The wireshark tag has no wiki summary.
2
votes
1answer
19 views
CouchDB plugin for Wireshark?
I am trying to understand CouchDB network traffic with Wireshark and find it very difficult.
A simple transaction with plain-text content seems to result in many lines in Wireshark, most of them ...
2
votes
0answers
43 views
Debugging slow SMB packets from a specific desktop client
I'm having some serious problems locating a slowdown, and I hope you could assist me with this.
We have an office network with ~50 clients and a main file server running Windows Server 2008 R2 ...
0
votes
0answers
42 views
Wireshark like app for embeded Windows CE
Greetings Im looking for a standalone wireshark like app that I can run on a embedded Windows CE device in order to debug some network issues.
Is anyone aware of such a thing. I know version 5 has ...
1
vote
1answer
34 views
Wireshark - Filter for Inbound HTTP Requests on Port 80 Only
We are integrating with an outside company in which we have had to make certain IP and port restrictions.
First, I am novice at network administration, so If I butcher anything, please forgive me.
...
0
votes
1answer
129 views
What is Reverse Gossip Transfer Protocol?
Playing with wireshark, I see a bunch of packets that say something like
rgtp > https [ACK] Seq=???? Ack=?????? Win=????? Len=0
What is a Reverse Gossip Ttransfer Protocol? What is it used for, ...
0
votes
2answers
43 views
Needs help to understand the wireshark results of a data transferring
In my LAN, I have a router that runs a Samba server and my PC connects to the router.
I wiresharked during uploading a file from my PC to the samba server.
Below is a shortcut of the wireshark ...
3
votes
3answers
140 views
Wireshark filter to only capture Incoming Packets?
I am trying to setup a Filter (so my log files aren't massive) that will capture only incoming traffic. I have looked on http://wiki.wireshark.org/CaptureFilters but so far have been unable to find a ...
0
votes
1answer
101 views
Configuring Wireshark for Rolling Captures during DDoS Attack
We have been getting hit with DDoS Attacks on various machines for months. The datacenter either null routes or sets up an ACL for us. However, it just came to my attention there's a tool floating ...
0
votes
1answer
60 views
Communication problems on secondary interface tap0
I am using UDP over ipv6 as communication stack.
I have network client running on secondary virtual interface tap0. It generates messages for server which is supposed to run on the same interface but ...
1
vote
0answers
44 views
Catalyst 3560G SPAN session not mirroring IGMP packets
I am developing a device which acts as a multicast host, and want to observe it as it responds to IGMP Queries.
My Catalyst 3560G is set up as follows (full config below): Port 0/1 is a TFTP server ...
0
votes
7answers
157 views
Firewall blocks traffic - how to find out what ports / ip addresses are used by software?
Well I get a "host was not accessible" error when trying to use a software. I don't know which port they use nor which address they are trying to reach. Is there a more or less easy way to figure that ...
0
votes
2answers
153 views
Troubleshoot large number of TCP retransmits / dup ack / segment lost
I have a problem with RDC slowing to a crawl or disconnecting entirely. Client is XP SP3 w/ RDC 6, server is Win 2k8 R2. Both have been scanned thoroughly and found to be virus free.
I downloaded ...
-1
votes
1answer
62 views
What does the C3 portion of 0xC308(BE) mean in an ICMP identifier?
I am using Wireshark to analyze traffic. I know that the 8 refers to the echo (ping) type. I have been unsuccesful with finding information regarding the C3 byte.
Identifier (BE): 49928 (0xc308)
2
votes
3answers
42 views
Cannot connect to SQL Server and Wireshark don't listen anything
I'm trying to connect to a SQL Server from outside the LAN, so I opened port 1433 (default SQL Server port) in the firewall. On the server side I'm listening with Wireshark and I can listen ping ...
0
votes
1answer
62 views
ICMP Data Field Modified - What does it Mean?
Normal ICMP Data fields are composed of a pretty standard 32 byte string of alphabet characters.
abcdefghijklmnopqrstuvwabcdefghi
I have captured a series of ICMP echo requests using WireShark with ...
0
votes
0answers
50 views
Measuring delays between various components on a localhost
I need to profile a web application from a system performance standpoint and find out for typical user actions (accessing the home page, logging in...) where the delay comes from. The website uses the ...
