Wireshark is a open source Network Protocol Analyzer under GNU License.

learn more… | top users | synonyms

0
votes
2answers
27 views

Wireshark Packet Capture Data Data ACK Confusion

I understand how acks work and windowing works. What I am not getting is why am I seeing the following behavior in packet captures Client Server data1-----> data2-----> <--------ack ...
0
votes
1answer
33 views

Capture traffic to/from a network node

I would like to capture all traffic to/from a network node. I don't know much about the network setup there, here's what I know: The target node is a Linux server, which has no access to internet, ...
0
votes
0answers
16 views

FileZilla FTP Error - 426 Connection Closed; aborted transfer of “filename”

I'm trying to transfer a file to an FTP server but I get the error on the title: "426 Connection Closed; aborted transfer of "XYZ". Here are some info: I can establish the connection, change ...
-2
votes
1answer
22 views

Advanced network (wire shake) [closed]

What are the Hex values (shown the raw bytes panel) of the two NICS Manufacturers OUIs? already I know Wireshark is a GUI network protocol analyzer. It lets you interactively browse packet data from ...
0
votes
0answers
21 views

Why sar ETCP shows TCP retransmission but wireshark tcp.analysis.retransmission doesn't

I am trying to investigate the cause of TCP retransmission. When I use sadc and sar, it shows there are tcp retransmission; but when I use wireshark on all of the server's interfaces, it doesn't show ...
0
votes
1answer
22 views

TCP connection RST after FIN, ACK

I have a situation that would like to clarify with the experts here. I am no network expert so maybe it's normal, but i rather ask. We are trying to diagnose a problem between two servers, both are ...
0
votes
0answers
20 views

Transferring data to Active FTP server fails from DMZ but works fine from LAN

I know there are a ton of similar questions already, but I've read through just about everything I could find and am still having trouble resolving my specific issue. Problem: I am having difficulty ...
0
votes
0answers
20 views

Which wireshark output format aligns closest with actual SMTP data?

I have a packet capture of a SMTP session (containing an email with international characters). I'd like to extract the message data from that and try reproducing an issue. When I follow the TCP ...
1
vote
1answer
42 views

Debugging why network packets are being dropped

Preface: I have an application that I am currently testing out that runs on RHEL 6. The setup for my test is the application installed on a embedded device, connected by an Ethernet cable to PC that ...
1
vote
2answers
32 views

How do I see absolute time stamps in Wireshark?

There is an example of pcap file opened in wireshark The second column is time. Is it possible to see absolute timestamps here instead of relative?
0
votes
0answers
9 views

What filter in Wireshark, can return the ACKs packets employed to complete TCP three-way handshakes instigated by a particular party?

What filter in Wireshark, can return the ACKs packets employed to complete TCP three-way handshakes instigated by a particular party? For instance if machine A requests for a TCP connection to be ...
1
vote
1answer
22 views

Is there a quick way to determine what applications are present within a Wireshark capture? If so how

Is there a quick way to determine what applications are present within a Wireshark capture? If so how As most captures contain over 10 thousand lines, I can't expect people would by hand check which ...
-2
votes
2answers
50 views

Why do different packet analyzers sometimes produce different results?

I ran wireshark and windump at the same time. Both packet analyzers use the same winpcap library. However after doing a row by row comparison of the results I noticed both every column between the 2 ...
2
votes
1answer
26 views

Meaning of [MASKED] in pcap file

What does [MASKED] mean? Is it related to websocket proto? Can i state that 168.109.7.151 initiated connection closing?
1
vote
2answers
24 views

tcpdump http containing non expected payload bytes

I am monitoring an openvpn link with tcpdump a la tcpdump -i tun5 -w capture.dump -W 100 -C 100M -s 0 -n There is http/xml traffic going over that link which is basically caputered just fine. However, ...
2
votes
2answers
71 views

How do you continuously run Wireshark without eating up all of my RAM?

