Wireshark is a open source Network Protocol Analyzer under GNU License.

learn more… | top users | synonyms

0
votes
1answer
18 views

How to debug a “connection refused” error with tshark?

I'm trying to establish a simple TCP connection between two machines in the same subnet (wireless network). The tool used is netcat. On machine A, I start a listener: nc -l -p 4506 On machine B, I ...
1
vote
0answers
15 views

Wireshark is not showing my network interface?

I want to capture traffic on Ethernet 4 but you can see that Ethernet 4 is not present in Wireshark network interface though Ethernet 4 is present in Networking and sharing center. Screenshot of ...
19
votes
2answers
1k views

What's the Wireshark packet receiving and processing procedure on a Windows machine?

I am about to use Wireshark for some traffic monitoring on my Windows computer. While working on it, I was wondering how Wireshark manages to catch low level network packets before Windows does. ...
1
vote
1answer
40 views

Using wireshark to determine which RSA PRIVATE KEY SSL conversation?

Situation I have a client VM and server VM communicating using SSL. The client VM runs wireshark capture using CLI Wireshark GUI is running locally on a different machine. Steps As USER on the ...
0
votes
1answer
46 views

Need help in understanding the packet analysis(wireshark) [closed]

The snapshot capture below contains a single HTTP request to a web server, in which the client web browser requests some files from server, and the server returns an HTTP/1.1 200 (OK) response which ...
0
votes
2answers
42 views

Wireshark Packet Capture Data Data ACK Confusion

I understand how acks work and windowing works. What I am not getting is why am I seeing the following behavior in packet captures Client Server data1-----> data2-----> <--------ack ...
0
votes
1answer
45 views

Capture traffic to/from a network node

I would like to capture all traffic to/from a network node. I don't know much about the network setup there, here's what I know: The target node is a Linux server, which has no access to internet, ...
0
votes
0answers
74 views

FileZilla FTP Error - 426 Connection Closed; aborted transfer of “filename”

I'm trying to transfer a file to an FTP server but I get the error on the title: "426 Connection Closed; aborted transfer of "XYZ". Here are some info: I can establish the connection, change ...
0
votes
0answers
34 views

Why sar ETCP shows TCP retransmission but wireshark tcp.analysis.retransmission doesn't

I am trying to investigate the cause of TCP retransmission. When I use sadc and sar, it shows there are tcp retransmission; but when I use wireshark on all of the server's interfaces, it doesn't show ...
0
votes
1answer
63 views

TCP connection RST after FIN, ACK

I have a situation that would like to clarify with the experts here. I am no network expert so maybe it's normal, but i rather ask. We are trying to diagnose a problem between two servers, both are ...
0
votes
0answers
40 views

Transferring data to Active FTP server fails from DMZ but works fine from LAN

I know there are a ton of similar questions already, but I've read through just about everything I could find and am still having trouble resolving my specific issue. Problem: I am having difficulty ...
0
votes
0answers
22 views

Which wireshark output format aligns closest with actual SMTP data?

I have a packet capture of a SMTP session (containing an email with international characters). I'd like to extract the message data from that and try reproducing an issue. When I follow the TCP ...
1
vote
1answer
48 views

Debugging why network packets are being dropped

Preface: I have an application that I am currently testing out that runs on RHEL 6. The setup for my test is the application installed on a embedded device, connected by an Ethernet cable to PC that ...
1
vote
2answers
55 views

How do I see absolute time stamps in Wireshark?

There is an example of pcap file opened in wireshark The second column is time. Is it possible to see absolute timestamps here instead of relative?
0
votes
0answers
11 views

What filter in Wireshark, can return the ACKs packets employed to complete TCP three-way handshakes instigated by a particular party?

What filter in Wireshark, can return the ACKs packets employed to complete TCP three-way handshakes instigated by a particular party? For instance if machine A requests for a TCP connection to be ...
1
vote
1answer
24 views

Is there a quick way to determine what applications are present within a Wireshark capture? If so how

Is there a quick way to determine what applications are present within a Wireshark capture? If so how As most captures contain over 10 thousand lines, I can't expect people would by hand check which ...
-2
votes
2answers
52 views

Why do different packet analyzers sometimes produce different results?

