Questions[winpcap](server)

I want to use Winpcap to capture all network packets going through a Gigabit NIC of a server.

Assuming that I am able to utilize the network link up to 100%, the maximum network speed is 1000Mbps. If we exclude the TCP/IP headers, the maximum TCP data rate should be roughly 940Mbps.

Let's say I send a 1GB file through the NIC at 940Mbps using TCP destination port 6000. I use Winpcap to capture all network packets going through the NIC and then dump it to a pcap file. If I use Wireshark to analyze the pcap file and then check the sum of packet size for all network packets sent to TCP port 6000, am I able to get exactly 1GB from the pcap file?

Thanks.

I have a strange issue while trying to capture RTP (UDP) traffic. I have a phone using IP 192.168.9.4 and a Windows 2003 PC connected to the same switch (actually to the monitor port of the switch - that's how I'm able to sniff the traffic).

When I run:

windump -i <interface_name> -tnnq

I can see all the RTP traffic of an open VOIP connection, but when I run:

windump -i <interface_name> -tnnq host 192.168.9.4

.. or even ..

windump -i <interface_name> -tnnq udp

I cannot see RTP traffic at all.

I'm using RTP in the description because I think I saw 1 UDP packet - ARP somewhere during my tests, so maybe not all UTP is affected.

I tried to connect my laptop to the monitoring port (Win7) and on both scenarios it worked OK (I was able to see RTP traffic from the phone).

Any ideas what can I check to find out what's wrong in the config of my Windows 2003 machine?

Im trying to write a program that reconstructs tcp sessions. I have a pcap file which have packets. The problem is i dont know which packets i should use to construct sessions when there is a retransmission.

http://img412.imageshack.us/img412/4655/retransmission.png

here is what wireshark shows about this session. Which packets should i use to reconstruct the session? First packets or retransmited packets? Which of them have valid datas?

I couldnt find a way to attach pcap file if you want i can upload pcap file to somewhere. Im sorry i couldnt post image to here cause i dont have enough reputation.

I recently installed Wireshark on a Win 7 host, but now it won't let me start the NPF service. I get:

C:\Windows\system32>net start npf
System error 5 has occurred.

Access is denied.

That's strange, because I am in the local admins group, and the SDDL string for the 'npf' service shows that the RP and WP permissions are allowed to the built-in administrator group.

C:\Windows\system32>net localgroup

Aliases for \\DOC

-------------------------------------------------------------------------------
*Administrators
*Backup Operators
*Cryptographic Operators
*Distributed COM Users
*Event Log Readers
*Guests
*IIS_IUSRS
*Network Configuration Operators
*Offer Remote Assistance Helpers
*Performance Log Users
*Performance Monitor Users
*Power Users
*Remote Desktop Users
*Replicator
*Users
The command completed successfully.


C:\Windows\system32>sc sdshow npf

D:(A;;CCLCSWRPWPDTLOCRRC;;;SY)(A;;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;BA)(A;;CCLCSWLOCR
RC;;;IU)(A;;CCLCSWLOCRRC;;;SU)

Clearly I am missing something, but what?

I just installed WireShark, which also installed WinPcap.

During the installation it said "do you want xxx to start automatically", which I answered yes.

Now I would like to stop the service when I am not running wireshark, but cannot find a service in the list with name wireshark or winPcap.

Is there a service that I can stop? Or do I need uninstall WireShark?