0
votes
1answer
72 views
Tcp retransmission tcp session reconstruction
Im trying to write a program that reconstructs tcp sessions. I have a pcap file which have packets. The problem is i dont know which packets i should use to construct sessions when there is a ...
0
votes
1answer
93 views
Why can't I start the WinPCap npf service when I'm the administrator?
I recently installed Wireshark on a Win 7 host, but now it won't let me start the NPF service. I get:
C:\Windows\system32>net start npf
System error 5 has occurred.
Access is denied.
That's ...
0
votes
1answer
41 views
Using tshark to generate traffic logs every X seconds
I'm trying to use tshark to maintain a running history of all the packets that are going through an interface, for say 30 seconds. I want it to be human readable.
This is a linux machine, and without ...
1
vote
2answers
49 views
How can I filter packets from a port monitor?
I have some data going from Point A to Point B. I have a SPAN monitor set up to a monitoring device C.
To recreate some real world scenarios, I want to filter out all traffic which is a certain type ...
0
votes
2answers
111 views
How to use tshark to do this task
I don't have any base knowledge about tshark, and it is hard to find any tutorial to help me with this.
So now I have a pcap file which consists a lot of network flows; a time range; an ip addr; a ...
0
votes
2answers
64 views
SYN packets sent from one server but never arrives at destination
I am troubleshooting network problems for a client, remotely. The problem they have is that they get "connection timed out" occasionally between a web server and and a back-end search server. They can ...
1
vote
1answer
102 views
Stopping the WinPcap Packet capture service
I just installed WireShark, which also installed WinPcap.
During the installation it said "do you want xxx to start automatically", which I answered yes.
Now I would like to stop the service when I ...
2
votes
2answers
304 views
How to debug “HTTP request sent, awaiting response”?
I have a Linux server on an ADSL connection, and I just noticed that sometimes I get
Connecting to example.com|xxx.xxx.xxx.122|:80... connected.
HTTP request sent, awaiting response...
when I use ...
1
vote
1answer
44 views
How can I display-filter the correspondant response to a specific display-filtered request in wireshark?
I am just tracing a very sporadic error in responses to HTTP requests to a specific resource on an embedded device's webserver.
So my plan is to run a test over night (or even weekend), capture the ...
1
vote
1answer
194 views
IP Conflicts from mikrotik router for multiple ip addresses (that it isnt assigned)
I have a point to point wireless connection using two mikrotiks. When I plug the mikrotik into a switch with just my laptop I get an IP address conflict on my machine no matter what IP I am assigned. ...
1
vote
1answer
229 views
How to make wireshark filter POST-requests only?
How to make wireshark filter POST-requests only?
Thanks, Ilya
0
votes
1answer
80 views
Strange UDP/TFTP Problem
My TFTP client only seems to be getting responses from the TFTP server to its RRQ (download requests) if I watch the traffic in wireshark.
If I shut down wireshark (running on the TFTP server), the ...
0
votes
0answers
97 views
Why server is sending RST?
Scenario is : We have a server machine behind a DSL router to which multiple clients are connecting over internet. For few days it worked fine but from today we have observed frequent disconnection. ...
1
vote
2answers
306 views
How can I monitor HTTPS traffic with Wireshark? [closed]
Possible Duplicate:
How can I filter https when monitoring traffic with Wireshark?
I want to verify that the analytics package I've added to my iOS app is attempting to talk to the ...
3
votes
1answer
323 views
Capturing multicast data with Wireshark with IGMP Snooping Enabled at the switch
I am trying to capture multicast traffic via Wireshark (actually TShark), however the switch has IGMP snooping enabled and will only send Multicast traffic on the ports that have an active IGMP ...
0
votes
1answer
99 views
In WireShark, what exactly is X-FCCKV2?
When I filtered HTTP traffic in Wireshark I bumped into a X-FCCKV2 HTTP header in the collected info under the Hypertext Transfer Protocol.
I've researched it on Google but found nothing.
What does ...
2
votes
1answer
100 views
Wireshark Display Filtered for Unreplied ICMP Echo Packets
Is there a wireshark display filter that will find ICMP echo requests that didn't have a reply?
