WireShark is not capturing my PCAP file I replayed using Tcpreplay?
One of my metrics is to test out Wireshark's accuracy of packet captures. I want to replay the pcap file I have with the images I know I have inside it on my eth0 network. I set up Ettercap, Wireshark and sleeted my targeted hosts. however wireshark cannot even track the attempt of pcap files
please advise what I have missed here
Yes, Wireshark can capture other packets such at http and ftp sessions without Tcpreplay. i set up a virtual box on my MacBook Pro. I am accessing wireshark through kali as its preloaded. version 2.6.8. by other tools do you mean like tool as in Xplico. on the terminal I run tcpreplay --intf1=eth0 pcap.pcap
the packet states its sent, but not been detected on wireshark.
do you think I may need to set an IP address in the pcap files or can I set an IP address on command line when typing up the tcpreplay?
Take a closer look at what
tcpreplay
is sending:Exclude Wireshark from the initial testing. Use
tcpdump
on the same machine runningtcpreplay
(excluding port 22 if you are connected with ssh)Once it's working with
tcpdump
then try the capture with Wireshark.Verify that the capture interface is running in promiscuous mode.
If Wireshark is not running on the same machine as
tcpreplay
then check here:https://wiki.wireshark.org/CaptureSet...
for information on setting up a SPAN port if needed.
thank you. I reinstalled kali and tested tcpdump to capture pcap.pcap with and it worked. afterwards I tested it with wireshark and it captured all imaged and files within my pcap file.