I am a complete novice to this... I have a webcam behind my router, and it's configured to be accessible on a particular port (e.g. 30000) using a port forwarding configuration. It has a fixed IP in my network.
Using wireshark, I can see the camera responding to requests coming from within my network (i.e. another client), and this does not use port forwarding.
However, when I access the camera from outside my network (i.e. using external IP plus port), wireshark does not show anything (but I see the camera streaming on the client).
I use wireshark on ubuntu, eth0, and ip.addr == 192.168.x.y as filter
When the camera was streaming data to the internal client, were you also capturing packets with Wireshark on that same client? I'm guessing that you were, which is why you saw the data.
When the camera streams to a client on an external network, the stream flows through the router, but your client is likely plugged into another switch port on the back of your router, and the router doesn't forward the packets to that port, which is why you don't see them.
In order to observe the packets, you would need to configure your capture PC such that it can capture the packets. There are a few different methods to achieve this, for example, using a hub, a SPAN/mirror port on a managed switch if you have one, or a TAP. I would recommend reading the detailed information available on the Wireshark Ethernet capture setup wiki page, which describes several different methods for successfully capturing Ethernet frames and provides helpful pictures as well. Choose a capture scenario that best meets your needs (and $$ budget).
Related
just started with wireshark and tcpdump,
they both work fine if I capture traffic on my IP but doesn`t capture anything on other sources (other IP on my network)
my setup : 1 pc running windows 8(ip 192.168.0.2), 1 laptop running ubuntu(192.168.0.3).
Both connected to a cheap unmanaged 5 port switch , that is connected to my router.
Both wired, even tried with the laptop on wireless mode.
if I run tcpdump on my laptop with filters: host 192.168.0.2(computer IP add) it does not capture anything!
Same if I run wireshark on my computer but use filters such as dest 192.168.0.3 (laptops IP)
Tried tcpdump with net 192.168.0.0/24 (should be capturing traffic from my whole network)... same result , captures only traffic that is destined to my IP (laptop from witch I am runing the command)
Tried setting to Promiscuous ON , on both the laptop and pc , same result.
Any ideea why I am not being able to capture anything from other IP addresses?
"Both connected to a cheap unmanaged 5 port switch"
As you've already discovered, your current capture setup won't work. From the Wireshark CaptureSetup/Ethernet wiki page:
In addition, if you are on a switched Ethernet, rather than a shared
Ethernet, you will also have to take action to ensure that all traffic
in which you're interested is sent to the Ethernet adapter on the
machine running the packet capture program; that is not, by default,
the case on switched networks, so attempts to capture on a switched
network will, by default, see only traffic that the capturing machine
would see when not in promiscuous mode.
Refer to that same page for a number of solutions, including using a TAP, a managed switch, or even a hub (if you can even find one and have no other choice), just to name a few.
In addition to the Wireshark wiki page, I'd also highly recommend reading the very talented Jasper Bongertz's 6-part Network Capture Playbook series:
The Network Capture Playbook Part 1 – Ethernet Basics
The Network Capture Playbook Part 2 – Speed, Duplex and Drops
The Network Capture Playbook Part 3 – Network cards
The Network Capture Playbook Part 4 – SPAN Port In-Depth
The Network Capture Playbook Part 5 – Network TAP Basics
The Network Capture Playbook Part 6 – Planning Network Troubleshooting
I want to send small (a few bytes) data from one ESP8266 to another over long distances.
I believe the signal is too weak to connect one ESP8266 to another but maybe they can receive small messages with some delay?
How can I achieve that using arduino-esp8266 library (or whatever)?
If ESP8266 boards can not connect directly to each other because of the weak signal (approximately more than 50m between them) you can still connect them to each other (indirectly) if they are connected to the same WiFi network created by external router or internet. But you can connect them to each other without need to connect to any external network only if they are in range of each other.
It both of them are connected to same local WiFi network router you can communicate between them as if they are connected directly to each other. Just in this case router option "WiFi Client isolation" must be disabled in router settings page for boards to see each other(in case that router has this or similar named option).