1
vote
2answers
972 views
Best way to analyze pcap files from Wireshark?
I've got 50-100MB pcap files captured from Wireshark and need to analyze where most of the traffic is going to/coming from.
What's the best way of doing this? Ideally I'd like to end up with an ...
0
votes
2answers
118 views
Capturing local traffic on Windows Server 2008 R2
I've got three different applications running on the same Windows Server 2008 R2 machine that communicate with eachother over TCP/IP. All three applications use the actual IP address of the server (vs ...
3
votes
1answer
393 views
WireShark - Capturing Packets on Multiple IP Address (FIlter)
I'm looking for the syntax to do a capture filter on WireShark, by capturing the traffic on several (specific) IP addresses. I understand how to capture a range, and an individual IP address. However, ...
2
votes
4answers
126 views
How can i measure the load of a WAN Connection with Wireshark?
I have a 100 Mbit WAN connection and want to check the load on it for a week.
So I put a hub (10/100Mbit) behind the WAN connection and connected a laptop with wireshark on it. Here is now my ...
1
vote
1answer
415 views
Capture HTTP GET requests
In the Wireshark wiki is an example for filtering HTTP GET requests:
Capture HTTP GET requests. This looks for the bytes 'G', 'E', 'T', and ' ' (hex values 47, 45, 54, and 20) just after the TCP ...
3
votes
1answer
152 views
SSL Packet inspection on Linux
I'm trying to build a web client for an HTTPS website. I think I've done everything right, yet obviously I get a different result in the browser than with my crawler.
As far as I understand, there is ...
0
votes
3answers
1k views
What causes duplicate ACK records?
We're reviewing Wireshark captures from a few client machines that are showing multiple duplicate ACK records which then triggers retransmit and out-of-sequence packets.
These are shown in the ...
0
votes
0answers
188 views
Socket Error 10054 & 10060
We are experiencing a problem after moving some software from one server to another. the client has remained on the same machine.
Old Server: Windows 2003 server Physical machine
New Server: Windows ...
3
votes
3answers
131 views
determining what ports a program uses
I'm trying to use wireshark to determine what ports a certain program uses. The program connects to the server fine if we are on the same network, but I obviously need to forward the ports on the ...
2
votes
3answers
832 views
How can I filter https when monitoring traffic with Wireshark?
I want to observe the HTTPs protocol. How can I use a Wireshark filter to do that?
2
votes
2answers
247 views
Silently start Wireshark
I have a computer in our office that always gets infected by viruses. Because of this, I would like to use Wireshark (or at least something) to monitor internet traffic for a while on this machine. ...
0
votes
2answers
327 views
Problem with WireShark (MySQL sniffing)
How can I snif MySQL data using WireShark? Also I used «mysqlsniffer» and have no results. There are no any packets from MySQL. I've filtered by «MySQL.isPresent» in WireShark but nothing happened.
...
0
votes
0answers
107 views
Every TCP packet has ACK=1 except those that have RST=1?
Is it true that every TCP packet except for a TCP SYN packet will have ACK=1?
I noticed that if I use the following filter in Wireshark
tcp.stream and !tcp.ack
then some TCP packets show up ...
0
votes
2answers
365 views
Getting wireshark to see network (uplink) traffic?
I have wireshark on a win 7 toshiba laptop plugged in to a hp procurve switch. I set the port the laptop is plugged in to as a 'monitor' port, monitoring all the other ports.
I have 1 other computer ...
2
votes
2answers
487 views
wireshark not seeing all packets on WiFi
I'm using Wireshark on OSX, trying to sniff my home network over WiFi. While I can see packets that are sent to/from the host I'm sniffing on, I'm not seeing anything else that goes over the WiFi. ...
1
vote
3answers
78 views
Server access through switch port
I am using wireshark to monitor traffic on a server - Problem is, the computer I am using is only a terminal wired through the switch. Main line comes into the server which is relayed to multi-port ...
1
vote
4answers
1k views
Wireshark - Graphic analysis tool. anyone knows?
Does anyone knows a graphical tool to analyse wireshark captures?
Like something that can agregate traffic by ip's and by protocol and show's it graphicly.
Anyone knows a freeware/opensource ...
