Wireshark is a open source Network Protocol Analyzer under GNU License.

learn more… | top users | synonyms

-1
votes
1answer
21 views

the MAC header of captured wireshark packets

I have been reading about the IEEE 802.11 and especially on the MAC layer, and i noticed that it contains a lot of informations, but when i start to capture with wireshark with my wireless card, the ...
0
votes
1answer
13 views

udp broadcast on port 25860

I used wireshark on my local network (to test it), and i noticed that there is a lot of udp packets send one broadcast, and the majority is coming from only one host. Theses udp packets are send on ...
0
votes
0answers
16 views

Analyzing SSL Encryption Alerts

I have captured the traffic between my machine and my server using Wireshark, trying to find why some SSL requests fail. I've read this and this post about debugging SSL entries, and I'm able to find ...
0
votes
1answer
17 views

PCAP traffic frame length short

I'm trying to make traffic and capture it using pcap file. I get pcap file from CAIDA(caida.org) site. This pcap file too big and doesn't have ethernet header. So i splitted pcap file to small size(40 ...
0
votes
1answer
18 views

Wireshark returns error on filters from Windows command prompt

It works when i use GUI with the following filter http.request.method == "GET" but when i run tshark is aways returns error tshark -i 1 -Y 'http.request.method == "GET"' tshark: Syntax error near ...
-1
votes
1answer
24 views

Can a remote connetion from outside a LAN be invisible to protocol analyzers such as Wireshark, Process Hacker, Nbtstat? [closed]

When studying the behavior of trojans and (RAT) Remote Access Trojans this question came up. Can an attacker create a trojan that could trick the OS or the NIC into hiding a remote connection to a ...
0
votes
0answers
31 views

Wireshark doesn't filter correctly http.host

When trying to filter for a specific host with http.host=="abc.com" it shows me everything instead of only the related packets. What am I doing wrong? Wireshark 1.12.6
1
vote
0answers
15 views

how can i setup tshark to capture full URL uri request ip and time stamp

How can I setup tshark to capture full URL uri request ip and time stamp. I have tried this: tshark -V -R "tcp.port ==80 && (http.request || http.response)" | awk "/Hypertext Transfer ...
0
votes
2answers
34 views

Wireshark unable to capture squid traffic at port other than 3128

I use the following display filters to analysis traffic between client and squid3 server with Wireshark but nothing shows up. http && tcp http && tcp && tcp.port == 3888 If ...
1
vote
2answers
39 views

How to send captured packets to a different destination?

I have some data packets captured using tcpdump in a pcap file. Now I want to send those packets to a another destination. how I can achieve this?
1
vote
1answer
37 views

Can't connect to python server on LAN

So I have this python server which just returns the uppercase sentence which came as a input: from socket import * serverPort = 12000 serverSocket = socket(AF_INET, SOCK_DGRAM) ...
1
vote
1answer
35 views

How do I export both Packet bytes and Summary line using tshark?

I can export ascii using Wireshark with exactly the same settings as in the example from the documenation, i.e. Only Summary line and Packet bytes exported. Since I have many files to do this with I ...
1
vote
0answers
14 views

detect process accessing network ip on Windows server 2012 R2 [closed]

I tried to identify processes that try to access certain IPs(akamai - 23.0.174.35...). I used MS Message Analyzer but it seams that it can not give definitive results since I get different name and ...
2
votes
0answers
24 views

is the disconnection caused by too many TCP Dup Ack?

I am investigating a service disconnection issue and I am a bit confused by some of the Wireshark logs. Need some help to find out how the disconnection was caused. Ideally when A sends an ACK to B ...
1
vote
1answer
89 views

Wireshark shows “TCP Dup Ack” on SACK after each regular ACK

I have a TCP session captured via switch port mirroring and tcpdump. When viewing it (in Wireshark), I see the same pattern whenever I send a message; here's an excerpt of the outbound packets (I ...
0
votes
1answer
17 views

wireshark sort by TCP dup ack and sort by worst offender?

