Wireshark is a open source Network Protocol Analyzer under GNU License.

learn more… | top users | synonyms

-2
votes
1answer
28 views

How do I get statistics on HTTP traffic from Wireshark?

I have captured traffic with dumpcap and filtered http only with Wireshark. I want to see statistics about that http traffic. For example: requests grouped by method and URL, ordered by number of ...
-3
votes
0answers
16 views

How do I save filtered traffic with Wireshark 1.10?

I capture traffic with dumpcap to a file. I import it to Wireshark (version 1.10.6) and apply a http display filter. How do I save only that filtered http traffic to a new file?
1
vote
1answer
89 views

Can firewall block packets visible in Wireshark?

Wireshark shows that an RTP package is received on a PC. Is it possible that despite detection by Wireshark, something (firewall?) is still prevent the application listening to the required port on ...
-1
votes
0answers
15 views

Wireshark keyboard layout is incorrect [migrated]

I just installed Wireshark Version 1.12.0 (v1.12.0-0-g4fab41a from master-1.12) on OSX 10.9.4 with XQuartz 2.7.7. Wireshark is doing something zany with my keyboard layout, but other X11 ...
0
votes
0answers
27 views

Why am I getting ICMP traffic with wireshark DNS filter?

I am surfing the web and looking at dns traffic in wireshark with the "dns" filter active. When I ask for a non existant domain or subdomain I get a Destination Unreachable (Port Unreachable message). ...
3
votes
2answers
439 views

Why is Wireshark not capturing certain POST requests?

If I use this filter in Wireshark: http.request.method == "POST" and use the vote buttons to vote for a stack exchange question, then Wireshark captures the corresponding POST request. I can also see ...
-1
votes
0answers
15 views

Cannot establish FTP connection, client sending TCP Reset flags

I have a problem between a Win 2008 R2 server and an FTP server (Server 2008 R2 & FileZilla). Both servers are using internal/private addresses and there is no NAT involved and no firewall rules ...
2
votes
0answers
36 views

RTP analysis - Discerning ptime (packetization time) for a given VoIP packet capture

I would like some help on the subject of an automated way of discerning the average packetization time (ptime) of a VoIP call's packet capture. The reason I am not depending on the value in the SDP ...
0
votes
1answer
15 views

Is it possible to mimic the client of a https web service

There is such a windows application that communications with the server through https protocol, it is an auction tool and works only several hours per month. I have captured network packets (by ...
0
votes
1answer
19 views

Why am I seeing prefixed/duplicated packets coming from a comcast device?

I'm looking at traffic my CPE from Comcast in Wireshark, and for every packet, there is an additional packet that is the exact same, except for 4 additional bytes at the beginning of the frame ...
0
votes
0answers
26 views

wireshark not showing netflow source addresses nfdump does

Hi guys i'm experiencing following issue, hope someone can explain me what's happening. I got a pcap with a dump of udp packets containing netflow data. I've used tcprewrite and tcpreplay to ...
0
votes
1answer
14 views

See historical packet receipt statistics in Windows

I know this is a long shot, but it would be really useful to me right now. Does anyone know of a Windows function or 3rd party tool that can show stats about the receipt of packets on a network ...
1
vote
0answers
41 views

Can I use tshark to write SSL-decrypted packets to a file?

I have a PCAP file containing SSL-encrypted HTTP traffic and the private key from the relevant web server. I'd like a PCAP file that contains the decrypted HTTP traffic to feed into a different tool. ...
1
vote
1answer
52 views

Intermittent switch failure and data flooding, hardware capacity?

We are using a switch (ZIO-SW500) connected to the building main network and we suffers from intermittent network halt. Normally the network works well. But, sometimes traffic designated to other ...
0
votes
1answer
126 views

SIP INVITE packet has WAN address rather than call manager LAN IP

I am using SIP between two subnets (192.168.3.0/24 and 192.168.30.0/24) each connected via VPN. I have a call server on 192.168.3.100, and two phones 192.168.30.118 (Ext. 3128) and 192.168.30.119 ...
-5
votes
1answer
78 views

how to sniff from a remote machine? [closed]

I have a PC and a tablet that connected to a TP-Link ADSL modem. PROBLEM: I want to see the packets that send and receive from my modem not my PC( to see both wire and wireless packets) I search ...
1
vote
2answers
308 views

