Right-click a file with the extension whose association you want to change, and then click Open With. In the Open With dialog box, click the program whith which you want the file to open, or click Browse to locate the program that you want. Select the Always use the selected program to open this kind of file check box. The CAJ file extension indicates to your device which app can open the file. However, different programs may use the CAJ file type for different types of data. We are aware of 2 different uses of the CAJ extension, which you can read more about below.
- Cap File Extension
- How To Open A Cap File Mac
- How To Open .cap File In Kali Linux
- How To Open A Cap File
- Cap File Reader
Using the packet capture feature of Network Watcher, you can initiate and manage captures sessions on your Azure VMs from the portal, PowerShell, CLI, and programmatically through the SDK and REST API. Packet capture allows you to address scenarios that require packet level data by providing the information in a readily usable format. Leveraging freely available tools to inspect the data, you can examine communications sent to and from your VMs and gain insights into your network traffic. Some example uses of packet capture data include: investigating network or application issues, detecting network misuse and intrusion attempts, or maintaining regulatory compliance. In this article, we show how to open a packet capture file provided by Network Watcher using a popular open source tool. We will also provide examples showing how to calculate a connection latency, identify abnormal traffic, and examine networking statistics.
Before you begin
This article goes through some pre-configured scenarios on a packet capture that was run previously. These scenarios illustrate capabilities that can be accessed by reviewing a packet capture. This scenario uses WireShark to inspect the packet capture.
This scenario assumes you already ran a packet capture on a virtual machine. To learn how to create a packet capture visit Manage packet captures with the portal or with REST by visiting Managing Packet Captures with REST API.
Scenario
In this scenario, you:
- Review a packet capture
Calculate network latency
In this scenario, we show how to view the initial Round Trip Time (RTT) of a Transmission Control Protocol (TCP) conversation occurring between two endpoints.
When a TCP connection is established, the first three packets sent in the connection follow a pattern commonly referred to as the three-way handshake. By examining the first two packets sent in this handshake, an initial request from the client and a response from the server, we can calculate the latency when this connection was established. This latency is referred to as the Round Trip Time (RTT). For more information on the TCP protocol and the three-way handshake refer to the following resource. https://support.microsoft.com/en-us/help/172983/explanation-of-the-three-way-handshake-via-tcp-ip
Step 1
Launch WireShark
Step 2
Load the .cap file from your packet capture. This file can be found in the blob it was saved in our locally on the virtual machine, depending on how you configured it.
Step 3
To view the initial Round Trip Time (RTT) in TCP conversations, we will only be looking at the first two packets involved in the TCP handshake. We will be using the first two packets in the three-way handshake, which are the [SYN], [SYN, ACK] packets. They are named for flags set in the TCP header. The last packet in the handshake, the [ACK] packet, will not be used in this scenario. The [SYN] packet is sent by the client. Once it is received the server sends the [ACK] packet as an acknowledgment of receiving the SYN from the client. Leveraging the fact that the server's response requires very little overhead, we calculate the RTT by subtracting the time the [SYN, ACK] packet was received by the client by the time [SYN] packet was sent by the client.
Using WireShark this value is calculated for us.
To more easily view the first two packets in the TCP three-way handshake, we will utilize the filtering capability provided by WireShark.
To apply the filter in WireShark, expand the 'Transmission Control Protocol' Segment of a [SYN] packet in your capture and examine the flags set in the TCP header.
Since we are looking to filter on all [SYN] and [SYN, ACK] packets, under flags confirm that the Syn bit is set to 1, then right click on the Syn bit -> Apply as Filter -> Selected.
Step 4
Now that you have filtered the window to only see packets with the [SYN] bit set, you can easily select conversations you are interested in to view the initial RTT. A simple way to view the RTT in WireShark simply click the dropdown marked 'SEQ/ACK' analysis. You will then see the RTT displayed. In this case, the RTT was 0.0022114 seconds, or 2.211 ms.
Unwanted protocols
You can have many applications running on a virtual machine instance you have deployed in Azure. Many of these applications communicate over the network, perhaps without your explicit permission. Using packet capture to store network communication, we can investigate how application are talking on the network and look for any issues.
In this example, we review a previous ran packet capture for unwanted protocols that may indicate unauthorized communication from an application running on your machine.
Step 1
Using the same capture in the previous scenario click Statistics > Protocol Hierarchy
The protocol hierarchy window appears. This view provides a list of all the protocols that were in use during the capture session and the number of packets transmitted and received using the protocols. This view can be useful for finding unwanted network traffic on your virtual machines or network.
As you can see in the following screen capture, there was traffic using the BitTorrent protocol, which is used for peer to peer file sharing. As an administrator you do not expect to see BitTorrent traffic on this particular virtual machines. Now you aware of this traffic, you can remove the peer to peer software that installed on this virtual machine, or block the traffic using Network Security Groups or a Firewall. Additionally, you may elect to run packet captures on a schedule, so you can review the protocol use on your virtual machines regularly. For an example on how to automate network tasks in azure visit Monitor network resources with azure automation
Finding top destinations and ports
Understanding the types of traffic, the endpoints, and the ports communicated over is an important when monitoring or troubleshooting applications and resources on your network. Utilizing a packet capture file from above, we can quickly learn the top destinations our VM is communicating with and the ports being utilized.
