Wireshark is a open source Network Protocol Analyzer under GNU License.

learn more… | top users | synonyms

0
votes
0answers
18 views

How to change mode from manged to monitor on mon0 interface on NIC?

I am connecting to a home router using wifi. The detais of my wireless cards are as follows: #lspci 01:00.0 Network controller: Qualcomm Atheros AR9485 Wireless Network Adapter (rev 01) #lspci -vv ...
0
votes
1answer
23 views

user agent in http or https request

Is there any way that I can differentiate, the HTTP or HTTPS packets are coming from browser or not ? specially for https request.There is User-Agent field in packet in Http,but I could not found ...
1
vote
1answer
31 views

Why do I see so many ssh packets in only a couple seconds?

I am learning how to use tshark so I can better understand networking. As a user the protocol I most often use day to day is SSH. So I thought I'd start a capture filter on ssh packets on my server ...
0
votes
0answers
38 views

Only capture HTTP post requests through tcpdump

For security purposes we want to list all POST requests URI's that are used in our applications (so we would disable POST through mod_security except for those URI's). The idea is to use tcpdump to ...
-5
votes
0answers
25 views

Python code to filter packets by protocol like in wireshark [closed]

I'm not sure if this question should go to stackoverflow or here, but since this is about packets and protocol, I figure it should go here. I have a program that can read raw bytes in packet data. ...
2
votes
1answer
41 views

Understanding LDAP traffic with ActiveDirectory

In looking at LDAP traffic through Wireshark I was curious to understand the conversation between the a windows client and Active Directory. Each conversation would vary to less than 80k bytes. But ...
-3
votes
1answer
40 views

Where to optain my client key for SSL decryption? [closed]

example.pcap is a traffic capture I have made on my local Linux box of and now I would like to decrypt it. tshark -o "ssl.desegment_ssl_records: TRUE" -o "ssl.desegment_ssl_application_data: ...
2
votes
1answer
879 views

Unable to open WireShark in CentOS 6.5

I have installed WireShark in CentOS 6.5 with the following packages using Yum. Dependencies Resolved ================================================================================ Package ...
0
votes
0answers
19 views

How to meet the arp table and the network toology with wireshark

I'm wondering if is possible meet(see) the arp table in a network traffic with wireshark or find some way to build manually the arp table, and how to see the router and swiches of topology( for ...
3
votes
1answer
55 views

Corrupt DNS requests

Sometimes in some network captures that include my DNS server, I find there are failed lookups for what seem like invalid requests. When viewed in Wireshark these show up with what looks like escaped ...
0
votes
0answers
14 views

upnp keep alive packet

I took a wireshark packet dump and Iam able to track the initial MSEARCH, SSDP out message to multicast IP etc., from my-device. but how do I see the incoming keep alive message from the other-device ...
2
votes
0answers
107 views

Troubleshooting Packet Loss on pfSense + Ubiquiti UniFi (Wireshark maybe?)

I'm dealing with an annoying situation in a small network in my church, which I'm the primary volunteer IT caretaker, of about 20 PCs, give-or-take. We're in Chattanooga, home of Gigabit internet, so ...
0
votes
1answer
35 views

nmap repeats the scan to a specific port multiple time

I scanned a subnet (16 hosts) while dumping the network traffic with wireshark. I did it 2 times and I noticed that in the traffic there is the normal SYN-SYN/ACK and SYN-RST from open/closed port, ...
0
votes
2answers
59 views

Wireshark “length” column - what does it include?

Can anyone tell me what the "Length" column in WireShark refers to? I'm pretty sure it's the "size" of the entire frame on the wire. I did some calculations, but I didn't get the number that ...
1
vote
1answer
98 views

HTTP not finishing over LAN. Hardware cause?

On a customer server running Apache 2.2 on Windows server 2012 we're noticing that from time to time, some requests to the server never finish. Using wireshark I've found a bunch of duplicate ACKs get ...
1
vote
0answers
77 views

FTP Connection Suddenly hanging on 'waiting for welcome message'

We've had our FTP server (Proftpd) running on Ubuntu Server 12.04 for over 12 months now with no connection issues. In the last few days there have been issues with slow connections to the server, ...
0
votes
0answers
20 views

Wireshark: fully customized output from TShark?

