Collaborate Disseminate
I’ve got a PCAP file that has 3,445 HTTP "206 Partial Content" packets for the application/pdf media type. Each of these requests is for the same file, different Content-Ranges are being requested each time as a covert means of d… Continue reading Why is the output of tshark `http.file_data` different from the Content Length? [migrated]
I was reading a paper, the authors said they converted their netflow files to 2D image. I want to convert my files to 2D images. What is the process?
I am able to search for a string in the in packet bytes of a pcap capture using Wireshark. Is there similar functionality available in tshark ?
I already have the pcap files. But I need to go through them quickly to find the matching strin… Continue reading Search for a string in packet bytes of a pcap file using tshark [migrated]
I have my domain .key and .crt file.
the key file include "—–BEGIN PRIVATE KEY—–"
when i use command on centos:
tshark -r /tmp/xx.pcap -o ‘ssl.keys_list:any,443,http,/tmp/private.key’ -o ‘ssl.debug_file:/tmp/ssl.log’ -Y htt… Continue reading How to decrypt HTTPS traffic with tshark when I have the .key and .crt file?
By Christian Kreibich, Principal Engineer, Corelight The past few weeks have seen several developments around Community ID, our open standard for rendering network traffic flow tuples into a concise textual representation. I’d like to summarize them in… Continue reading Community ID support for Wireshark
By Christian Kreibich, Principal Engineer, Corelight The past few weeks have seen several developments around Community ID, our open standard for rendering network traffic flow tuples into a concise textual representation. I’d like to summarize them in… Continue reading Community ID support for Wireshark
I am using Wireshark to scan for unwanted traffic in my home network. I enabled monitor mode for wlan0 using:
airmon-ng check kill
airmon-ng start wlan0
When I check iwconfig I can see the wlan0mon interface which has monitor mode enab… Continue reading Wireshark doesn’t capture on interface wlan0mon
I have a final year project and I chose honeypot as a subject. The idea is I capture/sniff attacker’s connections with tshark and save the log file. After that I made a script that takes source IPs from the pcap file and sends information … Continue reading Webhook Doesn’t send Slack notification in Python Script
Why would a client send a TLS session ID (96b839ce3aadb65780923d28a3e7e767fc5bddc507884a7e70e506d8b85a06d3 on its first visit to a server/website? My understanding is that the client would include a session ID in the ClientHello message to… Continue reading TLS Session ID from Client’s First Visit
If your current capture process can’t keep up with the traffic and drops packets – you need a new capture process. No debates here. Analyzing a trace file in which you don’t have all the packets of interest will waste your time. You a… Continue reading Tshark: 7 Tips on Wireshark’s Command-Line Packet Capture Tool