LinuxQuestions.org
Share your knowledge at the LQ Wiki.
Go Back   LinuxQuestions.org > Forums > Linux Forums > Linux - General
User Name
Password
Linux - General This Linux forum is for general Linux questions and discussion.
If it is Linux Related and doesn't seem to fit in any other forum then this is the place.

Notices


Reply
  Search this Thread
Old 04-03-2007, 11:46 AM   #1
exl75
Member
 
Registered: Mar 2007
Posts: 54

Rep: Reputation: 15
Question How to capture packets using wireshark


Ive just installed wireshark on my windows XP machine,and Im trying to capture and analyze a packet.The packet is on a Linux box that I have access to.But,at the same time,I have a copy of the same packet in a pdf document on my XP machine.

1)Is it possible to capture the packet from my XP machine to the linux box using wireshark?
2)How can I get that packet into wireshark?
3)Since I have a copy of the packet in a pdf document,can I save it in a text file and use it with wireshark? or is there a way to save the file in a different extension so that I can use it with wireshark? Im kinda stuck.Please help.
 
Old 04-03-2007, 12:52 PM   #2
acid_kewpie
Moderator
 
Registered: Jun 2001
Location: UK
Distribution: Gentoo, RHEL, Fedora, Centos
Posts: 43,417

Rep: Reputation: 1982Reputation: 1982Reputation: 1982Reputation: 1982Reputation: 1982Reputation: 1982Reputation: 1982Reputation: 1982Reputation: 1982Reputation: 1982Reputation: 1982
you have an ip packet in a pdf document?? don't think so somehow. i guess you don't appreciate that "packet" is a technical term for a single entity of IP (OSI layer 3) data.

anyway. wireshark can capture any traffic that is passing through, or to or from the machine you are running it on. just start a captre, select the nic and it will capture the data. that data is then "in" wireshark. you can also capture data to a file using tcpdump and then copy that file to another machien running wireshark and load it like you would open any given file.

again, you do NOT have that packet in a pdf document. no way.
 
Old 04-03-2007, 01:37 PM   #3
exl75
Member
 
Registered: Mar 2007
Posts: 54

Original Poster
Rep: Reputation: 15
Chris,I do have it in a pdf document..proof..here it is:
19:59:32.595590 00:50:56:5c:70:32 > ff:ff:ff:ff:ff:ff, ethertype IPv4 (0x0800),
etc.................

Now,this is the packet that I want to get into wireshark,but it is also on a Linux box.Could you please show me how to tcpdump to a file and then to my machine then I can get it into wireshark.

Last edited by exl75; 04-10-2007 at 11:30 PM.
 
Old 04-03-2007, 02:02 PM   #4
acid_kewpie
Moderator
 
Registered: Jun 2001
Location: UK
Distribution: Gentoo, RHEL, Fedora, Centos
Posts: 43,417

Rep: Reputation: 1982Reputation: 1982Reputation: 1982Reputation: 1982Reputation: 1982Reputation: 1982Reputation: 1982Reputation: 1982Reputation: 1982Reputation: 1982Reputation: 1982
ok, well that's just weird, wy on earth would you have that? certainly not going to get into a real capture file without typing it all out and then some....

well me aside, you can capture to a file using tcpdump by using the -w optoin to send data to a file rather than to stdout. just read the tcpdump manpage for the specific features you're after to suit your own needs.
 
Old 04-03-2007, 02:07 PM   #5
alienux
Member
 
Registered: Sep 2006
Location: Dayton, Ohio
Distribution: Slackware 12, Fedora Core, PCLinuxOS
Posts: 194

Rep: Reputation: 30
If you want to capture packets destined for your Linux machine but capture on a Windows machine, you'll need to make sure that those two machines are connected by a hub. Since hubs broadcast all incoming traffic out all other ports, your XP machine will "see" packets destined for the Linux machine and will be able to capture them. Just put wireshark on the XP machine and start a capture and you'll see all traffic to and from all machines connected to the hub.
 
Old 04-03-2007, 02:09 PM   #6
exl75
Member
 
Registered: Mar 2007
Posts: 54

Original Poster
Rep: Reputation: 15
No,Im not trying to do a live capture.For now,its just getting trying to understand how the whole wireshark,packet capture,and analysis works.Once thats done,I will try to do a live capture and just go from there.

The tcpdump man pages are not helping me out at all....at least so far.
 
Old 04-03-2007, 04:00 PM   #7
acid_kewpie
Moderator
 
Registered: Jun 2001
Location: UK
Distribution: Gentoo, RHEL, Fedora, Centos
Posts: 43,417

Rep: Reputation: 1982Reputation: 1982Reputation: 1982Reputation: 1982Reputation: 1982Reputation: 1982Reputation: 1982Reputation: 1982Reputation: 1982Reputation: 1982Reputation: 1982
well you need to capture somethign live otherwise you have no data to analyze...
 
Old 04-03-2007, 04:07 PM   #8
exl75
Member
 
Registered: Mar 2007
Posts: 54

Original Poster
Rep: Reputation: 15
Im using Putty to rsh to the Linux box.I have High Speed Internet connection that Im using.When I start wireshark,log on to the Linux,I can see 2 to 3 packet captures from wireshark.But,only the cable modem(high speed internet) has packet coming thru it.I dont see any packet from the other ones.Ive tried few things here and there,nothing is working,and Im starting to go nut.
 
