The wireshark tag has no wiki summary.
0
votes
0answers
25 views
Wireshark on home-network [migrated]
So basically I want to make WireShark ( Windows ) capture packets of the home network. As you know, home-networks are usually set by local IPs ( 192.168 or 10.0 range ) instead of the WAN IP so if we ...
0
votes
0answers
33 views
Source of TreeDisconnect Request
A client is experiencing network issues on one particular PC in a small peer-to-peer configuration (3 PCs total). After running Wireshark, I see that a TreeDisconnectRequest is sent from the problem ...
0
votes
0answers
43 views
Wireshark capture stops showing packets…even though my server is definitely receiving client traffic
I'm looking into a potential network issue. On a dev box I've been noticing mysteriously FIN/ACK and RST/ACKs that are breaking comm between my client and server. However, before I can start to ...
0
votes
1answer
65 views
Router is continually broadcasting the same ARP request, with the exact contents
I hope the question is clear and that this is correct place to post the question.
My router is broadcasting the same ARP frame over and over (once every second). It's probably not a big deal, but I ...
0
votes
0answers
96 views
How to interpret `iptables` logs and set rules appropriately?
Initially I thought iptables was blocking all http traffic for a reverse proxy I have set up with pound. This was working prior to a system update (ClearOS 6.2.x).
Now after implementing logging for ...
2
votes
2answers
63 views
How to separate PCAP by unique IP address
I have an hour long PCAP file which has about 60 individual network attacks done on our test network here at work. Each attack comes from a unique IP address which was not used elsewhere during the ...
1
vote
0answers
33 views
Creating keytab for computer account to decrypt packet capture
We are having an issue with our blackberry server (EWSTest fails at autodiscover lookup) and I am running a packet capture with Wireshark in an attempt to diagnose the issue. There is a conversation ...
-1
votes
1answer
84 views
Stealing internet by changing MAC address? [closed]
OK - I have a static IP - and I have been on the same provider for years - its a wired network (a cable goes directly to my network card) - and the cable is connected to a switch on a pole in the ...
0
votes
0answers
61 views
Packets dropped at endpoint NIC — Windows 2003
I have a virtualized Windows 2003 server that hosts one of my pieces of server software. The problem is that the port listener of this server doesn't get the client traffic sometimes. With Wireshark ...
3
votes
2answers
161 views
syn/ack sequence number confusion
I was looking at some random traffic in wireshark and came across this (using relative seq/ack numbers):
1. myIP -> 74.125.227.96 [SYN] seq=0
2. 74.125.227.96 -> myIP ...
2
votes
2answers
194 views
How to monitor VPN traffic with Wireshark on Windows 7?
I'm running Wireshark 1.6.7 (latest available release) x64 on Windows 7 x64.
I only have a single network card on this computer, and Wireshark shows only it as an available adapter to capture packets ...
0
votes
1answer
74 views
Wireshark/encryption and openvpn
I have a linux openvpn router and a home dsl modem. The dsl modem has port 1234 open and forwards it onto eth0 on the linux router.
I can connect to the router from a remote location no problem. All ...
-1
votes
1answer
167 views
Why Wireshark does not recognize this HTTP response?
I have a trivial CGI script that outputs simple text content. It's written in Perl and using CGI module and it specifies only the most basic headers:
print $q->header(
-type ...
-1
votes
1answer
79 views
Checking HTTP response for website using Wireshark
Is there a specific way to know if the file that we download through a web server (e.g.: Java) can be verified through Wireshark?
I want to check if the file is working perfectly from internal and ...
0
votes
1answer
89 views
wireshark windows - how to remote capture/analyze from a tshark or similar install?
I would like to set up some small, low-end hardware wireshark capture points on my network. I am hoping I can use something like command-line linux (ubuntu mini for example) to keep it light-weight.
...
1
vote
1answer
55 views
how to generate the graph in wireshark?
$ sudo tshark -i eth0 -R 'http.request.method == "GET"' "port 80"
Running as user "root" and group "root". This could be dangerous.
Capturing on eth0
5.641015 10.53.0.66 -> 209.85.143.104 HTTP ...
0
votes
1answer
224 views
NBSS Continuation Message - Wireshark - Definition?
Looking at a capture and seeing a "NBSS Continuation Message" port 445, but I cannot find any reference anywhere to what this might mean.