I have lots of hosts on this network, I want to find out who is the "noisiest", I captured 500k packets and many hosts have TCP dup ack (and other things), what regex should I use to sort by and then ...
0
votes
0answers
38 views

Error decrypting SSL traffic in Wireshark

I am trying to decrypt an SSL connection using Wireshark. It doesn't use DH, so I understand it should be possible to decrypt using the private key (which I have.) The following log shows the error. ...
0
votes
0answers
106 views

http cookie contains datr not working (none packets is returned) wireshark

When I filter in wireshark: http.cookie contains datr none packets is returned, the list in null. What's I going wrong?
0
votes
0answers
26 views

Is the output complete after omitting [TCP segment of reassembled PDU]?

If the tshark -r dumpfile output contains the type [TCP segment of a reassembled PDU], as in 81 3.164109000 4.5.6.7 -> 12.13.14.15 TLSv1.2 609 Application Data 83 3.164523000 4.5.6.7 -> ...
0
votes
1answer
23 views

Capturing un-encrypted HTTPS traffic using wireshark

I am trying to capture HTTPS traffic between a client (windows machine) and a server. I would like to do this before the traffic is encrypted as I would like to analysis its contents. Is there an ...
1
vote
1answer
28 views

SVN over SSL: Many reconnects on commit

The SVN server in our company, which is self setup and hosted on EC2, is pretty slow. The setup is based on Apache and mod_dav_svn. There is also a svnserve running that seems to be used by the CI ...
0
votes
0answers
13 views

(Windows Media Encoder) TCP connection randomly fails/succeeds

We have a windows media server running and are pushing a stream using Windows Media Encoder 9 software on the client. Sometimes, it can't connect to the server and sometimes it can. I ran wireshark ...
1
vote
0answers
38 views

Packet capture on ESXi host

I have an issue I am trying to track down and I believe the problem is with physical networking hardware. I have read the VMWare documentation on the pktcap-uw command and I know I can use it to dump ...
0
votes
0answers
84 views

TCP Out-of-order packets over GRE causing disconnect

I'm experiencing an issue with a small percentage of TCP connections over a GRE tunnel between two servers. The topology is basically Internet <-> GRE Tunnel <-> Backend The GRE tunnel and the ...
1
vote
0answers
71 views

Wireshark RST against TCP Zero Window

During application sharing with Microsoft Lync Client (Mac OS X), TCP ACK with RST flag is sent from my application end to Lync end against TCP Zero Window packets and call gets dropped. Image Link. ...
1
vote
2answers
47 views

What is the cause for TCP flow control misinterpretation?

The client cannot connect to our web server. I sniffed the client and web server only to found out that the client sees the TCP connection to be successful while the server see it as a failure. What ...
-2
votes
2answers
302 views

Promiscuous mode not working with ubuntu and wireshark [closed]

I am running Ubuntu Linux and have installed wireshark on it. I can see the incoming and outgoing traffic just fine. Now I want to see the traffic from other devices which are on my LAN. So, I did: ...
3
votes
4answers
846 views

pfSense not forwarding back packets

I have a pfSense box setup where my WAN interface (em0) is set up in my local network (192.168.1.100) and my LAN interface (em1) is a private network of its own (10.0.0.1). The end goal is to have the ...
3
votes
3answers
243 views

How would a PCAP filter look like to capture all DHCP related traffic?

As I understand it, for IPv4 I would need to capture UDP port 67 and 68, ARP, ICMP echo request and reply, and for IPv6 I would need UDP port 546 and 547, all DHCP-related multicast addresses, ...
1
vote
0answers
144 views

How to efficiently re-order packets in PCAP files based on timestamp?

I have a PCAP file which contains many packets. They are however out of order based on the timestamp (it is actually randomized). What is the best way to efficiently sort the PCAP packets based on ...
1
vote
1answer
68 views

Multiple syn's packets before handshake?

I have a scenario, I'm analyzing ssl (decrpyt) traffic to my webserver. I'm investigating server and end-to-end delay issues. In between this I'm stuck at following traffic pattern for which I need ...
-2
votes
1answer
38 views

Wireshark Data view

I would like to view the data from the capture in plain text, but when I do the "Follow UDP Stream" all I see is: ..........x..7..L....7.... ..7..Ver 6.41 Dec 21 ...
3
votes
1answer
188 views

Windows Server FIrewall (2012) Ipsec tunnel problems

I am new to Ipsec tunnels. I have successfully created a tunnel to a Cisco offsite router using a preshare key at a supplier. In Endpoints 1 : I have the servers ip address and the remote servers ip ...
1
vote
1answer
39 views

