Wireshark is a open source Network Protocol Analyzer under GNU License.
-3
votes
2answers
46 views
Alternatives to wireshark? [closed]
What would be a good option to troubleshoot an interaction of browser with a server besides wireshark?
I mean being able to see what the browser sends and receives.
Is firebug a good alternative or is ...
0
votes
1answer
33 views
can netgear RP614 be configured to enable promisc listening? [closed]
can I confugure NetGear RP614 to be able to receive all packets (packets from and to all machines on my LAN) and inspect them in Wireshark?
I enabled promisc on eth0 and in Wireshark but still can ...
0
votes
1answer
31 views
Is there an app that can provide details about wifi access point config?
I'm wondering if there is an easier way to determine of the following parameters of a wifi network. For users who already have say a laptop connected to a wifi network.
Does wifi network support ...
0
votes
2answers
38 views
Wireshark does not capture HTTP on 8080
I am running Wireshark on my linux machine and i have simple python web server running on localhost:8080
I am capturing only local port 8080. When i open browser on localhost:8080 wireshark captures ...
0
votes
0answers
32 views
Locating OSPF LSA Flooding In Wireshark
How can I identify the OSPF LSA flooding traffic which occurs every 30 minutes from a Wireshark capture? I'm finding it difficult to locate where the start and stop of this flooding process occurs in ...
0
votes
1answer
50 views
syn flood attack — packet hits on shared ip
How can I dump the TCP packets to get a better idea to know which website is being attacked?
Here is what I have in my logs:
May 4 23:10:26 host kernel: [2130002.635000] Firewall: *SYNFLOOD ...
2
votes
6answers
82 views
Wireshark Capture Between Two Routers
How would one go about capturing OSPF traffic in Wireshark between two routers?
I'm looking to do something like this:
[RTR A] - - - [LAPTOP] - - - [RTR B]
0
votes
0answers
21 views
Nagios connection reset (RST) “Misplaced TCP option (SACK)” - No data was received from host
This issue is a strange one. I have a Nagios server running for quite a while now, and all of a sudden I can't get data from 2 hosts...
The hosts are located in a different subnet:
Nagios: ...
0
votes
0answers
43 views
NetGroup Packet Filter Driver isn't installed with WinPcap on Windows Server 2008 R2 64bit
I'm running Windows Server 2008 R2, 64 bit on a Virtual Server. There I want to install Wireshark to capture some of my network traffic for debugging purpose.
During installation of Wireshark and ...
0
votes
2answers
112 views
TCPDump and IPTables DROP by string
by using tcpdump -nlASX -s 0 -vvv port 80 I get something like:
14:58:55.121160 IP (tos 0x0, ttl 64, id 49764, offset 0, flags [DF], proto TCP (6), length 1480)
206.72.206.58.http > ...
1
vote
1answer
78 views
tcpdump not picking up traffic redirected by iptables
The following iptables rule is used to redirect all internet traffic coming in from eth1 to port 3000 at localhost (interface lo with ip 127.0.0.1):
iptables -t nat -A PREROUTING -i eth1 -p tcp ...
-1
votes
1answer
48 views
IP testing tool similar to wireshark website [closed]
I am looking to implement a tool similar to the one linked below on my personal server/website what are the steps I would need to get started?
http://www.wireshark.org/tools/v46status.html
I ...
0
votes
0answers
37 views
How to interpret findings on TCP Send/Recv Buffers
I have an application running on a CentOS machine that connects to a remote DB server on another CentOS machine. Every once in a while, without any discernable warning signs, the application seems to ...
2
votes
2answers
30 views
Is TCP RWIN set by application or OS?
I have a situation where an application is listening on a TCP port and every once in a while, as seen in tcp dumps, gets its Receiving Window (RWIN) set to zero. When this happens, its Recv-Q stops ...
-2
votes
2answers
81 views
Using tcpdump to find strings [closed]
I need to block certain TCP packets by trying to find a string match in and on them. Is there a way to do that with TCPDump? Or do I need wireshare install on my linux server?
One I have the string ...
-1
votes
1answer
22 views
Continuous conversion to text file using Wireshark [closed]
What is the procedure to convert captured files to text files on a continuous basis ? Export in Wireshark is a manual technique, any way to automate the process ?