I need to run Wireshark all night to capture packets from a certain IP address. I notice the longer Wireshark runs, the more RAM it takes up because it stores all of the packets found during the run. ...
-1
votes
1answer
25 views

Is it possible for SYN/ACK to not be immediately proceeded by a SYN in a network trace

I'm writing a simple program to calculate initial RTTs from a network capture I took using Wireshark. To do this I wan't to calculate the difference in time between the SYN and the SYN/ACK. I don't ...
0
votes
0answers
52 views

TCP sockets dying on LTE

I have about 25 audio streaming clients built on an i.mx6 arm platform, running linux version 4.3.0-rc2-00019-gbcee19f-dirty #36 SMP Tue Feb 9 15:27:51 EST 2016 armv7l I find on two specific units ...
0
votes
1answer
58 views

How can I see what is the number of embedded objects used by a site in html from a wireshark trace?

I have recorded a wireshark trace and visited some websites. I exported the trace as a CSV file. How can I see the number of embedded objects in each of the sites I visited? Thanks.
-1
votes
1answer
37 views

the MAC header of captured wireshark packets

I have been reading about the IEEE 802.11 and especially on the MAC layer, and i noticed that it contains a lot of informations, but when i start to capture with wireshark with my wireless card, the ...
1
vote
1answer
35 views

udp broadcast on port 25860

I used wireshark on my local network (to test it), and i noticed that there is a lot of udp packets send one broadcast, and the majority is coming from only one host. Theses udp packets are send on ...
0
votes
0answers
35 views

Analyzing SSL Encryption Alerts

I have captured the traffic between my machine and my server using Wireshark, trying to find why some SSL requests fail. I've read this and this post about debugging SSL entries, and I'm able to find ...
0
votes
1answer
26 views

PCAP traffic frame length short

I'm trying to make traffic and capture it using pcap file. I get pcap file from CAIDA(caida.org) site. This pcap file too big and doesn't have ethernet header. So i splitted pcap file to small size(40 ...
0
votes
1answer
25 views

Wireshark returns error on filters from Windows command prompt

It works when i use GUI with the following filter http.request.method == "GET" but when i run tshark is aways returns error tshark -i 1 -Y 'http.request.method == "GET"' tshark: Syntax error near ...
-1
votes
1answer
37 views

Can a remote connetion from outside a LAN be invisible to protocol analyzers such as Wireshark, Process Hacker, Nbtstat? [closed]

When studying the behavior of trojans and (RAT) Remote Access Trojans this question came up. Can an attacker create a trojan that could trick the OS or the NIC into hiding a remote connection to a ...
0
votes
0answers
41 views

Wireshark doesn't filter correctly http.host

When trying to filter for a specific host with http.host=="abc.com" it shows me everything instead of only the related packets. What am I doing wrong? Wireshark 1.12.6
1
vote
1answer
46 views

how can i setup tshark to capture full URL uri request ip and time stamp

How can I setup tshark to capture full URL uri request ip and time stamp. I have tried this: tshark -V -R "tcp.port ==80 && (http.request || http.response)" | awk "/Hypertext Transfer ...
0
votes
2answers
77 views

Wireshark unable to capture squid traffic at port other than 3128

I use the following display filters to analysis traffic between client and squid3 server with Wireshark but nothing shows up. http && tcp http && tcp && tcp.port == 3888 If ...
1
vote
2answers
48 views

How to send captured packets to a different destination?

I have some data packets captured using tcpdump in a pcap file. Now I want to send those packets to a another destination. how I can achieve this?
1
vote
1answer
106 views

Can't connect to python server on LAN

So I have this python server which just returns the uppercase sentence which came as a input: from socket import * serverPort = 12000 serverSocket = socket(AF_INET, SOCK_DGRAM) ...
1
vote
1answer
57 views

How do I export both Packet bytes and Summary line using tshark?