Otherwise if ESP boards are connected to totally different networks, but both of these networks have access to internet, you can still connect them to each other but then you must use port forwarding on each router, so both of the ESP8266 boards are visible form internet. Google a bit about it, it is not so complicated. In this case you can have boards on any two locations in the world and make them communicate to each other as long as they are accessible from internet.
Maybe it is hard to test it when your code do not work out of the box, so I would recommend that you use some TCP or UDP terminal to test connectivity between two WiFi clients on different or same network. There are buch of such terminals available online.
For example for sending and receiving UDP packets same way as you would send/receive data from serial port, I use Docklight Scripting.
https://docklight.de/downloads/
I actually use it also for other Serial port communication so no big difference there. Don't let description text on their page fool you. It can also send/receive TCP/UDP data :)
Just when you create new project go to tools->project settings and type IP and port of another device you want to connect with (this can be another PC running docklight scripting or your ESP board). For example in my case I type in
Send/Receive Comm.: UDP:192.168.0.154:9761
Because that is the IP of my ESP board on local WiFi network and press "play button"or F5. Now you can send receive data to your board using UDP in same way that you communicate to basic serial port and in such way test basic connectivity. Or even use two laptops just to confirm connectivity between two WiFi clients on network.
And third hardest option must most versatile is needed if you do not have access to routers setup page (they are password protected) and cannot set port forwarding, then you must create server application on some server that is visible from internet and has public IP. So both of your ESP8266 boards are connected to this server as clients (for client port forwarding do not need to be set but in this case you must have access to internet by both clients) and server can forward their messages to each other. But this is way out of this topics scope. Maybe for start you use TCP/UDP terminal just to check connectivity between two WiFi clients and see if ESP8266 can communicate directly or not. Docklight scripting is just suggestion because it is my personal choice for TCP/UDP/RS232/RS485/MODBUS/USB HID, but you can use other software for this.
I hope this helps a bit about ways to connect two ESP8266 boards indirectly.
I'm trying to write a simple C code with WinPcap to broadcast a beacon packet and capture it in all nearby WiFi units. The code I'm using is very similar to the ones available at WinPcap[1].
The code runs fine if I create an ad-hoc network connection and join all the computers into it. However, this process of creating and joining to an ad-hoc network is cumbersome. It would be much better if, regardless of what network each computer is in, the beacon packets would be broadcasted and captured once the code is running.
As simple as this problem might sound, after some searching it seems that this is not possible to be done on windows (unless re-writing drivers or maybe the kernel):
Raw WiFi Packets with WinPcap[2]
Sending packets without network connection[3]
Does winpcap/libpcap allow me to send raw wireless packets?[4]
Basically, it would be necessary to use the WiFi in monitor mode, which is not supported in Windows[5]. Therefore, if the computers are not in the same network connection, the packets will be discarded.
1st Issue
I'm still intriguing, beacon and probe request packets are a normal traffic across the network. How they could be being sent and received constantly but the user is not allowed to write a program to do so? How to reconcile that?
2nd Issue
Does anyone has experience with Managed Wifi API[6]? I've heard that it might help.
3rd Issue
Acrylic WiFi[7] claims to have developed a NDIS driver which support monitor mode under Windows. Does anyone has experience with this software? Is it possible to integrate with C codes?
4th Issue
Is it possible to code such Wifi beacon on Linux? and on Android?
www.winpcap.org/docs/docs_412/html/main.html
stackoverflow.com/questions/34454592/raw-wifi-packets-with-winpcap/34461313?noredirect=1#comment56674673_34461313
stackoverflow.com/questions/25631060/sending-packets-without-network-connection-wireless-adapter
stackoverflow.com/questions/7946497/does-winpcap-libpcap-allow-me-to-send-raw-wireless-packets
en.wikipedia.org/wiki/Monitor_mode#Operating_system_support
managedwifi.codeplex.com/
www.acrylicwifi.com/
Couple questions I will try to answer. Mgmt and Ctrl packets are used for running a wifi network and don't contain data, I would not call these normal packets. Windows used to(I think still does) convert data packets into ethernet frames and pass it up the stack. Beacon and Probe Req pkts are not necessary for TCP/IP stack to work, ie. web browsers don't need beacon frames to get your web page. Most OS's need minimal info from mgmt/ctrl pkts to help a user interact with a wifi adapter, most mgmt/ctrl pkts only are useful to the driver(and low level os components) to figure how to interact with the network. This way the wifi adapters look and act like ethernet adapters to high level os components.
