Windows rpcapd

Steps for enable live sniffer as a service on Windows

(tested on 8.1 64b, IP 192.168.88.247)

• Install windows wireshark including winpcap driver
• Locate winpcap file (c:\Program Files (x86)\WinPcap)
• In winpcap folder we create config file for 'Remote Packet Capture' service (and set from which IP we will access this service)

rpcapd.exe -s rpcapd.ini -l 192.168.88.243
press CTRL+C and check existence of file rpcapd.ini

• edit rpcapd.ini using any text editor and change value of option NullAuthPermit to YES and save a file

notepad rpcapd.ini

• Start rpcapd service in services

Computer management->services->remote packet capture->start

• we should check that port 2002/tcp has been opened
• now we determine windows device on which we want to capture packets

c:\Program Files (x86)\Wireshark>Tshark -D

1.\Device\NPF_{0FF92A37-6568-4767-A301-C0F75B0E3B5F} (VMware Virtual Ethernet Adapter)
2.\Device\NPF_{0F19E8F6-4789-4010-B842-FA65172A9E8A} (Realtek PCIe FE Family Controller)
3.\Device\NPF_{6A56305C-21BB-4C9E-ADC2-1E52CAADDD1F} (Microsoft)
4.\Device\NPF_{EA754A1D-4BFE-422C-82F6-A65C28359CE0} (VMware Virtual Ethernet Adapter)
5.\Device\NPF_{62063D99-FD27-4E2E-8E27-5B154D2AE70C} (Microsoft)

• copy device of your choice, we use later '\Device\NPF_{0F19E8F6-4789-4010-B842-FA65172A9E8A}'

Steps for enable live capture using rpcap from remote PC

(tested on linux Wheezy, IP 192.168.88.243)

1. compile libpcap from wireshark
   1. mkdir -p /usr/src/libpcap-1.0.0/
   2. cd /usr/src/
   3. wget http://www.winpcap.org/install/bin/WpcapSrc_4_1_3.zip
   4. unzip WpcapSrc_4_1_3.zip
   5. cp -r /usr/src/winpcap_4_1_3/wpcap/libpcap/ /usr/src/libpcap-1.0.0/
   6. cd /usr/src/libpcap-1.0.0/
   7. chmod +x configure runlex.sh
   8. ./runlex.sh
   9. ./configure
   10. make; make install
       
2. compile old version of tcpdump (this one can use old libpcap used in wireshark)
   1. cd /usr/src
   2. wget http://www.tcpdump.org/release/tcpdump-4.0.0.tar.gz
   3. tar -xzf tcpdump-4.0.0.tar.gz
   4. cd /usr/src/tcpdump-4.0.0
   5. ./configure
      in outtext from configure we check for:
      "Checking for local pcap library... ./../libpcap-1.0.0/libpcap.a"
      
   6. make
   7. ./tcpdump --help
      we need to see:
      "tcpdump version 4.0.0
      libpcap version 1.0.0"
      
3. now try to capture from a remote (beware of not working CTRL+c,You can use CTRL+Z and then kill process.)
   Take a notice in doubled backslashes in windows device
   
   • capture to a console:
     ./tcpdump -i rpcap://192.168.88.247/\\Device\\NPF_{0F19E8F6-4789-4010-B842-FA65172A9E8A}
   • capture to a file:
     ./tcpdump -s0 -i rpcap://192.168.88.247/\\Device\\NPF_{0F19E8F6-4789-4010-B842-FA65172A9E8A} -w /tmp/data.pcap
   • capture to stdout without our IP address (rpcap transfering):
     ./tcpdump -q -s0 -U -i rpcap://192.168.88.247/\\Device\\NPF_{0F19E8F6-4789-4010-B842-FA65172A9E8A} not host 192.168.88.243 -w-
   • capture and passing it to voipmonitor:
     ./tcpdump -q -s0 -U -i rpcap://192.168.88.247/\\Device\\NPF_{0F19E8F6-4789-4010-B842-FA65172A9E8A} not host 192.168.88.243 -w- |voipmonitor -r /dev/stdin --config-file=/etc/voipmonitor.conf

1. To stop running capture use:

ps ax|grep tcpdump
kill -9 <its pid>

• tcpdump options explanation:
  • s0 - not to cut short captured packets
  • q - not to send statuses of tcpdump to stdout (We want to see only packets from remote)
  • U - packet buffering ( we want only whole packets to be sended to stdout)