Mercap/editcap: Files from that network type can't be saved in that format [solved]

Sometimes we do face problem in spilt/merge  packet captures taken in a different media. For example, if we capture packets in MAC operating system, we can't merge the capture files using mergecap utility. Because the files are not in libpcap format. When you try to merge/edit the files, you get the below error

Issue

mergecap  -w out.pcap VA123_00016_20170530202904 VA123_00016_20170530202905

mergecap: Can't open or create out.pcap: Files from that network type can't be saved in that format

file VA123_00016_20170530202904

VA989_00016_20170530202904: pcap-ng capture file - version 1.0

you can solve this issue with the help of tcpdump utility. With the help of tcpdump, you can convert the pcap-ng files to libpcap format 

tcpdump -r  VA123_00016_20170530202904  output.pcap

You can use the below script to merge the list of pcapng files into a single libpcap file

#!/bin/bash

for i in `ls`

do

    echo $i

    file=`echo $i | cut -d "." -f1`

    tcpdump -r $i -w $file.pcap

done

mergecap -w outputfile.pcap *.pcap

Install nodejs , npm and websocket in Debain wheezy

Installing npm and websocket is not so easy in Debian wheezy. You can make use of the below steps to install websocket and npm in Debian wheezy.

1) Install nodejs using the Debian package manager 

apt-get install nodejs

2) npm does not come with Debian package management system. Still there is a way 

curl https://www.npmjs.com/install.sh | sh

3) To install websocket, you need to upgrade to the latest version of nodejs and node-gyp package. You can install latest version of nodejs using nmp

npm cache clean -f

npm install -g n

n stable

n 4.7.2

4) Install node-gyp package using npm

npm install -g node-gyp

5) Finally install websocket using npm

npm install webscoket

P.S.

npm makes it easy for JavaScript developers to share and reuse code, and it makes it easy to update the code that you're sharing.

Debugging Signals- Log the PID of the sender

Suppose if your program randomly crashes  and you find that some process is sending SIGTERM to your program , you can find the process ID of the sender using "sigaction"


 You need to use sigaction call to set up your signal handler instead of signal. Doing so will let you set up a signal handler that takes three parameters:

• An int, for the signal number (just like signal)
• A siginfo_t *, which is a structure containing all sorts of information about the source of the signal, including the pid of the sender if applicable. (It also includes some information about the cause of the signal for automatic signals like SIGSEGV.)
• A ucontext_t *, which has to do with which thread got the signal. Mostly ignorable

Example code and steps:

1) catchsignal.c

"/* Example of using sigaction() to setup a signal handler with 3 arguments

 * including siginfo_t.
 */
#include <stdio.h>
#include <unistd.h>
#include <signal.h>
#include <string.h>
 
static void hdl (int sig, siginfo_t *siginfo, void *context)
{
 printf ("Sending PID: %ld, UID: %ld\n",
   (long)siginfo->si_pid, (long)siginfo->si_uid);
}
 
int main (int argc, char *argv[])
{
 struct sigaction act;
 
 memset (&act, '\0', sizeof(act));
 
 /* Use the sa_sigaction field because the handles has two additional parameters */
 act.sa_sigaction = &hdl;
 
 /* The SA_SIGINFO flag tells sigaction() to use the sa_sigaction field, not sa_handler. */
 act.sa_flags = SA_SIGINFO;
 
 if (sigaction(SIGTERM, &act, NULL) < 0) {
  perror ("sigaction");
  return 1;
 }
 
 while (1)
  sleep (10);
 
 return 0;

}

2) Compile the program 

    gcc -o catchsignal catchsignal.c

3) Shell script to trigger a signal 

sendsig.sh

#!/bin/sh
while [ 1 ]
do
    pidof=`ps -ef | grep catchsignal | grep -v "grep" | awk  '{print $2}'`
    if [ ! -z $pidof ]
    then
        kill $pidof
    fi
sleep 10
done

4) Execute the script
   sh sendsig.sh

5) Run the program 

    ./catchsignal

6) Output of the program

Sending PID: 18532, UID: 0 

Sending PID: 18532, UID: 0

Sending PID: 18532, UID: 0

Bash useful commands

1) To find the duplicates in a file

cat $filename | sort | uniq -c  | awk '$1 > 1 {print $2}'

sort  To sort contents of a file
uniq -c   Counts number of duplicates in a file
awk '$1 > 1 {print $2}'  Print values which has count greater than 1 (Duplicates)


2) Replace a text in vim editor

shift +R   To replace mode

3) Copy the entire file in vim editor

From top
shift + v  To enter visual mode
shift+gg  To Select the entire file

From bottom

shift + v  To enter visual mode
shift  + 1G To Select the entire file

Replay a tcp packet captured by wireshark

To replay a tcp packet cpatured by wireshark, you can use either tcpreplay/bittwist tools


Example1:

tcprewrite --infile=capturedtraffic.pcap --outfile=temp.pcap --srcipmap=0.0.0.0/0:192.168.1.15 --enet-smac=00:0c:29:de:78:42

tcpreplay --intf1=eth0 temp.pcap

sender source MAC is set to 00:0c:29:de:78:42


Example2:

bittwiste -I arp-packet.pcap -O fake-arp.pcap -T arp -o 2 -s 00:00:aa:bb:cc:dd -p 192.168.1.1 -t 00:08:55:64:65:6a -q 192.168.1.20

input file: arp-packet.pcap

output file: fake-arp.pcap

The sender MAC address is set to 00:00:aa:bb:cc:dd; a non-existent MAC address on the network.

bittwist -i vr0 fake-arp.pcap sending packets through vr0 trace file

Find the IP address of the client in an SSH session

1) SSH_CLIENT
shows the address of the client system, the outgoing port number on the client system and the incoming port on the server.

Ex:
echo $SSH_CLIENT
10.10.10.211 63956  22

2) SSH_CONNECTION

Identifies the client and server ends of the connection.
The variable contains four space-separated values: client IP address,
client port number, server IP address, and server port number.

Ex:
echo $SH_CONNECTION
10.10.10.211 63956 172.16.32.11 22

3) SSH_TTY

This is set to the name of the tty (path to the device) associated
with the current shell or command.  If the current session has no tty,
this variable is not set.

Ex:
echo $SSH_TTY
/dev/pts/22

4) Set your own .bashrc

userIP=`echo $SSH_CLIENT | awk '{ print $1}'`

 if [ "$userIP" = "x.x.x.x" ]

 then

        echo "It's my machine IP"

        source /home/bob/.bashrc

 fi

Using this feature you can set your own .bashrc

Fragmenation offset

Fragment Offset

The fragment offset field is measured in units of eight-byte blocks. It is 13 bits long and specifies the offset of a particular fragment relative to the beginning of the original fragmented IP datagram. The first fragment has an offset of zero. This allows a maximum offset of (213 – 1) × 8 = 65,528 bytes, which would exceed the maximum IP packet length of 65,535 bytes with the header length included (65,528 + 20 = 65,548 bytes).

From <https://en.wikipedia.org/wiki/IPv4#Header>

Why we need to divide fragment offset by 8?

Total length of the packet ( 2^16 -1) = 65535 bytes. If the fragment offset is 16 bits then we

Can keep  fragment offset as it's because 2^16 bytes is 65535 (Total length of the packet)..

We can only specify 8192 bytes (2^13) as maximum value of fragment offset. Only if we multiply 8192*8=65536 we will get the total length of the packet.

 So whenever we mention fragment offset we need to divide total size of the packet by 8.  Because in case if the packet size is 65535 byes we can't mention it because the maximum value of the fragment offset is 8192 bytes(2^13)