Old 04-03-2007, 04:41 PM   #9
alienux
Member
 
Registered: Sep 2006
Location: Dayton, Ohio
Distribution: Slackware 12, Fedora Core, PCLinuxOS
Posts: 194

Rep: Reputation: 30
Quote:
Originally Posted by exl75
But,only the cable modem(high speed internet) has packet coming thru it.I dont see any packet from the other ones.
What are "the other ones?"
 
Old 04-03-2007, 04:56 PM   #10
exl75
Member
 
Registered: Mar 2007
Posts: 54

Original Poster
Rep: Reputation: 15
There are four of them:
1)Adapter for generic dial up and VPN Capture: IP is grayed out,packets grayed out,and packets per seconds grayed out as well.
2)Motorola surfboard5120 USB Cable Modem: it has an IP address,and packets coming in and out of it.
3)VMWare Virtual Ethernet Adapter: Has an IP addr but no packets coming in and out,the packet column is grayed out.
4)Intel 8255x based Integrated Fast Ethernet: Has an IP addr but no packets coming in and out,also grayed out.

I can capture #2,the Motorola,but thats not the packet that I want.Im suspecting its the #3 VMWare Virtual Ethernet Adapter that I want,but I cant capture any packets there cause there is none coming thru.

Last edited by exl75; 04-03-2007 at 05:00 PM.
 
Old 04-03-2007, 05:03 PM   #11
acid_kewpie
Moderator
 
Registered: Jun 2001
Location: UK
Distribution: Gentoo, RHEL, Fedora, Centos
Posts: 43,417

Rep: Reputation: 1982Reputation: 1982Reputation: 1982Reputation: 1982Reputation: 1982Reputation: 1982Reputation: 1982Reputation: 1982Reputation: 1982Reputation: 1982Reputation: 1982
well you've never mentioned vmware in all of this... what's the actual topology you're using here?
 
Old 04-03-2007, 05:14 PM   #12
exl75
Member
 
Registered: Mar 2007
Posts: 54

Original Poster
Rep: Reputation: 15
I installed VMWare longtime ago on my laptop,it has nothing to do with what Im trying to do here.Im connected online via High speed internet and rsh to the Linux box using Putty.Im not using VMWare,its just showing on wireshark for whatever reason.

Last edited by exl75; 04-03-2007 at 05:17 PM.
 
Old 04-03-2007, 05:20 PM   #13
acid_kewpie
Moderator
 
Registered: Jun 2001
Location: UK
Distribution: Gentoo, RHEL, Fedora, Centos
Posts: 43,417

Rep: Reputation: 1982Reputation: 1982Reputation: 1982Reputation: 1982Reputation: 1982Reputation: 1982Reputation: 1982Reputation: 1982Reputation: 1982Reputation: 1982Reputation: 1982
so why would a vmware virtual nic be relevant? again.. what is your topology? ascii diagram maybe...
 
Old 04-03-2007, 05:34 PM   #14
exl75
Member
 
Registered: Mar 2007
Posts: 54

Original Poster
Rep: Reputation: 15
Not quite sure why its relevant,but im sure im not using VMWare for anything at this point.Thats what I see when I bring up wireshark and click on capture interface.My topology has to be the Bus,if I have to guess.

LAPTOP------->MOTOROLA(Cable Modem)-------->INTERNET

Last edited by exl75; 04-03-2007 at 07:39 PM.
 
Old 04-03-2007, 07:41 PM   #15
exl75
Member
 
Registered: Mar 2007
Posts: 54

Original Poster
Rep: Reputation: 15
Has anyone done anything like this before? I cant quite be the first one ever!! I need someone to save me!!!

On my windows XP: wireshark,connect online via cable modem
On a different Network:rsh to a linux box to get network packets.

Now,all I need to do is to have wireshark detect the packet on the Linux box that im rsh-ing to and capture the packets.I can run tcpdump on the linux box,but wireshark is not seeing it at all,and its kinda frustrating I cant figure it out,and no one seems to be able to help.

Or,the other option is to save the packet into a file from the Linux box to my xp machine,then get it into wireshark.Does anyone know how to do that?

Last edited by exl75; 04-03-2007 at 10:13 PM.
 
  


Reply


Thread Tools Search this Thread
Search this Thread:

Advanced Search

Posting Rules
You may not post new threads
You may not post replies
You may not post attachments
You may not edit your posts

BB code is On
Smilies are On
[IMG] code is On
HTML code is Off



Similar Threads
Thread Thread Starter Forum Replies Last Post
tcpdump does not capture all packets logicalfuzz Linux - Networking 1 03-19-2007 01:47 PM
capture tcp packets as non root bobwall Linux - Networking 1 06-16-2006 11:03 AM
Using Tcpdump and Tethereal to capture packets shanu_technical Linux - Networking 3 06-14-2006 09:54 AM
Monitor Mode Capture/Send Packets? jagster936 Linux - Networking 23 05-19-2006 09:16 AM
How to capture & reorder the packets between two PC's Janarthanan Linux - Networking 2 09-04-2005 03:25 AM

LinuxQuestions.org > Forums > Linux Forums > Linux - General

All times are GMT -5. The time now is 12:59 AM.

Main Menu
Advertisement
My LQ
Write for LQ
LinuxQuestions.org is looking for people interested in writing Editorials, Articles, Reviews, and more. If you'd like to contribute content, let us know.
Main Menu
Syndicate
RSS1  Latest Threads
RSS1  LQ News
Twitter: @linuxquestions
Open Source Consulting | Domain Registration