Wireshark TCP Window Size Value

I am debugging an application with Wireshark and watching the TCP Window Size value shrink on one side of the communication. If the packet's TCP section shows a "Window size value: 1", does that mean ...
0
votes
0answers
49 views

Wireshark - view complete packet

I am trying to use Wireshark to capture some HTTP packets, but when the packet is too long, Wireshark truncates it in its window. The bottom window still shows the entire packet, but I am not able to ...
2
votes
2answers
134 views

Packets returning but traceroute fails

I get this output from traceroute: #traceroute -i eth1 -s 192.168.12.14 192.168.1.72 1 192.168.12.1 (192.168.12.1) 1.410 ms 2.076 ms 2.251 ms 2 * * * 3 * * * etc.. But in another terminal I ...
1
vote
0answers
62 views

Simple tcp capture tool - output results like chat session? [closed]

I seek a tool which will capture TCP traffic with the resulting output looking almost like an iPhone SMS conversation. Something like: timestamps client stuff is left justified / green server stuff ...
-1
votes
2answers
155 views

block all packets in windows 7 (so nothing appears in wireshark)? Can anything locally installed do it?

is it possible to block all packets in windows 7, so that nothing appears in wireshark? I have tried choosing Block all for incoming. for outgoing, I see it has no block all option, just a block ...
0
votes
0answers
41 views

ZyXel ES-2024 - Mirrored port showing duplicated traffic

I have a ZyXel ES-2024 PWD switch. I would like a computer plugged into port 26 to see all traffic that passes through port 2, both inbound and outbound. I have configured port mirroring for the ...
2
votes
0answers
66 views

replay decrypted ssl traffic with tcpreplay

I have an pcap format from some https traffic from one of my web-servers. So I can use the key from my webserver to decrypt the traffic in wireshark. The problem I'm now facing is that I can't get an ...
3
votes
1answer
163 views

Need help understanding capturing from Wireshark?

I am having issues with my FTP servers. Connecting, sending and receiving fail sometimes, and it is not consistent. I manage to capture and filter by IP the packets, I just need pointers on what can ...
0
votes
1answer
73 views

Wireshark seems to ignore my filters

I'm trying to make use of Wireshark 1.10.6 for Windows and I want to only capture the traffic to port 443 (to diagnose some weird HTTPS problems I'm having). So I open Capture -> Capture Filters... ...
1
vote
1answer
690 views

Understand wireshark capture for ssh key exchange

I need to understand SSH key exchange, I have tried to read RFC document but it seems very difficult to understand so I have captured packets using wireshark ,I found various packets for ssh ...
2
votes
2answers
73 views

EC2 hosting, trying to understand network security model

We are hosting few virtual machines at amazon. Security groups and other configurations are set up to allow access only from desired addresses and to desired parties. The machines do talk with each ...
0
votes
0answers
117 views

Exporting SNMP OID values from wireshark capture?

I am trying to figure out how I can export the SNMP OID values that wireshark picked up. My issue is that when I export the raw data it is all together and not seperated. All I want to to is get only ...
31
votes
3answers
2k views

ISP broadcasting all IP-packets, so I can see traffic of other clients from ISP

Recently I wondered why my router shows a constant downstream of 5 MBit/s, while I am downloading almost no data. I discovered the "packet logging" function of my router, with which I was able to log ...
2
votes
2answers
65 views

How can I get a list of the ports that Wireshark knows?

When I need to choose a new port to use (internal to an organisation) I used to look in /etc/services. This is no longer sufficient, as Wireshark knows about many other ports that are not in ...
1
vote
2answers
126 views

Can I capture ISP SNMP information with Wireshark?

I am trying to do some heavy digging into SNMP, BPI+, ISP networks. Since wireshark can be used to capture network data, would I be able to use it to remotely capture my ISP SNMP agent information and ...
0
votes
1answer
90 views

Linux unfriendly IIS/ASP.NET :-) : Quick download on windows but slow on linux [closed]

This particular web site (gops.tay.be) serves objects quick if I try to request the page using windows, but I get them very slow if trying using linux. There is no difference if I use browser or curl: ...
0
votes
2answers
285 views

How can I create a packet capture file on a headless server for a single process?

I'm writing a python script on a headless server, and I'd like to see the packet capture output for the script. I can't run ettercap or Wireshark on the server as there is too much other noise ...
2
votes
1answer
153 views

Strange Ethernet II packets in wireshark

Looking at a wireshark capture, I'm seeing something really strange. Ethernet II packets with random data are being sent on the network. The larger packets in the capture seem to contain bits and ...
0
votes
2answers
71 views

Occasional Delay on Website Resources: Packet Loss Due to Bandwidth Cap?

