Hacker News Reader

Comment by taneq | Hacker News Reader

I've used it for a few things:

* To analyze the bluetooth protocol for a smartwatch so I could reverse-engineer a phone app to talk to it

* To intercept a temperature logger's TCP comms and figure out how it talked to the vendor's (crap) server software so I could write a better server for it

* To track down a weird problem where ffmpeg won't stream from my home CCTV system (it turns out it sends a duplicate PLAY command, still haven't figured out why yet...)

* To snoop for IP addresses on my local network in order to find lost devices (eg. when someone else set a device to a static IP address which has since been lost).

It's basically a fantastic Swiss Army knife for any question that starts with "what" and ends with "on the network".

View on HN

We recently used it to troubleshoot a problem where 2-3% of TLS connections on a certain VIP were failing. Turns out a switch inside our cloud provider was zeroing out two bits. (TCP CRCs only protect against corruption on the wire, not corruption that happens _inside_ a device!)

That was a fun support ticket.

I can one up that. I had corrupt HTTP payloads with what looked like boot loader data being inserted ! I tracked it back to VMWare host with a physical NIC driver that was reading past the buffer, and picking up the bootloader from memory. Inside the guest, wire shark was happy, but upstream at the LB it was receiving the nasty payload.

Same here. I have developed a few dissectors for Wireshark and monitoring tools on top of libpcap and find it immensely useful. I did a writeup of "Troubleshooting TCP Throughput" that involves Wireshark here: http://www.thedrews.net/troubleshoot_tcp_throughput.pdf

Also: USB with USBPCap.

My personal pain point is lack of localhost tracing under Windows.

Try npcap https://nmap.org/npcap/

Loopback Packet Capture: Npcap is able to sniff loopback packets (transmissions between services on the same machine) by using the Windows Filtering Platform (WFP). After installation, Npcap will create an adapter named Npcap Loopback Adapter for you. If you are a Wireshark user, choose this adapter to capture, you will see all loopback traffic the same way as other non-loopback adapters

Thanks; will try.

Rawcap can do this. It's increasingly showing its age, but I still use it fairly frequently. It generates PCAP files, it's 23KB, and its only dependency is .NET Framework 2.0 (which, admittedly, is becoming more of a problem than a blessing): http://www.netresec.com/?page=RawCap

Would be interesting reads! Do you have any material out there?

Not at the moment but maybe I should start blogging again... :)

I was able to quickly reverse engineer a slightly non-standard use of the fastboot protocol to update the firmware on a Linux-based device. Very cool piece of software.

eavesdropping, open source best friend. :cough:

Reply on news.ycombinator.com