I assume it's a normal message for the NetBIOS Session ...
1
vote
6answers
250 views
How to record SIP traffic / calls for future auditing?
We have a VOIP (SIP?) phone system and have to record all calls for specific phones in the company. It may be required at a future date to listen to these calls for auditing. These phones happen to ...
1
vote
3answers
202 views
How can I sniff the traffic of remote machin with wireshark?
I can sniff the traffic of my local pc,buy how can I sniff the traffic of a remote machin by wireshark?
When in capture option I select remote interface and enter my remote ip show me ...
4
votes
1answer
155 views
how to view hostnames in traffic entering my webserver (Apache)?
Is there any way I can view the hostnames used by incoming traffic that is accepted by my apache webserver?
For example, say the webserver is set up to process incoming traffic for an IP address, ...
1
vote
1answer
61 views
PCAP to Syslog utility
I am looking for a tool which sniff all the traffic on an interface and produce a syslog like Cisco log in real time.
Example :
Feb 16 10:19:05 tcp S.S.S.S(6083) -> D.D.D.D(80), 1 packet
Feb 16 ...
0
votes
2answers
144 views
cant decrypt imaps traffic in wireshark
I have currently problems to decrypt IMAPS Traffic in wireshark.
I set up the SSL Key with the correct IP Address, Port 993 and Protocol imap. The Key is the correct one.
Thats what i see in the ssl ...
2
votes
2answers
92 views
Is there some capture filter (or alternatives) that is especially useful for wireless capture?
I'm capturing wireless traffic in monitor mode with WireShark. I want to capture traffic only for a certain BSS. While wlan.bssid == xx:xx:xx:xx:xx:xx works well as a display filter, I don't want my ...
0
votes
0answers
47 views
server incoming request
i have a windows 2008 server and with the help of wireshark i am seeing the same request over and over again from an unknown ip.
Session request, to *SMBSERVER<20> from NTscan<20>
...
1
vote
0answers
30 views
Why adding capture filters breaks the traffic dump in wireshark / windump?
I have a strange issue while trying to capture RTP (UDP) traffic.
I have a phone using IP 192.168.9.4 and a Windows 2003 PC connected to the same switch (actually to the monitor port of the switch - ...
2
votes
1answer
47 views
CouchDB plugin for Wireshark?
I am trying to understand CouchDB network traffic with Wireshark and find it very difficult.
A simple transaction with plain-text content seems to result in many lines in Wireshark, most of them ...
2
votes
0answers
129 views
Debugging slow SMB packets from a specific desktop client
I'm having some serious problems locating a slowdown, and I hope you could assist me with this.
We have an office network with ~50 clients and a main file server running Windows Server 2008 R2 ...
0
votes
0answers
69 views
Wireshark like app for embeded Windows CE
Greetings Im looking for a standalone wireshark like app that I can run on a embedded Windows CE device in order to debug some network issues.
Is anyone aware of such a thing. I know version 5 has ...
1
vote
1answer
105 views
Wireshark - Filter for Inbound HTTP Requests on Port 80 Only
We are integrating with an outside company in which we have had to make certain IP and port restrictions.
First, I am novice at network administration, so If I butcher anything, please forgive me.
...
0
votes
1answer
140 views
What is Reverse Gossip Transfer Protocol?
Playing with wireshark, I see a bunch of packets that say something like
rgtp > https [ACK] Seq=???? Ack=?????? Win=????? Len=0
What is a Reverse Gossip Ttransfer Protocol? What is it used for, ...
0
votes
2answers
104 views
Needs help to understand the wireshark results of a data transferring
In my LAN, I have a router that runs a Samba server and my PC connects to the router.
I wiresharked during uploading a file from my PC to the samba server.
Below is a shortcut of the wireshark ...
3
votes
3answers
467 views
Wireshark filter to only capture Incoming Packets?
I am trying to setup a Filter (so my log files aren't massive) that will capture only incoming traffic. I have looked on http://wiki.wireshark.org/CaptureFilters but so far have been unable to find a ...
0
votes
1answer
253 views
Configuring Wireshark for Rolling Captures during DDoS Attack
We have been getting hit with DDoS Attacks on various machines for months. The datacenter either null routes or sets up an ACL for us. However, it just came to my attention there's a tool floating ...
0
votes
1answer
80 views
Communication problems on secondary interface tap0
I am using UDP over ipv6 as communication stack.
