Wireshark is a open source Network Protocol Analyzer under GNU License.

learn more… | top users | synonyms

-2
votes
0answers
24 views

An application running on a client is phoning home

Hi! I have a client running an application which takes aprox 1 minute to start when on my LAN. If i remove the network cable the application instantly starts. Wireshark confirms that the app is ...
0
votes
1answer
24 views

How to sniff externals IP using Mikrotik and WireShark

My internet connection is managed by a Mikrotik router. I am sniffing packets from the router using WireShark. I configured that like this: - One computer connected to the network (Windows XP), with ...
-2
votes
2answers
32 views

Promiscuous mode not working with ubuntu and wireshark [closed]

I am running Ubuntu Linux and have installed wireshark on it. I can see the incoming and outgoing traffic just fine. Now I want to see the traffic from other devices which are on my LAN. So, I did: ...
3
votes
4answers
89 views

pfSense not forwarding back packets

I have a pfSense box setup where my WAN interface (em0) is set up in my local network (192.168.1.100) and my LAN interface (em1) is a private network of its own (10.0.0.1). The end goal is to have the ...
3
votes
3answers
46 views

How would a PCAP filter look like to capture all DHCP related traffic?

As I understand it, for IPv4 I would need to capture UDP port 67 and 68, ARP, ICMP echo request and reply, and for IPv6 I would need UDP port 546 and 547, all DHCP-related multicast addresses, ...
1
vote
0answers
26 views

How to efficiently re-order packets in PCAP files based on timestamp?

I have a PCAP file which contains many packets. They are however out of order based on the timestamp (it is actually randomized). What is the best way to efficiently sort the PCAP packets based on ...
1
vote
0answers
14 views

Multiple syn's packets before handshake?

I have a scenario, I'm analyzing ssl (decrpyt) traffic to my webserver. I'm investigating server and end-to-end delay issues. In between this I'm stuck at following traffic pattern for which I need ...
-2
votes
1answer
27 views

Wireshark Data view

I would like to view the data from the capture in plain text, but when I do the "Follow UDP Stream" all I see is: ..........x..7..L....7.... ..7..Ver 6.41 Dec 21 ...
3
votes
1answer
136 views

Windows Server FIrewall (2012) Ipsec tunnel problems

I am new to Ipsec tunnels. I have successfully created a tunnel to a Cisco offsite router using a preshare key at a supplier. In Endpoints 1 : I have the servers ip address and the remote servers ip ...
1
vote
1answer
29 views

High Client Network Utilization Accessing File Share

When users try to access specific folders within our file server, their computer will sometimes lock up and stop responding. These folders have images that average 200KB in size. I've duplicated the ...
0
votes
1answer
17 views

MCU packet capture

I am trying to do a packet capture of a video conference hosted with CISCO [Codian] MCU. The instructions for capturing SIP packets with Wireshark are available. I also configured MCU to accept SIP ...
0
votes
0answers
13 views

after 487 Requst terminated there is no ACK

We have a weird problem. After a non successfull call (like a very long number and such), the phone (Yealink-any) gets "call time out" and then loses it registration. I ran wireshark and noticed that ...
1
vote
0answers
26 views

How to get the serial console logs via ethernet port? [closed]

I have a board running Busybox linux and for my debugging activities I always have to connect physically to the serial port to get the serial console prints and logs.I believe using netcat tool we ...
0
votes
0answers
25 views

Using I/O graph how to interept bytes/tick against packet details information?

I'm working on a trace-file which has reported ISP throttling occurrences in it. My task is to use IO graph to understand at what point in time the throttling process effected client upload ...
1
vote
0answers
37 views

Should I disable the Nagle Algorithm for Outlook / Exchange RPC/HTTP communication?

I'm investigating reasons why several Outlook clients in non-cached mode are having delays communicating... resulting in Outlook hanging. My suspicion is that a Netscaler, or intermediate device (? ...
-1
votes
1answer
77 views

Why is wireshark capturing packets not destined to my host? [closed]

My IP was configured as 192.168.101.91, I don't understand why my host is receiving packets which have a destination address of 192.168.87.203(and many other IPs which I didn't capture) given that I ...
5
votes
2answers
132 views

How can I easily locate a specific TCP conversation in two separate (and large) packet captures using wireshark?