I'm using TShark to analyze some packet capture logs and would like to produce some nice lists from the logs. I want the lists to be in text format, so they could be viewed/printed/etc. easily on ...
0
votes
0answers
25 views

Early tear down of communication

I have an application which performs an LDAP search which works in one domain but not in the other, when analyzing the packets sent between the application server and the domain controller being ...
-1
votes
1answer
48 views

Analyzing twitter packets [closed]

Thanks for your time. I'd like to find a way if a client has made a 'GET' or a 'POST' request for twitter. We are currently doing an educational project and we wanted to understand how we can achieve ...
1
vote
1answer
75 views

How can I write a filter to get tcp sequence number inconsistency?

I am using WireShark 1.12 and I am trying to filter SYN , SYN/ACK , ACK by inconsistencies. Would anyone know how to write a filter for this version? Currently I am using this: tcp.ack & tcp.seq ...
-3
votes
1answer
64 views

How do I get statistics on HTTP traffic from Wireshark? [closed]

I have captured traffic with dumpcap and filtered http only with Wireshark. I want to see statistics about that http traffic. For example: requests grouped by method and URL, ordered by number of ...
1
vote
1answer
187 views

Can firewall block packets visible in Wireshark?

Wireshark shows that an RTP package is received on a PC. Is it possible that despite detection by Wireshark, something (firewall?) is still prevent the application listening to the required port on ...
0
votes
0answers
50 views

Why am I getting ICMP traffic with wireshark DNS filter?

I am surfing the web and looking at dns traffic in wireshark with the "dns" filter active. When I ask for a non existant domain or subdomain I get a Destination Unreachable (Port Unreachable message). ...
3
votes
2answers
541 views

Why is Wireshark not capturing certain POST requests?

If I use this filter in Wireshark: http.request.method == "POST" and use the vote buttons to vote for a stack exchange question, then Wireshark captures the corresponding POST request. I can also see ...
2
votes
0answers
94 views

RTP analysis - Discerning ptime (packetization time) for a given VoIP packet capture

I would like some help on the subject of an automated way of discerning the average packetization time (ptime) of a VoIP call's packet capture. The reason I am not depending on the value in the SDP ...
0
votes
1answer
24 views

Is it possible to mimic the client of a https web service

There is such a windows application that communications with the server through https protocol, it is an auction tool and works only several hours per month. I have captured network packets (by ...
0
votes
1answer
20 views

Why am I seeing prefixed/duplicated packets coming from a comcast device?

I'm looking at traffic my CPE from Comcast in Wireshark, and for every packet, there is an additional packet that is the exact same, except for 4 additional bytes at the beginning of the frame ...
0
votes
0answers
43 views

wireshark not showing netflow source addresses nfdump does

Hi guys i'm experiencing following issue, hope someone can explain me what's happening. I got a pcap with a dump of udp packets containing netflow data. I've used tcprewrite and tcpreplay to ...
0
votes
1answer
18 views

See historical packet receipt statistics in Windows

I know this is a long shot, but it would be really useful to me right now. Does anyone know of a Windows function or 3rd party tool that can show stats about the receipt of packets on a network ...
1
vote
0answers
88 views

Can I use tshark to write SSL-decrypted packets to a file?

I have a PCAP file containing SSL-encrypted HTTP traffic and the private key from the relevant web server. I'd like a PCAP file that contains the decrypted HTTP traffic to feed into a different tool. ...
2
votes
1answer
75 views

Intermittent switch failure and data flooding, hardware capacity?

We are using a switch (ZIO-SW500) connected to the building main network and we suffers from intermittent network halt. Normally the network works well. But, sometimes traffic designated to other ...
0
votes
1answer
174 views

SIP INVITE packet has WAN address rather than call manager LAN IP

I am using SIP between two subnets (192.168.3.0/24 and 192.168.30.0/24) each connected via VPN. I have a call server on 192.168.3.100, and two phones 192.168.30.118 (Ext. 3128) and 192.168.30.119 ...
-5
votes
1answer
139 views

how to sniff from a remote machine? [closed]

I have a PC and a tablet that connected to a TP-Link ADSL modem. PROBLEM: I want to see the packets that send and receive from my modem not my PC( to see both wire and wireless packets) I search ...
1
vote
2answers
2k views