Never had any experience with Managed Wifi API or Acrylic, so can't give you any feedback.
Most analyzers that capture and send packets do it in 2-3 separate modes mainly because of hardware. Wifi adapters can be in listen mode(promiscuous mode and/or monitor mode) or adapter mode. To capture network traffic you need to listen and not send, ie. if someone sends a pkt while you are sending you miss that traffic. In order to capture(or send) traffic you will need a custom NDIS driver in windows, on linux many of them already do. Checkout wireshark or tshark, they use winpcap to capture pkts in windows and there are some adapters they recommend to use to capture pkts.
Yes it is possible to send a beacon on linux, ie. Aireplay. I know its possible to capture traffic on Android but you it needs to have rooted or custom firmware, which I would believe also means you can send custom pkts. If you are simply trying to send a pkt it might be easier to capture some traffic in tshark or wireshark and use something like aireplay to resend that traffic. You could also edit the packet with a hex editor to tune it to what you need.
When creating a peer to peer audio connection using webRTC, the STUN server we use will return the public IP if a user is behind a router. Now in the ICE objects, I can see that the rport is always something between 50000 and up.
Is there a way to use a specific port so that the user does not have to open all those ports?
Is there a way to use a specific port so that the user does not have to open all those ports?
I think you have a misunderstanding. The whole point of STUN and ICE (including its WebRTC derivative) exists to avoid anyone having to open a port on their NAT. Instead, STUN and ICE dynamically open the port.
Here's how it works (in a really brief description).
Client opens a socket on a random port (e.g. 50001)
Contacts STUN server using that socket to discover the external IP:port mapping for this socket. (e.g. 192.168.1.2:50001 maps to 1.2.3.4:50001). Ports don't necessarily have to match between internal and external addresses, but they usually do, so I'll keep with that for this example.
Through an external mechanism (SIP, XMPP, Jingle, cups with strings), the candidate address list of both nodes are exchanged. This includes all known internal and external addresses collected (e.g. 192.168.1.2:50001 and 1.2.3.4:50001).
Using the same socket opened in step 1, both sides send (STUN) messages (UDP packets) directly between each other. The first pair of messages may be blocked by the router/firewall. But because one side initiated an outbound packet to the remote address, subsequent packets from that address are allowed back in. This is called the "hole punching step". Hence, the port is dynamically open without the router needing any specific configuration.
Hope this helps.
You can't programatically unless you are using webrtc API in your own application. The browser will pick specific local ports from a range locally; and then it will inform you about them in the SDP and ICE candidate information.
STUN server only helps discover whether a client is behind a NAT/firewall; and then ICE uses this information in establishing peer-to-peer connection.
I have heard somewhere there might be a way to control that port range via Chrome policy templates(used by enterprises to restrict Chrome settings) - http://www.chromium.org/administrators/policy-templates. It might worth looking into...
in my college lab all the PCs are connected via LAN by L2 switch. i want to capture the http data packets by wireshark but it is only showing the interface of my own PC. so how can i capture the packets of other PCs.
can somebody tell me working of wireshark?
It is in the nature of switches that you will only see either broadcast packets or traffic that has your MAC address as a destination, that is one of the crucial differences between a switch and a hub.
It is possible for most switches to be configured to copy traffic from one port to another, this is commonly done for monitoring purposes, but that has to be done via administrative access to the device.
You can manipulate the switch's behavior by means of ARP-Spoofing. But be cautious! Doing so might be seen as a criminal act.
So be sure that you're allowed to do so in the lab, sometimes that's OK if it serves the educational purpose. Ask your supervisor or the school's administrator.
My weapon of choice for such things is Ettercap.
A far less intrusive approach would be to use one of your own switches and configure it to forward all traffic. Then you can connect one port as an uplink to the lab's switch, one port to the device under test and one port to your machine running wireshark. (I would recommend using tcpdump for capturing, though.) If you don't have a manageable switch at hand, you can also use a router running OpenWRT.