Ask Your Question
0

How to find Source device details

asked 2018-10-07 17:32:46 +0000

Joe77 gravatar image

How much source device details we can get from a captured data? For instance I'm trying to find out the host which is continuously probing on our firewall. So I'm trying to figure out if I can get the type of device which is hitting our firewall, though the connection is dropped by the firewall.

I can see a tab on the packet details > Linux cooked capture > under which there is a "Source" field" like the below which I assume it is the MAC address of the device and the string "Checkpoi" indicates it is sent from a firewall may be Checkpoint?

Any insight is appreciated. Source: CheckPoi_63:86:3a (00:1c:7f:63:86:3a)

edit retag flag offensive close merge delete

Comments

Aren't you confusing your firewall with the CheckPoint thing? I can only assume it's your CheckPoint firewall which generated the capture file. A Linux Cooked capture contains no real data link information, it starts above, with IP information for instance.

Jaap gravatar imageJaap ( 2018-10-07 18:45:19 +0000 )edit

Thanks Jaap. I did some sample captures and I found that the details (like MAC address) I see in the Checkpoint capture file is the next hop internet router's MAC. But the capture do not contains any relevant info about the original source device which is the origin.

Joe77 gravatar imageJoe77 ( 2018-10-08 12:01:54 +0000 )edit
add a comment

1 Answer

Sort by » oldest newest most voted
0

answered 2018-10-09 14:35:00 +0000

cmaynard gravatar image

If you want to capture the source MAC address, don't capture on interface -i any. You'll end up with the Linux Cooked Capture like you have now, which won't show you the real MAC addresses of the machine you're capturing from.

Either capture on only one interface, i.e., -i eth0, or if you need to capture on more than one interface, then you can use a sufficiently modern version of Wireshark/tshark/dumpcap that supports capturing from multiple interfaces at once. Such support was added to the Wireshark suite with the release of Wireshark 1.8.0 back on June 21, 2012.

So, how to capture on multiple interfaces at once? With Wireshark, use Control-Click to select more than one interface from the GUI or with tshark or dumpcap, you can just specify as many interfaces as you need with multiple occurrences of the -i option, i.e., -i eth0 -i eth1 …. (You can also use -i with Wireshark too, but I don't think most people typically specify command-line options when launching Wireshark.)

edit flag offensive delete link more
add a comment

Your Answer

Please start posting anonymously - your entry will be published after you log in or create a new account.

Add Answer

Question Tools

subscribe to rss feed

Stats

Asked: 2018-10-07 17:32:46 +0000

Seen: 3,732 times

Last updated: Oct 09 '18