I ran wireshark and windump at the same time. Both packet analyzers use the same winpcap library. However after doing a row by row comparison of the results I noticed both every column between the 2 ...
2
votes
1answer
35 views

Meaning of [MASKED] in pcap file

What does [MASKED] mean? Is it related to websocket proto? Can i state that 168.109.7.151 initiated connection closing?
1
vote
2answers
27 views

tcpdump http containing non expected payload bytes

I am monitoring an openvpn link with tcpdump a la tcpdump -i tun5 -w capture.dump -W 100 -C 100M -s 0 -n There is http/xml traffic going over that link which is basically caputered just fine. However, ...
2
votes
2answers
91 views

How do you continuously run Wireshark without eating up all of my RAM?

I need to run Wireshark all night to capture packets from a certain IP address. I notice the longer Wireshark runs, the more RAM it takes up because it stores all of the packets found during the run. ...
-1
votes
1answer
26 views

Is it possible for SYN/ACK to not be immediately proceeded by a SYN in a network trace

I'm writing a simple program to calculate initial RTTs from a network capture I took using Wireshark. To do this I wan't to calculate the difference in time between the SYN and the SYN/ACK. I don't ...
0
votes
0answers
57 views

TCP sockets dying on LTE

I have about 25 audio streaming clients built on an i.mx6 arm platform, running linux version 4.3.0-rc2-00019-gbcee19f-dirty #36 SMP Tue Feb 9 15:27:51 EST 2016 armv7l I find on two specific units ...
0
votes
1answer
58 views

How can I see what is the number of embedded objects used by a site in html from a wireshark trace?

I have recorded a wireshark trace and visited some websites. I exported the trace as a CSV file. How can I see the number of embedded objects in each of the sites I visited? Thanks.
-1
votes
1answer
47 views

the MAC header of captured wireshark packets

I have been reading about the IEEE 802.11 and especially on the MAC layer, and i noticed that it contains a lot of informations, but when i start to capture with wireshark with my wireless card, the ...
1
vote
1answer
44 views

udp broadcast on port 25860

I used wireshark on my local network (to test it), and i noticed that there is a lot of udp packets send one broadcast, and the majority is coming from only one host. Theses udp packets are send on ...
0
votes
0answers
52 views

Analyzing SSL Encryption Alerts

I have captured the traffic between my machine and my server using Wireshark, trying to find why some SSL requests fail. I've read this and this post about debugging SSL entries, and I'm able to find ...
0
votes
1answer
32 views

PCAP traffic frame length short

I'm trying to make traffic and capture it using pcap file. I get pcap file from CAIDA(caida.org) site. This pcap file too big and doesn't have ethernet header. So i splitted pcap file to small size(40 ...
0
votes
1answer
32 views

Wireshark returns error on filters from Windows command prompt

It works when i use GUI with the following filter http.request.method == "GET" but when i run tshark is aways returns error tshark -i 1 -Y 'http.request.method == "GET"' tshark: Syntax error near "...
0
votes
1answer
40 views

Can a remote connetion from outside a LAN be invisible to protocol analyzers such as Wireshark, Process Hacker, Nbtstat? [closed]

When studying the behavior of trojans and (RAT) Remote Access Trojans this question came up. Can an attacker create a trojan that could trick the OS or the NIC into hiding a remote connection to a ...
0
votes
0answers
49 views

Wireshark doesn't filter correctly http.host

When trying to filter for a specific host with http.host=="abc.com" it shows me everything instead of only the related packets. What am I doing wrong? Wireshark 1.12.6
1
vote
1answer
63 views

how can i setup tshark to capture full URL uri request ip and time stamp

How can I setup tshark to capture full URL uri request ip and time stamp. I have tried this: tshark -V -R "tcp.port ==80 && (http.request || http.response)" | awk "/Hypertext Transfer ...
0
votes
2answers
99 views

Wireshark unable to capture squid traffic at port other than 3128

I use the following display filters to analysis traffic between client and squid3 server with Wireshark but nothing shows up. http && tcp http && tcp && tcp.port == 3888 If ...
1
vote
2answers
57 views

How to send captured packets to a different destination?

I have some data packets captured using tcpdump in a pcap file. Now I want to send those packets to a another destination. how I can achieve this?
1
vote
1answer
162 views

Can't connect to python server on LAN

So I have this python server which just returns the uppercase sentence which came as a input: from socket import * serverPort = 12000 serverSocket = socket(AF_INET, SOCK_DGRAM) serverSocket.bind(('...
1
vote
1answer
65 views

How do I export both Packet bytes and Summary line using tshark?