Step 1
Using the same capture in the previous scenario click Statistics > IPv4 Statistics > Destinations and Ports
Step 2
As we look through the results a line stands out, there were multiple connections on port 111. The most used port was 3389, which is remote desktop, and the remaining are RPC dynamic ports.
While this traffic may mean nothing, it is a port that was used for many connections and is unknown to the administrator.
Step 3
Now that we have determined an out of place port we can filter our capture based on the port.
The filter in this scenario would be:
We enter the filter text from above in the filter textbox and hit enter.
From the results, we can see all the traffic is coming from a local virtual machine on the same subnet. If we still don't understand why this traffic is occurring, we can further inspect the packets to determine why it is making these calls on port 111. With this information we can take the appropriate action.
Cap File Extension
Next steps
Learn about the other diagnostic features of Network Watcher by visiting Azure network monitoring overview
Wireshark can read in previously saved capture files. To read them, simplyselect the File → Open menu or toolbar item. Wireshark will then pop upthe 'File Open' dialog box, which is discussed in more detail in Section 5.2.1, 'The 'Open Capture File' Dialog Box'.
When a TCP connection is established, the first three packets sent in the connection follow a pattern commonly referred to as the three-way handshake. By examining the first two packets sent in this handshake, an initial request from the client and a response from the server, we can calculate the latency when this connection was established. This latency is referred to as the Round Trip Time (RTT). For more information on the TCP protocol and the three-way handshake refer to the following resource. https://support.microsoft.com/en-us/help/172983/explanation-of-the-three-way-handshake-via-tcp-ip
Step 1
Launch WireShark
Step 2
Load the .cap file from your packet capture. This file can be found in the blob it was saved in our locally on the virtual machine, depending on how you configured it.
Step 3
To view the initial Round Trip Time (RTT) in TCP conversations, we will only be looking at the first two packets involved in the TCP handshake. We will be using the first two packets in the three-way handshake, which are the [SYN], [SYN, ACK] packets. They are named for flags set in the TCP header. The last packet in the handshake, the [ACK] packet, will not be used in this scenario. The [SYN] packet is sent by the client. Once it is received the server sends the [ACK] packet as an acknowledgment of receiving the SYN from the client. Leveraging the fact that the server's response requires very little overhead, we calculate the RTT by subtracting the time the [SYN, ACK] packet was received by the client by the time [SYN] packet was sent by the client.
Using WireShark this value is calculated for us.
To more easily view the first two packets in the TCP three-way handshake, we will utilize the filtering capability provided by WireShark.
To apply the filter in WireShark, expand the 'Transmission Control Protocol' Segment of a [SYN] packet in your capture and examine the flags set in the TCP header.
Since we are looking to filter on all [SYN] and [SYN, ACK] packets, under flags confirm that the Syn bit is set to 1, then right click on the Syn bit -> Apply as Filter -> Selected.
Step 4
Now that you have filtered the window to only see packets with the [SYN] bit set, you can easily select conversations you are interested in to view the initial RTT. A simple way to view the RTT in WireShark simply click the dropdown marked 'SEQ/ACK' analysis. You will then see the RTT displayed. In this case, the RTT was 0.0022114 seconds, or 2.211 ms.
Unwanted protocols
You can have many applications running on a virtual machine instance you have deployed in Azure. Many of these applications communicate over the network, perhaps without your explicit permission. Using packet capture to store network communication, we can investigate how application are talking on the network and look for any issues.
In this example, we review a previous ran packet capture for unwanted protocols that may indicate unauthorized communication from an application running on your machine.
Step 1
Using the same capture in the previous scenario click Statistics > Protocol Hierarchy
The protocol hierarchy window appears. This view provides a list of all the protocols that were in use during the capture session and the number of packets transmitted and received using the protocols. This view can be useful for finding unwanted network traffic on your virtual machines or network.
As you can see in the following screen capture, there was traffic using the BitTorrent protocol, which is used for peer to peer file sharing. As an administrator you do not expect to see BitTorrent traffic on this particular virtual machines. Now you aware of this traffic, you can remove the peer to peer software that installed on this virtual machine, or block the traffic using Network Security Groups or a Firewall. Additionally, you may elect to run packet captures on a schedule, so you can review the protocol use on your virtual machines regularly. For an example on how to automate network tasks in azure visit Monitor network resources with azure automation
Finding top destinations and ports
Understanding the types of traffic, the endpoints, and the ports communicated over is an important when monitoring or troubleshooting applications and resources on your network. Utilizing a packet capture file from above, we can quickly learn the top destinations our VM is communicating with and the ports being utilized.
Step 1
Using the same capture in the previous scenario click Statistics > IPv4 Statistics > Destinations and Ports
Step 2
As we look through the results a line stands out, there were multiple connections on port 111. The most used port was 3389, which is remote desktop, and the remaining are RPC dynamic ports.
