Hi there, i want to check differences in Traffic which occur between cable modem and router, and traffic between the coaxial jack and cable modem. As i can easily set up a proxy between modem and router and intercept ethernet traffic with tcpdump or wireshark the other side of the cable modem seems to be more complicated. Cable modems are using DOCSIS standard (EuroDOCSIS in Europe) which can be encrypted. As well i don't have an idea how i could connect my proxy with the coaxial cable. Are there any adapters which can help here in connection with a demodulator? Because wireshark has got a DOCSIS dissector i assume, that it should be possible to catch that docsis traffic "out of the cable". I found a video called "Sniffing cable modems" but the aspect how to connect the proxy via coaxial cable is not discussed in detail. Best Regards, Bastian asked 12 Mar '14, 02:26 CipherSpec |
2 Answers:
Not necessarily. Wireshark can read captures in many different file formats, and some of them contain packet types that the mechanisms that libpcap/WinPcap use can't capture. In the case of DOCSIS, that was added to Wireshark because some Cisco "cable modem termination systems" (CMTS) for the "head end" of cable modem networks (i.e., for use at the cable company's site) can take DOCSIS packets, wrap them in Ethernet low-level framing (no Ethernet header, just the raw octets of a DOCSIS packet, preceded by an Ethernet preamble and start frame delimiter and terminated by an Ethernet FCS), and put them out on an Ethernet. Support was added to libpcap/WinPcap to, when capturing on an Ethernet device, use a link-layer header type of DOCSIS rather than Ethernet, and Wireshark can read those files. Sadly, I don't know of any cable modems that support the same mechanism that the Cisco CMTSes do. The "sniffing cable modems" video that pops up when I do a search is the one by Guy Martin; the slides from that talk speak of using a DVB-C card to capture traffic in one direction and a USRP device to capture traffic in the other direction, but don't give any details. Guy Martin definitely knows about Wireshark, and the slides have his e-mail address; he might have some advice on hardware to use to sniff cable modem traffic. answered 12 Mar '14, 19:26 Guy Harris ♦♦ |
A answered 19 Apr '15, 08:35 quantex edited 19 Apr '15, 08:37 |
Actually, DOCSIS uses the RF interface to transmit DOCSIS packets; that's what the Wireshark DOCSIS dissector dissects, and what would be included in packets for which the link-layer header type value is
LINKTYPE_DOCSIS
, as per the tcpdump.org link-layer header types page.That entry says
So it's not just "Ethernet over cable".