[TOSS Conf 2023 Offline] Wireshark,tshark,nmap - journey

With much more analysis on wireshark application, found that there is an option to sniff the packets on remote-host from Open-source tool wireshark application itself. from capture->manage interfaces->remote-interface ( This is feature was not available at older versions with which i learnt 3.2.3 over which supporting libraries was not installed)
According to wireshark documentation, the remote interface support was provided to Wireshark since version 1.0.0, which was released on June 15, 2008. However, this feature requires WinPcap or Npcap on Windows, or libpcap on Linux and other Unix-like systems.

To extensively use RPCAP ( remote protocol packet capture) on Cloud server and remote packet captures- rpcapd and libpcap libraries can be used to understand the extensively through studying the libpcap concepts for requirement based capturing packets from - Home | TCPDUMP & LIBPCAP
and
For requirement of automated way of capturing the packet for analysis and filtering - python package named pyshark can be used along with IPC mechanisms support.

Requirement to try automating of packet capturing to interleave captured packet to server to get logged:
[How to Transfer Files in the Network using Sockets in Python - Python Code]
[An Intro to Threading in Python – Real Python]

Incase found browsing of code is huge, you can try an alternate option : Python 3.8 based Network Packet Sniffer : “EONRaider” from Github - to start easily and work. Challenge is that library module :
Incase- if anyone interested - Please try and share your results.
Traceback (most recent call last):
File “sniffer.py”, line 3, in
from core import PacketSniffer
File “/home/box/WS-using-NETprotocol-lib/Packet-Sniffer/packet_sniffer/core.py”, line 10, in
import netprotocols
ModuleNotFoundError: No module named ‘netprotocols’
box@box-virtual-machine:~/WS-using-NETprotocol-lib/P

Below are few of the Filter commands to test and practice with wireshark applications for packet analysis and inspection

Ethernet
eth.addr
eth.len
eth.src
eth.dst
eth.lg
eth.trailer
eth.ig
eth.multicast
eth.type

ARP
arp.hw.type
arp.src.proto_ipv4
arp.dst.hw_mac
arp.proto.size
arp.dst.proto_ipv4
arp.proto.type
arp.hw.size
arp.src.hw_mac
arp.opcode

IEEE 802.1Q
vlan.cfivlan.id
vlan.priority
vlan.etypevlan.len
vlan.trailer

IPv4
ip.addr
ip.fragment.overlap.conflict
ip.checksum
ip.fragment.toolongfragment
ip.checksum_bad
ip.fragments
ip.checksum_good
ip.hdr_len
ip.dsfieldip.host
ip.dsfield.ce
ip.id
ip.dsfield.dscp
ip.len
ip.dsfield.ect
ip.proto
ip.dstip.reassembled_in
ip.dst_host
ip.src
ip.flags
ip.src_host
ip.flags.df
ip.tos
ip.flags.mf
ip.tos.cost
ip.flags.rb
ip.tos.delay
ip.frag_offset
ip.tos.precedence
ip.fragment
ip.tos.reliability
ip.fragment.error
ip.tos.throughput
ip.fragment.multipletails
ip.ttl
ip.fragment.overlap
ip.version

TCP
tcp.ack
tcp.options.qs
tcp.checksum
tcp.options.sack
tcp.checksum_bad
tcp.options.sack_le
tcp.checksum_good
tcp.options.sack_perm
tcp.continuation_to
tcp.options.sack_re
tcp.dstport
tcp.options.time_stamp
tcp.flags
tcp.options.wscale
tcp.flags.ack
tcp.options.wscale_val
tcp.flags.cwr
tcp.pdu.last_frame
tcp.flags.ecn
tcp.pdu.size
tcp.flags.fin
tcp.pdu.time
tcp.flags.push
tcp.port
tcp.flags.reset
tcp.reassembled_in
tcp.flags.syn
tcp.segment
tcp.flags.urg
tcp.segment.error
tcp.hdr_len
tcp.segment.multipletails
tcp.len
tcp.segment.overlap
tcp.nxtseq
tcp.segment.overlap.conflict
tcp.options
tcp.segment.toolongfragment
tcp.options.cc
tcp.segments
tcp.options.ccecho
tcp.seq
tcp.options.ccnew
tcp.srcport
ipv6.addripv6.hop_opt
tcp.options.echotcp.time_delta
ipv6.classipv6.host
tcp.options.echo_reply
tcp.time_relative
ipv6.dstipv6.mipv6_home_address
tcp.options.md5
tcp.urgent_pointer
ipv6.dst_hostipv6.mipv6_length
tcp.options.mss
tcp.window_size
ipv6.dst_opt
ipv6.m
ipv6_typetcp.options.mss_val
ipv6.flowipv6.nxt
ipv6.fragment
ipv6.opt.pad1
ipv6.fragment.error
ipv6.opt.padn
ipv6.fragment.more
ipv6.plen
ipv6.fragment.multipletails
ipv6.reassembled_in
ipv6.fragment.offset
ipv6.routing_hdr
ipv6.fragment.overlap
ipv6.routing_hdr.addreq
ipv6.fragment.overlap.conflict
ipv6.routing_hdr.leftne
ipv6.fragment.toolongfragment
ipv6.routing_hdr.typegt
ipv6.fragments
ipv6.srclt
ipv6.fragment.id
ipv6.src_hostge
ipv6.hlim
ipv6.versionle

UDP
udp.checksum
udp.dstport
udp.checksum_bad
udp.length
udp.checksum_good
udp.port
udp.srcport