While this traffic may mean nothing, it is a port that was used for many connections and is unknown to the administrator.
Step 3
Now that we have determined an out of place port we can filter our capture based on the port.
The filter in this scenario would be:
We enter the filter text from above in the filter textbox and hit enter.
From the results, we can see all the traffic is coming from a local virtual machine on the same subnet. If we still don't understand why this traffic is occurring, we can further inspect the packets to determine why it is making these calls on port 111. With this information we can take the appropriate action.
Cap File Extension
Next steps
Learn about the other diagnostic features of Network Watcher by visiting Azure network monitoring overview
Wireshark can read in previously saved capture files. To read them, simplyselect the File → Open menu or toolbar item. Wireshark will then pop upthe 'File Open' dialog box, which is discussed in more detail in Section 5.2.1, 'The 'Open Capture File' Dialog Box'.
| You can use drag and drop to open files |
|---|
On most systems you can open a file by simply dragging it in your file manager and dropping it onto Wireshark's main window. |
How To Open A Cap File Mac
If you haven't previously saved the current capture file you will be asked todo so to prevent data loss. This warning can be disabled in the preferences.
In addition to its native file format (pcapng), Wireshark can read and writecapture files from a large number of other packet capture programs as well. SeeSection 5.2.2, 'Input File Formats' for the list of capture formats Wiresharkunderstands.
How To Open .cap File In Kali Linux
The 'Open Capture File' dialog box allows you to search for a capture filecontaining previously captured packets for display in Wireshark. The followingsections show some examples of the Wireshark 'Open File' dialog box. Theappearance of this dialog depends on the system. However, the functionalityshould be the same across systems.
Common dialog behaviour on all systems:
- Select files and directories.
- Click the button to accept your selected file and open it.
- Click the button to go back to Wireshark and not load a capture file.
- The button will take you to this section of the 'User's Guide'.
Wireshark adds the following controls:
- View file preview information such as the size and the number of packets in a selected a capture file.
- Specify a read filter with the 'Read filter' field.This filter will be used when opening the new file.The text field background will turn green for a valid filter string and red for an invalid one.Read filters can be used to exclude various types of traffic, which can be useful for large capture files.They use the same syntax as display filters, which are discussed in detail in Section 6.3, 'Filtering Packets While Viewing'.
- Optionally force Wireshark to read a file as a particular type using the 'Automatically detect file type' dropdown.
Figure 5.1. 'Open' on Microsoft Windows
This is the common Windows file open dialog along with some Wireshark extensions.
Figure 5.2. 'Open' - Linux and UNIX
This is the common Qt file open dialog along with some Wireshark extensions.
The following file formats from other capture tools can be opened by Wireshark:
- pcapng. A flexible, extensible successor to the libpcap format. Wireshark 1.8 and latersave files as pcapng by default. Versions prior to 1.8 used libpcap.
- libpcap. The default format used by the libpcap packet capture library. Usedby tcpdump, _Snort, Nmap, Ntop, and many other tools.
- Oracle (previously Sun) snoop and atmsnoop
- Finisar (previously Shomiti) Surveyor captures
- Microsoft Network Monitor captures
- Novell LANalyzer captures
- AIX iptrace captures
- Cinco Networks NetXray captures
- Network Associates Windows-based Sniffer and Sniffer Pro captures
- Network General/Network Associates DOS-based Sniffer (compressed or uncompressed) captures
- AG Group/WildPackets/Savvius EtherPeek/TokenPeek/AiroPeek/EtherHelp/PacketGrabber captures
- RADCOM's WAN/LAN Analyzer captures
- Network Instruments Observer version 9 captures
- Lucent/Ascend router debug output
- HP-UX's nettl
- Toshiba's ISDN routers dump output
- ISDN4BSD i4btrace utility
- traces from the EyeSDN USB S0
- IPLog format from the Cisco Secure Intrusion Detection System
- pppd logs (pppdump format)
- the output from VMS's TCPIPtrace/TCPtrace/UCX$TRACE utilities
- the text output from the DBS Etherwatch VMS utility
- Visual Networks' Visual UpTime traffic capture
- the output from CoSine L2 debug
- the output from Accellent's 5Views LAN agents
- Endace Measurement Systems' ERF format captures
- Linux Bluez Bluetooth stack hcidump -w traces
- Catapult DCT2000 .out files
- Gammu generated text output from Nokia DCT3 phones in Netmonitor mode
- IBM Series (OS/400) Comm traces (ASCII & UNICODE)
- Juniper Netscreen snoop captures
- Symbian OS btsnoop captures
- Tamosoft CommView captures
- Textronix K12xx 32bit .rf5 format captures
- Textronix K12 text file format captures
- Apple PacketLogger captures
- Captures from Aethra Telecommunications' PC108 software for their test instruments
How To Open A Cap File
New file formats are added from time to time. Uefa euro 2008 pc dvd crack codes.
Cap File Reader
It may not be possible to read some formats dependent on the packet typescaptured. Ethernet captures are usually supported for most file formats but itmay not be possible to read other packet types such as PPP or IEEE 802.11 fromall file formats.
