Skip to main content
6 votes

Sniffing TCP traffic for specific process using Wireshark

Arbitrary packets are typically not associated with a process. For established TCP sockets, this information could potentially be looked up on-the-fly, but there is no way to express a capture filter ...
Lekensteyn's user avatar
3 votes

Sniffing TCP traffic for specific process using Wireshark

An alternative suggestion to Wireshark as of ~2018, the current Microsoft-developed solution that has superseded Microsoft Network Monitor is Microsoft Message Analyzer. The latest build of Version 1....
gcode's user avatar
  • 131
2 votes

CaptureBAT equivalent on Windows 10?

Alternatively, you can use Microsoft Network Monitor tool to filter the traffic of a specific process. Archive Download Link: https://www.microsoft.com/en-us/download/details.aspx?id=4865 EDIT: ...
Abdullah Mohamed's user avatar
2 votes

Encoding method of float

This isn't a complete answer but is a bit more than fits in a comment. There's definitely a pattern in the powers of 2. They all have exactly 4 bits set. The high bit is always 1 and the lower 15 ...
Ian Cook's user avatar
  • 2,548
2 votes

Sniffing TCP packets using Wireshark

You can instead try injecting code into the process to dump the raw data before it is encrypted/after it is decrypted. You can use Google's ssl_logger for that. You need to run python ssl_logger.py -...
CherryDT's user avatar
  • 141
1 vote

Sniffing TCP traffic for specific process using Wireshark

On Mac sudo unbuffer tshark -lni utun1 2>/dev/null |unbuffer -p grep TCP |tee /dev/tty | unbuffer -p awk -v ip=`ifconfig utun1 |grep inet |awk '{print $2}'` '{if($3==ip){print $8}else{print $10}}' ...
marcobazzani's user avatar
1 vote
Accepted

Identifying the source of encryption used by UDP packets in a PCAP file

To your first question, you'd have to look at the code. There may be encryption, but some of the UDP packets have very small payloads, and using encryption would slow down packet processing which is ...
Mega Tonnage's user avatar
1 vote
Accepted

Where is the CRC16 checksum in a USB BULK IN transfer?

You are apparently using a software capture, usbmon rather than a hardware capture such as OpenVizla, so the CRC is not going to be visible to you. See the USB Analysis 101 video by Tomasz Moń for ...
Edward's user avatar
  • 2,521
1 vote

What is the best approach to reverse a custom TCP Application Layer?

at first you need to gather all - and i mean ALL information you can get about everything around the paket producing software/device some questions: how big are the pakets - are we talking about +-...
llm's user avatar
  • 336
1 vote

On reverse engineering an udp protocol to control a drone

If you use an android app, you may use network debuggers such as https://play.google.com/store/apps/details?id=app.greyshirts.sslcapture this also supports UDP This might be easier to use/retrieve ...
Ben's user avatar
  • 146
1 vote

CaptureBAT equivalent on Windows 10?

Really, if all your after is the procmon filters from CaptureBAT, go to the git hub page and download just them. They will be about a decade old, though. I guess they'll give you a start. You can ...
waydaws's user avatar
  • 11
1 vote

CaptureBAT equivalent on Windows 10?

An alternative to CaptureBAT on Windows 10 is FakeNet-NG.
moveevom's user avatar
1 vote
Accepted

How to reverse engineer mobile app image?

To get an image from an mobile app you first want to know if it is stored on your device or if it is loaded when you log in to your account. In my case it was an profile picture witch will be loaded ...
Timon Post's user avatar
1 vote

How to reverse engineer mobile app image?

Wireshark will be ok, if the traffic is not encrypted. Otherwise you'll have to setup a proxy which will do sniffering of SSL traffic. Also the picture may be sent encoded in some application specific ...
Anton Kukoba's user avatar
  • 1,850

Only top scored, non community-wiki answers of a minimum length are eligible