Wireshark is a open source Network Protocol Analyzer under GNU License.

learn more… | top users | synonyms

0
votes
0answers
13 views

Wiresharking access to AWS to debug permission problems

I have a plugin which pushes files to S3. It's not my plugin and auditing what exactly it does has proved difficult. I'm trying to enable access logging on the bucket to figure out what exactly is ...
0
votes
0answers
32 views

Unknown device showing up in network scan

I need some help finding a device that has been showing up whenever I scan my network using Spiceworks' "Inventory" scan. I can ping the device, but nslookup returns a non-existent domain, and ...
1
vote
0answers
43 views

Creating a Network Diagram with .pcap [closed]

I have a Wireshark .pcap Capture of around 500k packets and I would like to enumerate a Network Diagram with all the Routers, Switches, PCs etc. Is there a tool that I could use to automatically ...
0
votes
0answers
25 views

Expanding HAProxy health check to monitor MongoDB primary and secondary state

Follow up question regarding the MongoDB health check with HAProxy How to construct a MongoDB Health Check in HAProxy? The current solution works well when the focus is on determining if mongo ...
2
votes
0answers
27 views

Difference between ping time and time for first ACK answer

While creating a packet performance monitor I come across the follow problem: if I ping a server, I get about 4ms. If I calculate the time between a POST and its first ACK, I get about 25us ...
-1
votes
0answers
14 views

Installing latest wireshark impossible? [migrated]

It looks like installing a later version of wireshark is near impossible on redhat 6. I've searched the web extensively and can't find any questions where someone has said their issue was resolved. ...
6
votes
2answers
119 views

TCP acks are paused, then resumed, then paused again. Why?

I would like some help finding the reason for the reduced data transfer rate in my application. I have 12 embedded systems and a Linux server. The embedded systems send data to the server over TCP on ...
1
vote
1answer
40 views

Wireshark does not capture second IP address traffic

I have interface with ip address: 192.168.1.3. I'm adding a second ip address: 192.168.1.4 to that interface using: ip address add Then from other computer (192.168.1.10), I ping those address & ...
-1
votes
0answers
25 views

Wireshark capture SSL only [migrated]

I would like to capture SSL or HTTPS traffic only in Wireshark, this is not something that can be filtered after due to the length of the time I would be recording the data after and the size of the ...
-2
votes
0answers
38 views

Problems analyzing network capture

I just received a pcap capture in order to investigate some slowness and I believe the issue is related to the network, but can't seem to realize if it's from my end or their end. My IP is the one ...
1
vote
2answers
74 views

In WireShark, how can I filter results so that it shows only a single line per source?

I'm using WireShark to find any systems pointed to an old system we're decommissioning and rather than showing the same IP 1,000 times I'd like to use a filter that will only show each IP source once. ...
0
votes
0answers
107 views

tcp connection reset [RST, ACK]

getting this errors looks like server is restating the connection because of some packet loss any possible suggestion's to figure out this 37713 591.925575000 ...
0
votes
1answer
35 views

server is not responding on SYN packets

On the attached tcp dump, the first two SYN packets (#21800 and 21801) came to the server, however SYN ACK was sent for the second SYN. Is that correct behaviour? My understanding is that the client ...
1
vote
1answer
25 views

Selecting a TCP stream with most bytes transferred in Wireshark

I have captured traffic in Wireshark and I want to follow the TCP stream with most bytes transferred in the traffic. After opening Statistics > Conversations and sorting by Bytes column I filter the ...
6
votes
1answer
63 views

What is “Cisco STG” and why would it dynamically replace a wildcard certificate on port 5061?

I have a lync client that is connecting to a Lync Edge server on port 5061. I get an invalid certificate error when connecting. When I run wireshark, during the TLS setup, and inside the ...
2
votes
0answers
47 views

Decrypt All traffic by wireshark [closed]

Ok I can decrypt a specified client connected to wifi by deauthing it and getting the handshake using wireshark. In fact after wireshark captures the EAPOL messages it starts to decrypt the traffic. ...
0
votes
0answers
54 views

What conditions can account for incorrect inbound TCP checksums?

