6
votes
Sniffing TCP traffic for specific process using Wireshark
Arbitrary packets are typically not associated with a process. For established TCP sockets, this information could potentially be looked up on-the-fly, but there is no way to express a capture filter ...
- 211
3
votes
Accepted
What checksum algorithm is this network protocol using?
Got it!
The algorithm is a CRC with the following parameters, stored in those two bytes as a big-endian short:
Polynomial: 0x2e97
Xor In Value: 0
Xor Out Value: 0
Reflect Input: True
Reflect Out: ...
- 41
3
votes
Sniffing TCP traffic for specific process using Wireshark
An alternative suggestion to Wireshark as of ~2018, the current Microsoft-developed solution that has superseded Microsoft Network Monitor is Microsoft Message Analyzer.
The latest build of Version 1....
- 131
2
votes
Encoding method of float
This isn't a complete answer but is a bit more than fits in a comment.
There's definitely a pattern in the powers of 2. They all have exactly 4 bits set. The high bit is always 1 and the lower 15 ...
- 2,503
2
votes
Sniffing TCP packets using Wireshark
You can instead try injecting code into the process to dump the raw data before it is encrypted/after it is decrypted.
You can use Google's ssl_logger for that.
You need to run python ssl_logger.py -...
- 141
1
vote
Accepted
Identifying the source of encryption used by UDP packets in a PCAP file
To your first question, you'd have to look at the code. There may be encryption, but some of the UDP packets have very small payloads, and using encryption would slow down packet processing which is ...
- 796
1
vote
Accepted
Where is the CRC16 checksum in a USB BULK IN transfer?
You are apparently using a software capture, usbmon rather than a hardware capture such as OpenVizla, so the CRC is not going to be visible to you. See the USB Analysis 101 video by Tomasz Moń for ...
- 2,521
1
vote
What is the best approach to reverse a custom TCP Application Layer?
at first you need to gather all - and i mean ALL information you can get about everything around the paket producing software/device
some questions:
how big are the pakets - are we talking about +-...
- 336
1
vote
On reverse engineering an udp protocol to control a drone
If you use an android app, you may use network debuggers such as
https://play.google.com/store/apps/details?id=app.greyshirts.sslcapture
this also supports UDP
This might be easier to use/retrieve ...
- 146
1
vote
CaptureBAT equivalent on Windows 10?
Really, if all your after is the procmon filters from CaptureBAT, go to the git hub page and download just them. They will be about a decade old, though. I guess they'll give you a start. You can ...
- 11
1
vote
1
vote
CaptureBAT equivalent on Windows 10?
Alternatively, you can use Microsoft Network Monitor tool to filter the traffic of a specific process.
Archive Download Link:
https://www.microsoft.com/en-us/download/details.aspx?id=4865
EDIT: ...
- 168
1
vote
Accepted
How to reverse engineer mobile app image?
To get an image from an mobile app you first want to know if it is stored on your device or if it is loaded when you log in to your account. In my case it was an profile picture witch will be loaded ...
- 121
1
vote
How to reverse engineer mobile app image?
Wireshark will be ok, if the traffic is not encrypted. Otherwise you'll have to setup a proxy which will do sniffering of SSL traffic. Also the picture may be sent encoded in some application specific ...
- 1,840
1
vote
Sniffing TCP traffic for specific process using Wireshark
On Mac
sudo unbuffer tshark -lni utun1 2>/dev/null |unbuffer -p grep TCP |tee /dev/tty | unbuffer -p awk -v ip=`ifconfig utun1 |grep inet |awk '{print $2}'` '{if($3==ip){print $8}else{print $10}}' ...
- 111
Only top scored, non community-wiki answers of a minimum length are eligible