This is our old Q&A Site. Please post any new questions and answers at


I have a problem with captured telnet password using macflood attack. As you can see on the screen, there is no password, just "......".

When I use another attack (arpspoof, ...), I can see password without problems. Anybody knows where could be a problem?



asked 28 Apr '14, 01:41

petersonn's gravatar image

accept rate: 0%

edited 28 Apr '14, 04:14

You either captured only one direction of the communication or you filtered the traffic to show only one direction (dst: So, what you see in the screenshot is only the traffic from the telnet server to the telnet client. Why you only see half of the traffic could be related to your capture method/setup. As you did not tell us anything about that (except 'macflood') it's impossible to give you any advice.

The reason why you see dots (....) for the password is some ECHO option enabled on the telnet server. With that option it will echo certain pieces of the communication back to the client. In the case of the password, your telnet server apparently does not echo the real password. Instead it uses other characters.

The difference to your other capture file is (most certainly) the fact that you've captured both directions in the other capture file and thus you can see the cleartext password sent from the client to the server. You'll have the echoed password as well in the capture file (if it's the same telnet server), but you might not have noticed, as you probably did not know about that feature and thus you ignored the extra characters.


permanent link

answered 28 Apr '14, 17:06

Kurt%20Knochner's gravatar image

Kurt Knochner ♦
accept rate: 15%

Yes, you're right, I captured only traffic from telnet server to telnet client. My topology is: I run macof from attacker's PC for a few seconds to fill CAM table. After that I start capturing data on attacker's PC and then I connect Telnet client PC and make telnet connection. But I can see in the Wireshark only telnet traffic captured in one direction. Where can I find the other direction (from client to server)? If necessary, I can upload my .pcap file for you.

Thank you for answering!


(29 Apr '14, 02:39) petersonn
Your answer
toggle preview

Follow this question

By Email:

Once you sign in you will be able to subscribe for any updates here



Answers and Comments

Markdown Basics

  • *italic* or _italic_
  • **bold** or __bold__
  • link:[text]( "title")
  • image?![alt text](/path/img.jpg "title")
  • numbered list: 1. Foo 2. Bar
  • to add a line break simply add two spaces to where you would like the new line to be.
  • basic HTML tags are also supported

Question tags:


question asked: 28 Apr '14, 01:41

question was seen: 3,410 times

last updated: 29 Apr '14, 02:39

p​o​w​e​r​e​d by O​S​Q​A