According to The Wireshark FAQ TCP checksum offloading causes checksums for outbound traffic to be calculated incorrectly. On some Linux hosts I see some inbound TCP traffic that is flagged with ...
0
votes
1answer
79 views

Dumpcap on remote linux interface

I want to capture packets on a remote linux interface using dumpcap. I have observed that there is a command - dumpcap -i rpcap://<host>/<interface> and dumpcap -i ...
0
votes
2answers
41 views

Wireshark/tshark cutting data short

We are doing a packet capture from within our testing software using the command line: tshark -V -i vlan2091 -R "bootp.hw.mac_addr contains "00:17:33:00:00:00"" The problem we have is one of the ...
0
votes
1answer
38 views

Difference between ISAKMP exchanges types IKE_SA_INIT and Identity protection

I have some Wireshark traces to see how ISAKMP works. This traces were taken from peers when a IPsec tunnel is stablished. It seems that the traces display a different IPsec implementation. When IKE ...
0
votes
1answer
43 views

Plain UDP shows up as STUN in Wireshark

I am sending 4 bytes of data over UDP upon request from another program. Sometimes the frame's protocol is identified as STUN in Wireshark, but I have no clue why. A ruby prototype of the ...
0
votes
0answers
84 views

Installing Wireshark 1.6 on CentOS 5.7

I want to install wireshark version which is higher than 1.2 since I need to analyse the iec104 packets (only version higher than 1.2 supports this). I am using CentOS 5.7 version and it only supports ...
0
votes
1answer
132 views

user agent in http or https request

Is there any way that I can differentiate, the HTTP or HTTPS packets are coming from browser or not ? specially for https request.There is User-Agent field in packet in Http,but I could not found ...
1
vote
1answer
51 views

Why do I see so many ssh packets in only a couple seconds?

I am learning how to use tshark so I can better understand networking. As a user the protocol I most often use day to day is SSH. So I thought I'd start a capture filter on ssh packets on my server ...
1
vote
0answers
425 views

Only capture HTTP post requests through tcpdump

For security purposes we want to list all POST requests URI's that are used in our applications (so we would disable POST through mod_security except for those URI's). The idea is to use tcpdump to ...
2
votes
1answer
84 views

Understanding LDAP traffic with ActiveDirectory

In looking at LDAP traffic through Wireshark I was curious to understand the conversation between the a windows client and Active Directory. Each conversation would vary to less than 80k bytes. But ...
-3
votes
1answer
67 views

Where to optain my client key for SSL decryption? [closed]

example.pcap is a traffic capture I have made on my local Linux box of and now I would like to decrypt it. tshark -o "ssl.desegment_ssl_records: TRUE" -o "ssl.desegment_ssl_application_data: ...
10
votes
1answer
4k views

Unable to open WireShark in CentOS 6.5

I have installed WireShark in CentOS 6.5 with the following packages using Yum. Dependencies Resolved ================================================================================ Package ...
0
votes
0answers
30 views

How to meet the arp table and the network toology with wireshark

I'm wondering if is possible meet(see) the arp table in a network traffic with wireshark or find some way to build manually the arp table, and how to see the router and swiches of topology( for ...
3
votes
1answer
75 views

Corrupt DNS requests

Sometimes in some network captures that include my DNS server, I find there are failed lookups for what seem like invalid requests. When viewed in Wireshark these show up with what looks like escaped ...
0
votes
0answers
35 views

upnp keep alive packet

I took a wireshark packet dump and Iam able to track the initial MSEARCH, SSDP out message to multicast IP etc., from my-device. but how do I see the incoming keep alive message from the other-device ...
2
votes
0answers
494 views

Troubleshooting Packet Loss on pfSense + Ubiquiti UniFi (Wireshark maybe?)

I'm dealing with an annoying situation in a small network in my church, which I'm the primary volunteer IT caretaker, of about 20 PCs, give-or-take. We're in Chattanooga, home of Gigabit internet, so ...
0
votes
1answer
76 views

nmap repeats the scan to a specific port multiple time

I scanned a subnet (16 hosts) while dumping the network traffic with wireshark. I did it 2 times and I noticed that in the traffic there is the normal SYN-SYN/ACK and SYN-RST from open/closed port, ...
0
votes
2answers
362 views

Wireshark “length” column - what does it include?

