((tcp[12:1] & 0xf0) >> 2):4] which figures out the TCP Header Length, but I can't find out how it ...