My website loads more slowly than I think it should, due to a few of the assets taking an absurdly long time to download from the server. I've been trying to track down the cause of this. I'm about ...
1
vote
0answers
266 views

USB packet sniffing on Mac OS? [closed]

I want to sniff USB packets being sent from my Mac to a device. For various reasons I cannot use Linux or Windows, and I'm stuck with Mac OS. Can anyone recommend a packet sniffing method? I've tried ...
-6
votes
1answer
134 views

How to monitor all network traffic [closed]

I have installled wireshark on my server but can only monitor traffic through the local nic but all network traffic does not go through the server. I would like to monitor all network traffic. Are ...
0
votes
1answer
321 views

Wireshark - Capture syslog traffic form local workstation

I am using wireshark version 1.10.3 on windows 7 x64 enterprise. I am trying to capture all outbound UDP traffic, in particular syslog traffic. I have tried a capture filter UDP, but all I can see ...
0
votes
1answer
94 views

Network card capable of capturing a tonne of packets and not dropping them?

Edit: Our server is trying to capture packets at between 500-600Mb/s, but is dropping packets 'due to kernel'. Data is being written to SSDs, and isn't bottleneck there. What things should I look ...
0
votes
0answers
38 views

Capturing same interface with tshark with same or different capture filters

I am in stuck in a situation where an interface will be captured more than one time. Like :- $ tshark -i rpcap://1.1.1.1/lo -f "ip proto 1" -i rpcap://1.1.1.1/lo -f "ip proto 132" or (same filter) ...
2
votes
1answer
119 views

How to block own rpcap traffic where tshark is running?

Platform :- Fedora 13 32-bit machine RemoteMachine$ ./rpcapd -n ClientMachine$ tshark -w "filename" -i "any interface name" As soon as capture starts without any capture filter, thousands of ...
1
vote
0answers
86 views

NFSv3 Asynchronous Write Depends on Block Size?

I am trying to figure out if my NFSv3 deployment is performing SAFE asynchronous writes. I suspect that it is doing strictly synchronous writes, as I am getting poor performance in general. I used ...
1
vote
1answer
105 views

“tshark: There are no interfaces on which a capture can be done” in Amazon Linux AMI

My goal is to capture packets with tshark in Amazon Linux AMI. While typing tshark in the command line there's an error: "tshark: There are no interfaces on which a capture can be done" How to ...
0
votes
1answer
111 views

How can I measure the cumulative network usage of a process, from execution beginning to end

I want to measure how much bandwidth git pull uses, preferably by prefixing git command with desired program, i.e. nettally git pull Alternatively, is there some sneaky way to accumulate nethogs / ...
0
votes
0answers
92 views

How to get more NFS packet details from Wireshark?

How can I get Wireshark to give me details about NFS packets at this level of granularity? (as exemplified here here) Specifically, I am interesting in looking at the the "Stable" option toward ...
2
votes
2answers
407 views

Wireshark filtering-trying to filter out my own local ip

i'm trying to filter out my ip address(local address) "192.168.5.22" I used "ip.src != 192.168.5.22|| ip.dst !=192.168.5.22"(without quotes) and I keep seeing my address pop up im in a heavy traffic ...
0
votes
0answers
339 views

Window Size goes to zero

We are seeing an issue with our web servers where a client is doing a HTTP POST and sending xml files. We are seeing weird behavior where we are sometimes only receiving part of the data. (Sometimes ...
1
vote
1answer
62 views

Wireshark not found after installing RHEL 5.5 [closed]

After installing Wireshark in RHEL 5.5 (32bit) with following command: yum install wireshark Wireshark not found: [root@localhost ~]# wireshark bash: wireshark: command not found What ...
0
votes
2answers
149 views

server sending hpoms-dps-lstn packets to unknown IP

I have a server running pacemaker with corosync and some standard services as mails, web, ssh... When I run wireshard in my network I keep getting those packets that my server is sending to the IP ...
2
votes
3answers
7k views

Excessive 'TCP Dup ACK' & 'TCP Fast Retransmission' causing issues on network. What's causing this?

I'm getting excessive TCP Dup ACK and TCP Fast Retransmission on our network when I transfer files over the MetroEthernet link. The two sites are connected by one sonicwall router, so the sites are ...