-1
votes
1answer
31 views
Wireshark not displaying GET or POST data [closed]
I'm a student and I'm taking my first networking class. I'm working on an assignment designed to get me used to using Wireshark and understanding packet transfers. Part of the assignment is to collect ...
1
vote
1answer
36 views
centos6 - wireshark
1) Is there any easy way to install wireshark-1.8.3 on centos 6 ?
I try the wget utility and i get the dependency on gtk..which inturn has dependency on glib, atk , pango and cairo..
2) Looks like ...
3
votes
1answer
102 views
How to use a switch as a network tap?
I would like to tcpdump all traffic that my router does when it makes a firmware update.
So I have taken a HP ProCurve 1800-8G switch and mirrored port 7 to port 8.
I have connected:
Internet ...
3
votes
2answers
107 views
What are cables/boxes called for listening in on a RJ45 cable?
I would like to capture the traffic from a router, so I assume there must exist a cable or hardware box with 3 RJ45 socks, where two of them are IN and OUT, and the third is for capturing device (a ...
2
votes
2answers
117 views
How to use Linux to capture packets on eth0 and send everything to eth1?
Today I got an enterprise Internet connection together with a Sagemcom router. The first time it is connected to the Internet, it will spend 20 minutes upgrading the firmware.
I would really like to ...
0
votes
1answer
49 views
No response from IIS
My problem is that the Default Web Site can be opened from the server machine (localhost), but cannot be opened from a test machine (which is in the same LAN). Netstat says that IIS 7.5 is listening ...
0
votes
2answers
43 views
How to measure Wireshark parsing time of PCAP file?
I need to find out how to measure the parsing time of a PCAP file when using Wireshark.
Does anyone know how to do this?
-2
votes
1answer
79 views
Why wireshark is so slow when analyzing RTP packets? [closed]
The pcap file is about 40MB and mainly contain VOIP conversations. I'm trying to analysis the rtp stream to output the wav (.au) file. It was pretty fast at the beginning but when hits 3x% it turns ...
0
votes
3answers
54 views
Which bit represents which TCP flag?
For instance, a WireShark capture filter example I found - tcp[13] & 8 == 8 represents packets with PSH flags.
How do I count the 8 ?
Based on the wikipedia image,
PSH is in the middle of ...
0
votes
0answers
38 views
Caculating packet offset
In Wireshark, if I want to write a filter which accepts only ICMP destination unreachable ( type 3 ) messages, the filter is icmp[0] == 3 .
How do I count the packet offset of 0 in this instance ?
...
0
votes
3answers
87 views
Wireshark Promiscuous Mode and multiple Subnets
Is it possible to Sniff traffic with Wireshark where the source IP and Destination IP are on different subnets (of the same network) and neither of them are your IP? NIC is Intel 82579LM.
-1
votes
1answer
96 views
DHCP messages in LAN [closed]
I run a Mac and release/renew my IP with:
sudo ipconfig set en0 DHCP
In wireshark I get the following with udp.port==67 as filter:
Why are the messages sent from my computer broadcasted, but ...
1
vote
2answers
231 views
FTP Error 500 Illegal Port Command - PORT command sending different IP than source of request
The problem I'm experiencing is that I'm getting a "500 Illegal PORT command" Response from an FTP server when attempting to upload a file programmatically.
This program is a small c# application ...
0
votes
0answers
81 views
Synergy choppiness: Is my wireless router delaying packets after silent period? [closed]
[Edit: I've reposted to Superuser
as suggested by Dennis Kaarsemaker.]
I am sharing keyboard and mouse between my Linux desktop and MacBook Air using Synergy. There is a very noticeable lag every ...
0
votes
0answers
25 views
Calculating propagation time of a link state announcement
I have a set of traces from a few routers in my network which are running IS-IS. I want to calculate the time it takes for a Link state announcement to propagate from one router to another from these ...
0
votes
2answers
55 views
Multiple ICMP destination unreachable messages
I'm load testing some web services hosted on IIS7. The web services make network calls to underlying services in response to client requests. The client requests are simple HTTP requests but the ...
-1
votes
1answer
195 views
capturing wifi packets coming from android phone; packet request from phone wont show in wireshark [closed]
I'm trying to capture/monitor packets coming out/going in from my android phone. To accomplish this, I'm using a trial of connectify. Basically, it makes my laptop a wifi hotspot while also connected ...