Can anyone tell me what the "Length" column in WireShark refers to? I'm pretty sure it's the "size" of the entire frame on the wire. I did some calculations, but I didn't get the number that ...
1
vote
3answers
1k views

HTTP not finishing over LAN. Hardware cause?

On a customer server running Apache 2.2 on Windows server 2012 we're noticing that from time to time, some requests to the server never finish. Using wireshark I've found a bunch of duplicate ACKs get ...
1
vote
0answers
296 views

FTP Connection Suddenly hanging on 'waiting for welcome message'

We've had our FTP server (Proftpd) running on Ubuntu Server 12.04 for over 12 months now with no connection issues. In the last few days there have been issues with slow connections to the server, ...
0
votes
0answers
99 views

Wireshark: fully customized output from TShark?

I'm using TShark to analyze some packet capture logs and would like to produce some nice lists from the logs. I want the lists to be in text format, so they could be viewed/printed/etc. easily on ...
0
votes
0answers
41 views

Early tear down of communication

I have an application which performs an LDAP search which works in one domain but not in the other, when analyzing the packets sent between the application server and the domain controller being ...
-1
votes
1answer
64 views

Analyzing twitter packets [closed]

Thanks for your time. I'd like to find a way if a client has made a 'GET' or a 'POST' request for twitter. We are currently doing an educational project and we wanted to understand how we can achieve ...
1
vote
1answer
263 views

How can I write a filter to get tcp sequence number inconsistency?

I am using WireShark 1.12 and I am trying to filter SYN , SYN/ACK , ACK by inconsistencies. Would anyone know how to write a filter for this version? Currently I am using this: tcp.ack & tcp.seq ...
-3
votes
1answer
125 views

How do I get statistics on HTTP traffic from Wireshark? [closed]

I have captured traffic with dumpcap and filtered http only with Wireshark. I want to see statistics about that http traffic. For example: requests grouped by method and URL, ordered by number of ...
1
vote
1answer
360 views

Can firewall block packets visible in Wireshark?

Wireshark shows that an RTP package is received on a PC. Is it possible that despite detection by Wireshark, something (firewall?) is still prevent the application listening to the required port on ...
0
votes
0answers
87 views

Why am I getting ICMP traffic with wireshark DNS filter?

I am surfing the web and looking at dns traffic in wireshark with the "dns" filter active. When I ask for a non existant domain or subdomain I get a Destination Unreachable (Port Unreachable message). ...
3
votes
2answers
722 views

Why is Wireshark not capturing certain POST requests?

If I use this filter in Wireshark: http.request.method == "POST" and use the vote buttons to vote for a stack exchange question, then Wireshark captures the corresponding POST request. I can also see ...
3
votes
0answers
136 views

RTP analysis - Discerning ptime (packetization time) for a given VoIP packet capture

I would like some help on the subject of an automated way of discerning the average packetization time (ptime) of a VoIP call's packet capture. The reason I am not depending on the value in the SDP ...
0
votes
1answer
34 views

Is it possible to mimic the client of a https web service

There is such a windows application that communications with the server through https protocol, it is an auction tool and works only several hours per month. I have captured network packets (by ...
0
votes
1answer
22 views

Why am I seeing prefixed/duplicated packets coming from a comcast device?

I'm looking at traffic my CPE from Comcast in Wireshark, and for every packet, there is an additional packet that is the exact same, except for 4 additional bytes at the beginning of the frame ...
0
votes
0answers
67 views

wireshark not showing netflow source addresses nfdump does

Hi guys i'm experiencing following issue, hope someone can explain me what's happening. I got a pcap with a dump of udp packets containing netflow data. I've used tcprewrite and tcpreplay to ...
0
votes
1answer
22 views

See historical packet receipt statistics in Windows

I know this is a long shot, but it would be really useful to me right now. Does anyone know of a Windows function or 3rd party tool that can show stats about the receipt of packets on a network ...
1
vote
0answers
142 views

Can I use tshark to write SSL-decrypted packets to a file?

I have a PCAP file containing SSL-encrypted HTTP traffic and the private key from the relevant web server. I'd like a PCAP file that contains the decrypted HTTP traffic to feed into a different tool. ...