How to find Source device details

asked 2018-10-07 17:32:46 +0000

Joe77
1 ●1 ●1 ●1

How much source device details we can get from a captured data? For instance I'm trying to find out the host which is continuously probing on our firewall. So I'm trying to figure out if I can get the type of device which is hitting our firewall, though the connection is dropped by the firewall.

I can see a tab on the packet details > Linux cooked capture > under which there is a "Source" field" like the below which I assume it is the MAC address of the device and the string "Checkpoi" indicates it is sent from a firewall may be Checkpoint?

Any insight is appreciated. Source: CheckPoi_63:86:3a (00:1c:7f:63:86:3a)

Comments

Aren't you confusing your firewall with the CheckPoint thing? I can only assume it's your CheckPoint firewall which generated the capture file. A Linux Cooked capture contains no real data link information, it starts above, with IP information for instance.

Jaap ( 2018-10-07 18:45:19 +0000 )edit

Thanks Jaap. I did some sample captures and I found that the details (like MAC address) I see in the Checkpoint capture file is the next hop internet router's MAC. But the capture do not contains any relevant info about the original source device which is the origin.

Joe77 ( 2018-10-08 12:01:54 +0000 )edit

add a comment

answered 2018-10-09 14:35:00 +0000

cmaynard

11115 ●11 ●317 ●165 https://www.igt.com/

If you want to capture the source MAC address, don't capture on interface -i any. You'll end up with the Linux Cooked Capture like you have now, which won't show you the real MAC addresses of the machine you're capturing from.

Either capture on only one interface, i.e., -i eth0, or if you need to capture on more than one interface, then you can use a sufficiently modern version of Wireshark/tshark/dumpcap that supports capturing from multiple interfaces at once. Such support was added to the Wireshark suite with the release of Wireshark 1.8.0 back on June 21, 2012.

So, how to capture on multiple interfaces at once? With Wireshark, use Control-Click to select more than one interface from the GUI or with tshark or dumpcap, you can just specify as many interfaces as you need with multiple occurrences of the -i option, i.e., -i eth0 -i eth1 …. (You can also use -i with Wireshark too, but I don't think most people typically specify command-line options when launching Wireshark.)

edit flag offensive delete link

add a comment

Your Answer

Please start posting anonymously - your entry will be published after you log in or create a new account.

How to find Source device details

Comments

1 Answer

Your Answer

Question Tools

Stats

How to find Source device details edit

Comments

1 Answer

Your Answer

Question Tools

Stats

How to find Source device details