High Client Network Utilization Accessing File Share

When users try to access specific folders within our file server, their computer will sometimes lock up and stop responding. These folders have images that average 200KB in size. I've duplicated the ...
0
votes
1answer
25 views

MCU packet capture

I am trying to do a packet capture of a video conference hosted with CISCO [Codian] MCU. The instructions for capturing SIP packets with Wireshark are available. I also configured MCU to accept SIP ...
0
votes
0answers
31 views

after 487 Requst terminated there is no ACK

We have a weird problem. After a non successfull call (like a very long number and such), the phone (Yealink-any) gets "call time out" and then loses it registration. I ran wireshark and noticed that ...
1
vote
0answers
50 views

How to get the serial console logs via ethernet port? [closed]

I have a board running Busybox linux and for my debugging activities I always have to connect physically to the serial port to get the serial console prints and logs.I believe using netcat tool we ...
0
votes
0answers
70 views

Using I/O graph how to interept bytes/tick against packet details information?

I'm working on a trace-file which has reported ISP throttling occurrences in it. My task is to use IO graph to understand at what point in time the throttling process effected client upload ...
1
vote
0answers
71 views

Should I disable the Nagle Algorithm for Outlook / Exchange RPC/HTTP communication?

I'm investigating reasons why several Outlook clients in non-cached mode are having delays communicating... resulting in Outlook hanging. My suspicion is that a Netscaler, or intermediate device (? ...
-1
votes
1answer
99 views

Why is wireshark capturing packets not destined to my host? [closed]

My IP was configured as 192.168.101.91, I don't understand why my host is receiving packets which have a destination address of 192.168.87.203(and many other IPs which I didn't capture) given that I ...
5
votes
2answers
320 views

How can I easily locate a specific TCP conversation in two separate (and large) packet captures using wireshark?

Occasionally, I'll need to compare packet captures (usually wireshark or tcpdump) that are collected from both sides of a TCP conversation. Sometimes the two hosts involved are very "chatty" so I'll ...
1
vote
1answer
784 views

How to decode traffic as NTLM protocol in Wireshark?

I'm trying to debug NTLM authentication issue. One of my ideas was to capture the network traffic and look thougth it. In my case NTLM authentication is going over non-stardart port (6901). Of course, ...
0
votes
1answer
123 views

Too Many HTTP Requests from one source

We are having an issue at one of our customer sites where Tripwire is flagging events when more than 1000 HTTP connections are being individually created from different IP addresses within a span of ...
0
votes
0answers
35 views

Too Many HTTP Requests from one source

We are having an issue at one of our customer sites where Tripwire is flagging events when more than 1000 HTTP connections are being created from one IP address within a span of one minute. We have ...
1
vote
0answers
86 views

How to find ACK for multiple segments using Wireshark?

I'm trying to use Wireshark to find a ACK (for TCP connections) send my the server which ACKs multiple segments as opposed to just ACKing 1 segment. Is there a wireshark filter than can help me with ...
2
votes
0answers
145 views

Wireshark only capturing broadcast packages [closed]

I've ran Wireshark multiple times on my notebook for wireless networks verifying mobile packages for my devices and it used to work most of the time. I haven't been able to monitor my traffic today ...
1
vote
3answers
2k views

How can the SSDP protocol be filtered out of Wireshark view?

In Wireshark version 1.12.4, I am trying to filter out packet messages with an SSDP protocol. When I clicked the Expression button next to the Filter field, and selected "HTTP" (as Field Name) and ...
0
votes
0answers
91 views

Remote packet capturing using fifo and dumpcap

I'm currently working on two linux servers where one server is running in 2.6.18-274.el5(Server A) and the second one in CentOS 7 (Server B). My requirement is to capture the packets of the network ...
0
votes
1answer
117 views

How to ping a host with different MTU size to simulate icmpv6 packet too big scenario?

As the Title states,I want to check whether my host will actually send a ICMPv6 packet too big if i send a packet with beyond the defined MTU size.I don't have a cisco router(extended ping) to try out ...
0
votes
0answers
52 views

Wiresharking access to AWS to debug permission problems

I have a plugin which pushes files to S3. It's not my plugin and auditing what exactly it does has proved difficult. I'm trying to enable access logging on the bucket to figure out what exactly is ...