I can export ascii using Wireshark with exactly the same settings as in the example from the documenation, i.e. Only Summary line and Packet bytes exported. Since I have many files to do this with I ...
1
vote
0answers
17 views

detect process accessing network ip on Windows server 2012 R2 [closed]

I tried to identify processes that try to access certain IPs(akamai - 23.0.174.35...). I used MS Message Analyzer but it seams that it can not give definitive results since I get different name and ...
2
votes
0answers
43 views

is the disconnection caused by too many TCP Dup Ack?

I am investigating a service disconnection issue and I am a bit confused by some of the Wireshark logs. Need some help to find out how the disconnection was caused. Ideally when A sends an ACK to B ...
1
vote
1answer
255 views

Wireshark shows “TCP Dup Ack” on SACK after each regular ACK

I have a TCP session captured via switch port mirroring and tcpdump. When viewing it (in Wireshark), I see the same pattern whenever I send a message; here's an excerpt of the outbound packets (I don'...
0
votes
1answer
26 views

wireshark sort by TCP dup ack and sort by worst offender?

I have lots of hosts on this network, I want to find out who is the "noisiest", I captured 500k packets and many hosts have TCP dup ack (and other things), what regex should I use to sort by and then ...
0
votes
0answers
182 views

Error decrypting SSL traffic in Wireshark

I am trying to decrypt an SSL connection using Wireshark. It doesn't use DH, so I understand it should be possible to decrypt using the private key (which I have.) The following log shows the error. ...
0
votes
0answers
179 views

http cookie contains datr not working (none packets is returned) wireshark

When I filter in wireshark: http.cookie contains datr none packets is returned, the list in null. What's I going wrong?
0
votes
1answer
50 views

Is the output complete after omitting [TCP segment of reassembled PDU]?

If the tshark -r dumpfile output contains the type [TCP segment of a reassembled PDU], as in 81 3.164109000 4.5.6.7 -> 12.13.14.15 TLSv1.2 609 Application Data 83 3.164523000 4.5.6.7 -> 12....
0
votes
1answer
28 views

Capturing un-encrypted HTTPS traffic using wireshark

I am trying to capture HTTPS traffic between a client (windows machine) and a server. I would like to do this before the traffic is encrypted as I would like to analysis its contents. Is there an ...
1
vote
1answer
45 views

SVN over SSL: Many reconnects on commit

The SVN server in our company, which is self setup and hosted on EC2, is pretty slow. The setup is based on Apache and mod_dav_svn. There is also a svnserve running that seems to be used by the CI ...
0
votes
0answers
14 views

(Windows Media Encoder) TCP connection randomly fails/succeeds

We have a windows media server running and are pushing a stream using Windows Media Encoder 9 software on the client. Sometimes, it can't connect to the server and sometimes it can. I ran wireshark ...
1
vote
0answers
51 views

Packet capture on ESXi host

I have an issue I am trying to track down and I believe the problem is with physical networking hardware. I have read the VMWare documentation on the pktcap-uw command and I know I can use it to dump ...
0
votes
0answers
120 views

TCP Out-of-order packets over GRE causing disconnect

I'm experiencing an issue with a small percentage of TCP connections over a GRE tunnel between two servers. The topology is basically Internet <-> GRE Tunnel <-> Backend The GRE tunnel and the ...
1
vote
0answers
95 views

Wireshark RST against TCP Zero Window

During application sharing with Microsoft Lync Client (Mac OS X), TCP ACK with RST flag is sent from my application end to Lync end against TCP Zero Window packets and call gets dropped. Image Link. ...
1
vote
2answers
54 views

What is the cause for TCP flow control misinterpretation?

The client cannot connect to our web server. I sniffed the client and web server only to found out that the client sees the TCP connection to be successful while the server see it as a failure. What ...
-2
votes
2answers
649 views

Promiscuous mode not working with ubuntu and wireshark [closed]

I am running Ubuntu Linux and have installed wireshark on it. I can see the incoming and outgoing traffic just fine. Now I want to see the traffic from other devices which are on my LAN. So, I did: ...