EzDevInfo.com

sniffing interview questions

Top sniffing frequently asked interview questions

Can you sniff packets of an open wifi network that you are not connected to?

I mean, just see all the packets going though the air.. is this possible with Wireshark, for example?


Source: (StackOverflow)

RS232 Packet Sniffer

I'm working on a software development project that requires me to send signals to a device via RS232 port. Sadly the included utilities for transferring to and from the device would not work for mass distribution, so I'm left to writing my own. The included documentation doesn't really give any examples of the device's packet structure, and I would like to examine the packets sent to and from their included software package.

Does anyone know of a good program that would allow me to monitor packets coming to and from the serial port? Free is preferred, but not required.


Source: (StackOverflow)

Advertisements

How do I return just the Http header from tshark?

I'm using tshark to sniff my packets and I'm only concerned with the http header (preferably in the form its sent, but I'll take what I can get).

I tried using:

tshark tcp port 80 or tcp port 443 -V -R "http"

Which gave me the header, but also content (which I don't want as its a large amount of garbage to parse). I really only care about the header, is there any easy way to get just that (other than parsing the data myself).

Edit: I should qualify I also care about host/port so I can keep track of requests across multiple packets.


Source: (StackOverflow)

Is there a popular application for Windows 7 to find nearby WiFi networks?

I was wondering if we can use a third party program, besides "Network and Sharing Center," to find WiFi networks.

Is there a popular and recommended application for Windows 7 that finds WiFi networks?


Source: (StackOverflow)

Windows tool to find out which port an app is trying to use?

I am guessing that netstat shows apps and their ports that already have a connection and it doesn't show or can't show an app that is trying to open a connection.

If I have an app that's trying to connect to the net but is blocked by a firewall, how do I know which port it's trying to use?


Source: (StackOverflow)

Looking for HTTP debugging proxy for Mac similar to Fiddler on Windows [closed]

In previous jobs when I've worked on a Windows machine, I've used Fiddler for viewing HTTP transactions and debugging.

I'm specifically looking to monitor the HTTP transactions for an ajax site I'm working on to verify that the site is doing what I expect. Rewriting HTTP (as provided by Fiddler) is a nice-to-have, but not essential.

Can anybody recommend something similar for use on a Mac?


Source: (StackOverflow)

How can I capture packets going from my router to a specific server?

I have a small local network in my house that has two computers connected to a modem-router. I want to capture the packets going from the router to a specific server (I know the IP address of the server).

The router's manufacturer is D-Link.


Source: (StackOverflow)

Wireless Card that supports promiscuous mode in Windows 7

I'm trying to use wireshark to learn a bit about networking and capturing packets. However, from what I understand, the combination of windows 7 + various wifi chips don't allow the network card to operate in "promiscuous mode". Has anyone had any experience getting this to work?


Source: (StackOverflow)

Unable to capture outgoing traffic with Wireshark on wi-fi network

I'm trying to use Wireshark on Backtrack 5 to capture packets that are transmitted through my home wi-fi network.

I'm perfectly able to capture outgoing traffic from localhost and, it seems, incoming traffic to all the hosts connected to the network, but I'm not able to capture outgoing traffic from these hosts to the net.

Any ideas?


Source: (StackOverflow)

On an unencrypted public wi-fi hotspot, what exactly is a packet sniffer doing to get another computer's packet?

I get mixed results when reading information security articles, some of them stating that in order to do something similar you need to also setup some sort of honeypot with a running access point and local Web server to intercept traffic. Then other articles seem to indicate you don't need that, and you can just run Wireshark, and it will detect all packets being sent on the network. How could that be, and what exactly is a packet sniffer doing to get those packets? Does this involve intercepting wireless signals transmitted over the wireless protocol and frequency via the NIC on the computer running a program like Wireshark?


Source: (StackOverflow)

Chrome browser sending Keep-Alive packets?

I ran Wireshark on my PC and found that my chrome browser was sending LOTS of Keep-alive packets even when there are no sites loaded in the browser, and even when there are no extensions installed!! I don't recognize the IPs that Chrome is trying to contact. Does anyone know what this is all about?

I have three PCs and two out of three exhibit this behavior of sending keep-alive packets. One does not. It's possible that this is due to wireshark settings??

I can post details of the OS, Chrome version and wireshark export for each if necessary but it would get pretty long. So, please let me know if there is any other info I should post that would help determine the cause of this.

Edit

This is embarassing. I can't seem to replicate the problem on either PCs right now! I saved my earlier wireshark logs as .txt files so I'm running wireshark again to capture some .pcap files and I'm not seeing the problem! I get pairs of random keep-alive packets as opposed to 35+ in a row as previously. See http://cloudshark.org/captures/12d73929a99f for what I can log at time of this edited posting.

Earlier text output can be seen at http://pastebin.com/69JSMF7K

Would there be any specific reason that these keep-alive packets happen more often during certain times of the day?


Source: (StackOverflow)

What stops an internet router from sniffing my traffic?

Packets travel through internetworks, and take many routes through internet routers. On each route that forwards traffic to another until reaching the ultimate destination, what stops them from viewing the packets they receive/forward?


Source: (StackOverflow)

Packet Sniff over Wi-Fi

I've got a non-PC wireless client, and I'm wondering about some of its connections. I want to see the actual packets being exchanged from the net to my device over a Wi-Fi connection.

I have Wireshark running on a PC and am watching traffic go by on the network, but whenever the device loads information from the net, it doesn't show up on the sniffer. I have it set to promiscuous mode, but still nothing.

Does anyone know how to make something be seen by a packet sniffer?


Source: (StackOverflow)

Capturing wireless traffic (using Wireshark)

When I run wireshark on a wired network it works fine and reports all of the packets.
When I run it on a wireless network though I only see my own traffic. The wireless card I have is supposed to support packet capture and go into premiscous mode, but I don't see any other system traffic.

What is wrong?


Source: (StackOverflow)

Capture traffic for specific application

I have an application which communicates with some server. I want to know what the IP of this server is. How can I capture all the traffic from a specific application and not just all the traffic like Wireshark does?


Source: (StackOverflow)