1
vote
0answers
48 views
mysql logging activity from specific user or ip
I have mysql server.
The server is accessed by my application, and by external auditor (person using mysql workbench).
The auditor has specific user and password and dedicated IP and it is granted ...
0
votes
1answer
41 views
Application traffic classification with tcpdump
I have a trace file from my network. I would like to identify the top 10 applications used by us . Does tcpdump provide any application based filtering options ? Any details regarding this would be ...
5
votes
2answers
223 views
Is it possible for Wireshark to drop packets purposely?
I would like to test something like VoIP. I would like to test with some "artificial packet loss". Is Wireshark able to do this? Or is there any good solutions?
0
votes
1answer
93 views
Filtering inbound traffic without knowing the destination subnet
I have a linux machine configured as a router with two interfaces facing LAN A and LAN B. I want to filter traffic passing from LAN A to LAN B (inbound traffic) using tcpdump, but I don't have the ...
0
votes
1answer
57 views
tshark conversation statistic not resolving hostnames
Executing the -z conv,ip command does not display the hostnames (like in wireshark).
I execute the command, and after a bit of traffic was monitored, I stop tshark with Ctrl-C and then the ...
2
votes
2answers
74 views
Filter tcpdump file AFTER capturing
I captured a really big tcpdump file which now always crashes my wireshark. It was captured with no filters and I need to apply some afterwards to make the file smaller.
Is this somehow possible?
1
vote
2answers
234 views
using wireshark/tshark in command line to ignore ssh connections
I'm trying to debug some by looking at the packets and I would like to avoid getting all the SSH traffic to the server. Is there a way to ignore?
I tried to do something like tshark -f "port !22" but ...
0
votes
0answers
116 views
Method to capture traffic going through a wireless router (802.11)
I am interested in monitoring and saving all wireless traffic going through a router (that includes the management frames sent from and the router too) but I am not sure what is the optimal strategy ...
2
votes
2answers
143 views
Correct way to show only TCP packages in wireshark
I needed to write a filter that correctly outputs only TCP packets, the obvious way, and the way written in wireshark is just tcp but when I tried it, it showed me also http, tls (as far as I ...
2
votes
0answers
334 views
Issue with Netgear GS108T Managed Switch and Jumbo Frames
I recently purchased a Netgear GS108T managed switch and I am trying to configure jumbo packets between my NAS (Thecus N4100Pro), PC and managed switch. I should mention the fact that I was able to ...
-1
votes
1answer
79 views
does ping command to a dns name uses DNS PTR type messages?
Okay I cant understand this, when I try to ping to a machine on my network using the name associated I get a response from that machine, thats normal..
But there are messages that the sender sends to ...
2
votes
2answers
142 views
Can you run a packet capture (wireshark) while rdped to a server?
I want to run a packet capture while rdped into a box. I'm pretty sure it won't drop the connection to the server (a server with one nic). I tested on VMs and it seems fine. Am I missing something?
2
votes
2answers
104 views
Wireshark and mirrored ports bringing in 10k+ packets a second
I've got wireshark setup on a monitoring machine to monitor our offices internet traffic (approx 40 machines). However, whenever I start wireshark within about 30-40 seconds it has crashed - I think ...
2
votes
1answer
45 views
Printing to shared printers across VPN
I have a program that prints labels at five remote sites. Two sites, aren't working, but the rest are with an identical (as far as I can tell) setup.
Using Wireshark, I have determined that the ...
0
votes
2answers
96 views
Analyse custom Ethernet frame with WireShark
WireShark can conveniently dissect Ethernet frames, and tell you exactly what each byte means. For example, it tells you where the TCP/IP headers are, how they have been populated and if the checksums ...
2
votes
0answers
183 views
Wireshark (WinPCap) does not see Intel X520-DA2 10 GbE NIC teaming intermittently
I am running a team of two 10 GigE ports on Intel X520-DA2 network card. They work well in tandem and achieve the desired throughput. However, I see an intermittent issue whereby WireShark and my ...
1
vote
0answers
112 views
tshark not recognizing wpa psk option
I'm trying to decrypt captured wpa-psk traffic with tshark, but it's not recognizing the option I'm trying to override. This option allows me to specify a PSK to use for decrypting. I'm using tshark ...