Wireshark TCP Window Size Value

I am debugging an application with Wireshark and watching the TCP Window Size value shrink on one side of the communication. If the packet's TCP section shows a "Window size value: 1", does that mean ...
0
votes
0answers
79 views

Wireshark - view complete packet

I am trying to use Wireshark to capture some HTTP packets, but when the packet is too long, Wireshark truncates it in its window. The bottom window still shows the entire packet, but I am not able to ...
2
votes
2answers
200 views

Packets returning but traceroute fails

I get this output from traceroute: #traceroute -i eth1 -s 192.168.12.14 192.168.1.72 1 192.168.12.1 (192.168.12.1) 1.410 ms 2.076 ms 2.251 ms 2 * * * 3 * * * etc.. But in another terminal I ...
-1
votes
2answers
299 views

block all packets in windows 7 (so nothing appears in wireshark)? Can anything locally installed do it?

is it possible to block all packets in windows 7, so that nothing appears in wireshark? I have tried choosing Block all for incoming. for outgoing, I see it has no block all option, just a block ...
0
votes
0answers
55 views

ZyXel ES-2024 - Mirrored port showing duplicated traffic

I have a ZyXel ES-2024 PWD switch. I would like a computer plugged into port 26 to see all traffic that passes through port 2, both inbound and outbound. I have configured port mirroring for the ...
2
votes
0answers
82 views

replay decrypted ssl traffic with tcpreplay

I have an pcap format from some https traffic from one of my web-servers. So I can use the key from my webserver to decrypt the traffic in wireshark. The problem I'm now facing is that I can't get an ...
3
votes
1answer
264 views

Need help understanding capturing from Wireshark?

I am having issues with my FTP servers. Connecting, sending and receiving fail sometimes, and it is not consistent. I manage to capture and filter by IP the packets, I just need pointers on what can ...
0
votes
1answer
109 views

Wireshark seems to ignore my filters

I'm trying to make use of Wireshark 1.10.6 for Windows and I want to only capture the traffic to port 443 (to diagnose some weird HTTPS problems I'm having). So I open Capture -> Capture Filters... ...
1
vote
1answer
2k views

Understand wireshark capture for ssh key exchange

I need to understand SSH key exchange, I have tried to read RFC document but it seems very difficult to understand so I have captured packets using wireshark ,I found various packets for ssh ...
2
votes
2answers
85 views

EC2 hosting, trying to understand network security model

We are hosting few virtual machines at amazon. Security groups and other configurations are set up to allow access only from desired addresses and to desired parties. The machines do talk with each ...
0
votes
0answers
160 views

Exporting SNMP OID values from wireshark capture?

I am trying to figure out how I can export the SNMP OID values that wireshark picked up. My issue is that when I export the raw data it is all together and not seperated. All I want to to is get only ...
31
votes
3answers
2k views

ISP broadcasting all IP-packets, so I can see traffic of other clients from ISP

Recently I wondered why my router shows a constant downstream of 5 MBit/s, while I am downloading almost no data. I discovered the "packet logging" function of my router, with which I was able to log ...
2
votes
2answers
100 views

How can I get a list of the ports that Wireshark knows?

When I need to choose a new port to use (internal to an organisation) I used to look in /etc/services. This is no longer sufficient, as Wireshark knows about many other ports that are not in ...
1
vote
2answers
164 views

Can I capture ISP SNMP information with Wireshark?

I am trying to do some heavy digging into SNMP, BPI+, ISP networks. Since wireshark can be used to capture network data, would I be able to use it to remotely capture my ISP SNMP agent information and ...
0
votes
1answer
111 views

Linux unfriendly IIS/ASP.NET :-) : Quick download on windows but slow on linux [closed]

This particular web site (gops.tay.be) serves objects quick if I try to request the page using windows, but I get them very slow if trying using linux. There is no difference if I use browser or curl: ...
0
votes
2answers
470 views

How can I create a packet capture file on a headless server for a single process?

I'm writing a python script on a headless server, and I'd like to see the packet capture output for the script. I can't run ettercap or Wireshark on the server as there is too much other noise ...
2
votes
1answer
275 views

Strange Ethernet II packets in wireshark

Looking at a wireshark capture, I'm seeing something really strange. Ethernet II packets with random data are being sent on the network. The larger packets in the capture seem to contain bits and ...