I have network client running on secondary virtual interface tap0. It generates messages for server which is supposed to run on the same interface but ...
1
vote
0answers
100 views
Catalyst 3560G SPAN session not mirroring IGMP packets
I am developing a device which acts as a multicast host, and want to observe it as it responds to IGMP Queries.
My Catalyst 3560G is set up as follows (full config below): Port 0/1 is a TFTP server ...
0
votes
7answers
303 views
Firewall blocks traffic - how to find out what ports / ip addresses are used by software?
Well I get a "host was not accessible" error when trying to use a software. I don't know which port they use nor which address they are trying to reach. Is there a more or less easy way to figure that ...
0
votes
2answers
584 views
Troubleshoot large number of TCP retransmits / dup ack / segment lost
I have a problem with RDC slowing to a crawl or disconnecting entirely. Client is XP SP3 w/ RDC 6, server is Win 2k8 R2. Both have been scanned thoroughly and found to be virus free.
I downloaded ...
-1
votes
1answer
64 views
What does the C3 portion of 0xC308(BE) mean in an ICMP identifier?
I am using Wireshark to analyze traffic. I know that the 8 refers to the echo (ping) type. I have been unsuccesful with finding information regarding the C3 byte.
Identifier (BE): 49928 (0xc308)
2
votes
3answers
132 views
Cannot connect to SQL Server and Wireshark don't listen anything
I'm trying to connect to a SQL Server from outside the LAN, so I opened port 1433 (default SQL Server port) in the firewall. On the server side I'm listening with Wireshark and I can listen ping ...
0
votes
1answer
112 views
ICMP Data Field Modified - What does it Mean?
Normal ICMP Data fields are composed of a pretty standard 32 byte string of alphabet characters.
abcdefghijklmnopqrstuvwabcdefghi
I have captured a series of ICMP echo requests using WireShark with ...
0
votes
0answers
77 views
Measuring delays between various components on a localhost
I need to profile a web application from a system performance standpoint and find out for typical user actions (accessing the home page, logging in...) where the delay comes from. The website uses the ...
0
votes
1answer
127 views
Tcp retransmission tcp session reconstruction
Im trying to write a program that reconstructs tcp sessions. I have a pcap file which have packets. The problem is i dont know which packets i should use to construct sessions when there is a ...
0
votes
1answer
278 views
Why can't I start the WinPCap npf service when I'm the administrator?
I recently installed Wireshark on a Win 7 host, but now it won't let me start the NPF service. I get:
C:\Windows\system32>net start npf
System error 5 has occurred.
Access is denied.
That's ...
0
votes
1answer
53 views
Using tshark to generate traffic logs every X seconds
I'm trying to use tshark to maintain a running history of all the packets that are going through an interface, for say 30 seconds. I want it to be human readable.
This is a linux machine, and without ...
1
vote
2answers
53 views
How can I filter packets from a port monitor?
I have some data going from Point A to Point B. I have a SPAN monitor set up to a monitoring device C.
To recreate some real world scenarios, I want to filter out all traffic which is a certain type ...
0
votes
2answers
168 views
How to use tshark to do this task
I don't have any base knowledge about tshark, and it is hard to find any tutorial to help me with this.
So now I have a pcap file which consists a lot of network flows; a time range; an ip addr; a ...
0
votes
2answers
79 views
SYN packets sent from one server but never arrives at destination
I am troubleshooting network problems for a client, remotely. The problem they have is that they get "connection timed out" occasionally between a web server and and a back-end search server. They can ...
1
vote
1answer
218 views
Stopping the WinPcap Packet capture service
I just installed WireShark, which also installed WinPcap.
During the installation it said "do you want xxx to start automatically", which I answered yes.
Now I would like to stop the service when I ...
2
votes
2answers
637 views
How to debug “HTTP request sent, awaiting response”?
I have a Linux server on an ADSL connection, and I just noticed that sometimes I get
Connecting to example.com|xxx.xxx.xxx.122|:80... connected.
HTTP request sent, awaiting response...
when I use ...
1
vote
1answer
55 views
How can I display-filter the correspondant response to a specific display-filtered request in wireshark?
I am just tracing a very sporadic error in responses to HTTP requests to a specific resource on an embedded device's webserver.
So my plan is to run a test over night (or even weekend), capture the ...