Occasionally, I'll need to compare packet captures (usually wireshark or tcpdump) that are collected from both sides of a TCP conversation. Sometimes the two hosts involved are very "chatty" so I'll ...
1
vote
1answer
287 views

How to decode traffic as NTLM protocol in Wireshark?

I'm trying to debug NTLM authentication issue. One of my ideas was to capture the network traffic and look thougth it. In my case NTLM authentication is going over non-stardart port (6901). Of course, ...
0
votes
1answer
102 views

Too Many HTTP Requests from one source

We are having an issue at one of our customer sites where Tripwire is flagging events when more than 1000 HTTP connections are being individually created from different IP addresses within a span of ...
0
votes
0answers
17 views

Too Many HTTP Requests from one source

We are having an issue at one of our customer sites where Tripwire is flagging events when more than 1000 HTTP connections are being created from one IP address within a span of one minute. We have ...
1
vote
0answers
31 views

How to find ACK for multiple segments using Wireshark?

I'm trying to use Wireshark to find a ACK (for TCP connections) send my the server which ACKs multiple segments as opposed to just ACKing 1 segment. Is there a wireshark filter than can help me with ...
2
votes
0answers
88 views

Wireshark only capturing broadcast packages [closed]

I've ran Wireshark multiple times on my notebook for wireless networks verifying mobile packages for my devices and it used to work most of the time. I haven't been able to monitor my traffic today ...
0
votes
2answers
301 views

How can the SSDP protocol be filtered out of Wireshark view?

In Wireshark version 1.12.4, I am trying to filter out packet messages with an SSDP protocol. When I clicked the Expression button next to the Filter field, and selected "HTTP" (as Field Name) and ...
0
votes
0answers
66 views

Remote packet capturing using fifo and dumpcap

I'm currently working on two linux servers where one server is running in 2.6.18-274.el5(Server A) and the second one in CentOS 7 (Server B). My requirement is to capture the packets of the network ...
0
votes
1answer
76 views

How to ping a host with different MTU size to simulate icmpv6 packet too big scenario?

As the Title states,I want to check whether my host will actually send a ICMPv6 packet too big if i send a packet with beyond the defined MTU size.I don't have a cisco router(extended ping) to try out ...
0
votes
0answers
34 views

Wiresharking access to AWS to debug permission problems

I have a plugin which pushes files to S3. It's not my plugin and auditing what exactly it does has proved difficult. I'm trying to enable access logging on the bucket to figure out what exactly is ...
0
votes
0answers
115 views

Unknown device showing up in network scan

I need some help finding a device that has been showing up whenever I scan my network using Spiceworks' "Inventory" scan. I can ping the device, but nslookup returns a non-existent domain, and ...
1
vote
0answers
170 views

Creating a Network Diagram with .pcap [closed]

I have a Wireshark .pcap Capture of around 500k packets and I would like to enumerate a Network Diagram with all the Routers, Switches, PCs etc. Is there a tool that I could use to automatically ...
0
votes
0answers
231 views

Expanding HAProxy health check to monitor MongoDB primary and secondary state

Follow up question regarding the MongoDB health check with HAProxy How to construct a MongoDB Health Check in HAProxy? The current solution works well when the focus is on determining if mongo ...
2
votes
0answers
66 views

Difference between ping time and time for first ACK answer

While creating a packet performance monitor I come across the follow problem: if I ping a server, I get about 4ms. If I calculate the time between a POST and its first ACK, I get about 25us ...
6
votes
2answers
183 views

TCP acks are paused, then resumed, then paused again. Why?

I would like some help finding the reason for the reduced data transfer rate in my application. I have 12 embedded systems and a Linux server. The embedded systems send data to the server over TCP on ...
1
vote
1answer
70 views

Wireshark does not capture second IP address traffic

I have interface with ip address: 192.168.1.3. I'm adding a second ip address: 192.168.1.4 to that interface using: ip address add Then from other computer (192.168.1.10), I ping those address & ...
1
vote
2answers
91 views

In WireShark, how can I filter results so that it shows only a single line per source?

