How to find Source device details

retag add tags

How much source device details we can get from a captured data? For instance I'm trying to find out the host which is continuously probing on our firewall. So I'm trying to figure out if I can get the type of device which is hitting our firewall, though the connection is dropped by the firewall.

I can see a tab on the packet details > Linux cooked capture > under which there is a "Source" field" like the below which I assume it is the MAC address of the device and the string "Checkpoi" indicates it is sent from a firewall may be Checkpoint?

Any insight is appreciated. Source: CheckPoi_63:86:3a (00:1c:7f:63:86:3a)

Joe77

asked 2018-10-07 17:32:46 +0000

edit flag offensive 0 remove flag close merge delete

Comments

Aren't you confusing your firewall with the CheckPoint thing? I can only assume it's your CheckPoint firewall which generated the capture file. A Linux Cooked capture contains no real data link information, it starts above, with IP information for instance.

Jaap (2018-10-07 18:45:19 +0000) edit

Thanks Jaap. I did some sample captures and I found that the details (like MAC address) I see in the Checkpoint capture file is the next hop internet router's MAC. But the capture do not contains any relevant info about the original source device which is the origin.

Joe77 (2018-10-08 12:01:54 +0000) edit

add a comment see more comments

1 Answer

Sort by

oldest

newest

most voted

If you want to capture the source MAC address, don't capture on interface -i any. You'll end up with the Linux Cooked Capture like you have now, which won't show you the real MAC addresses of the machine you're capturing from.

Either capture on only one interface, i.e., -i eth0, or if you need to capture on more than one interface, then you can use a sufficiently modern version of Wireshark/tshark/dumpcap that supports capturing from multiple interfaces at once. Such support was added to the Wireshark suite with the release of Wireshark 1.8.0 back on June 21, 2012.

So, how to capture on multiple interfaces at once? With Wireshark, use Control-Click to select more than one interface from the GUI or with tshark or dumpcap, you can just specify as many interfaces as you need with multiple occurrences of the -i option, i.e., -i eth0 -i eth1 …. (You can also use -i with Wireshark too, but I don't think most people typically specify command-line options when launching Wireshark.)

11.1k

cmaynard

answered 2018-10-09 14:35:00 +0000

edit flag offensive 0 remove flag delete link

Comments

add a comment see more comments

Your Answer

Please start posting anonymously - your entry will be published after you log in or create a new account. This space is reserved only for answers. If you would like to engage in a discussion, please instead post a comment under the question or an answer that you would like to discuss.

Add Answer

How to find Source device details edit

Comments

1 Answer

Comments