I'm using WireShark to find any systems pointed to an old system we're decommissioning and rather than showing the same IP 1,000 times I'd like to use a filter that will only show each IP source once. ...
1
vote
0answers
409 views

tcp connection reset [RST, ACK]

getting this errors looks like server is restating the connection because of some packet loss any possible suggestion's to figure out this 37713 591.925575000 ...
0
votes
1answer
117 views

server is not responding on SYN packets

On the attached tcp dump, the first two SYN packets (#21800 and 21801) came to the server, however SYN ACK was sent for the second SYN. Is that correct behaviour? My understanding is that the client ...
1
vote
1answer
39 views

Selecting a TCP stream with most bytes transferred in Wireshark

I have captured traffic in Wireshark and I want to follow the TCP stream with most bytes transferred in the traffic. After opening Statistics > Conversations and sorting by Bytes column I filter the ...
5
votes
1answer
144 views

What is “Cisco STG” and why would it dynamically replace a wildcard certificate on port 5061?

I have a lync client that is connecting to a Lync Edge server on port 5061. I get an invalid certificate error when connecting. When I run wireshark, during the TLS setup, and inside the ...
1
vote
0answers
70 views

Decrypt All traffic by wireshark [closed]

Ok I can decrypt a specified client connected to wifi by deauthing it and getting the handshake using wireshark. In fact after wireshark captures the EAPOL messages it starts to decrypt the traffic. ...
0
votes
0answers
81 views

What conditions can account for incorrect inbound TCP checksums?

According to The Wireshark FAQ TCP checksum offloading causes checksums for outbound traffic to be calculated incorrectly. On some Linux hosts I see some inbound TCP traffic that is flagged with ...
0
votes
1answer
195 views

Dumpcap on remote linux interface

I want to capture packets on a remote linux interface using dumpcap. I have observed that there is a command - dumpcap -i rpcap://<host>/<interface> and dumpcap -i ...
0
votes
2answers
71 views

Wireshark/tshark cutting data short

We are doing a packet capture from within our testing software using the command line: tshark -V -i vlan2091 -R "bootp.hw.mac_addr contains "00:17:33:00:00:00"" The problem we have is one of the ...
0
votes
1answer
137 views

Difference between ISAKMP exchanges types IKE_SA_INIT and Identity protection

I have some Wireshark traces to see how ISAKMP works. This traces were taken from peers when a IPsec tunnel is stablished. It seems that the traces display a different IPsec implementation. When IKE ...
0
votes
1answer
88 views

Plain UDP shows up as STUN in Wireshark

I am sending 4 bytes of data over UDP upon request from another program. Sometimes the frame's protocol is identified as STUN in Wireshark, but I have no clue why. A ruby prototype of the ...
0
votes
0answers
120 views

Installing Wireshark 1.6 on CentOS 5.7

I want to install wireshark version which is higher than 1.2 since I need to analyse the iec104 packets (only version higher than 1.2 supports this). I am using CentOS 5.7 version and it only supports ...
0
votes
1answer
326 views

user agent in http or https request

Is there any way that I can differentiate, the HTTP or HTTPS packets are coming from browser or not ? specially for https request.There is User-Agent field in packet in Http,but I could not found ...
1
vote
1answer
84 views

Why do I see so many ssh packets in only a couple seconds?

I am learning how to use tshark so I can better understand networking. As a user the protocol I most often use day to day is SSH. So I thought I'd start a capture filter on ssh packets on my server ...
1
vote
0answers
1k views

Only capture HTTP post requests through tcpdump

For security purposes we want to list all POST requests URI's that are used in our applications (so we would disable POST through mod_security except for those URI's). The idea is to use tcpdump to ...
2
votes
1answer
184 views

Understanding LDAP traffic with ActiveDirectory

In looking at LDAP traffic through Wireshark I was curious to understand the conversation between the a windows client and Active Directory. Each conversation would vary to less than 80k bytes. But ...
-3
votes
1answer
90 views

Where to optain my client key for SSL decryption? [closed]

example.pcap is a traffic capture I have made on my local Linux box of and now I would like to decrypt it. tshark -o "ssl.desegment_ssl_records: TRUE" -o "ssl.desegment_ssl_application_data: ...
10
votes
1answer
7k views

Unable to open WireShark in CentOS 6.5

I have installed WireShark in CentOS 6.5 with the following packages using Yum. Dependencies Resolved ================================================================================ Package ...