I can export ascii using Wireshark with exactly the same settings as in the example from the documenation, i.e. Only Summary line and Packet bytes exported. Since I have many files to do this with I ...
1
vote
0answers
16 views

detect process accessing network ip on Windows server 2012 R2 [closed]

I tried to identify processes that try to access certain IPs(akamai - 23.0.174.35...). I used MS Message Analyzer but it seams that it can not give definitive results since I get different name and ...
2
votes
0answers
33 views

is the disconnection caused by too many TCP Dup Ack?

I am investigating a service disconnection issue and I am a bit confused by some of the Wireshark logs. Need some help to find out how the disconnection was caused. Ideally when A sends an ACK to B ...
1
vote
1answer
186 views

Wireshark shows “TCP Dup Ack” on SACK after each regular ACK

I have a TCP session captured via switch port mirroring and tcpdump. When viewing it (in Wireshark), I see the same pattern whenever I send a message; here's an excerpt of the outbound packets (I ...
0
votes
1answer
23 views

wireshark sort by TCP dup ack and sort by worst offender?

I have lots of hosts on this network, I want to find out who is the "noisiest", I captured 500k packets and many hosts have TCP dup ack (and other things), what regex should I use to sort by and then ...
0
votes
0answers
142 views

Error decrypting SSL traffic in Wireshark

I am trying to decrypt an SSL connection using Wireshark. It doesn't use DH, so I understand it should be possible to decrypt using the private key (which I have.) The following log shows the error. ...
0
votes
0answers
152 views

http cookie contains datr not working (none packets is returned) wireshark

When I filter in wireshark: http.cookie contains datr none packets is returned, the list in null. What's I going wrong?
0
votes
1answer
42 views

Is the output complete after omitting [TCP segment of reassembled PDU]?

If the tshark -r dumpfile output contains the type [TCP segment of a reassembled PDU], as in 81 3.164109000 4.5.6.7 -> 12.13.14.15 TLSv1.2 609 Application Data 83 3.164523000 4.5.6.7 -> ...
0
votes
1answer
27 views

Capturing un-encrypted HTTPS traffic using wireshark

I am trying to capture HTTPS traffic between a client (windows machine) and a server. I would like to do this before the traffic is encrypted as I would like to analysis its contents. Is there an ...
1
vote
1answer
38 views

SVN over SSL: Many reconnects on commit

The SVN server in our company, which is self setup and hosted on EC2, is pretty slow. The setup is based on Apache and mod_dav_svn. There is also a svnserve running that seems to be used by the CI ...
0
votes
0answers
14 views

(Windows Media Encoder) TCP connection randomly fails/succeeds

We have a windows media server running and are pushing a stream using Windows Media Encoder 9 software on the client. Sometimes, it can't connect to the server and sometimes it can. I ran wireshark ...
1
vote
0answers
45 views

Packet capture on ESXi host

I have an issue I am trying to track down and I believe the problem is with physical networking hardware. I have read the VMWare documentation on the pktcap-uw command and I know I can use it to dump ...
0
votes
0answers
109 views

TCP Out-of-order packets over GRE causing disconnect

I'm experiencing an issue with a small percentage of TCP connections over a GRE tunnel between two servers. The topology is basically Internet <-> GRE Tunnel <-> Backend The GRE tunnel and the ...
1
vote
0answers
88 views

Wireshark RST against TCP Zero Window

During application sharing with Microsoft Lync Client (Mac OS X), TCP ACK with RST flag is sent from my application end to Lync end against TCP Zero Window packets and call gets dropped. Image Link. ...
1
vote
2answers
50 views

What is the cause for TCP flow control misinterpretation?

The client cannot connect to our web server. I sniffed the client and web server only to found out that the client sees the TCP connection to be successful while the server see it as a failure. What ...
-2
votes
2answers
533 views

Promiscuous mode not working with ubuntu and wireshark [closed]

I am running Ubuntu Linux and have installed wireshark on it. I can see the incoming and outgoing traffic just fine. Now I want to see the traffic from other devices which are on my LAN. So, I did: ...
3
votes
4answers
2k views

pfSense not forwarding back packets

I have a pfSense box setup where my WAN interface (em0) is set up in my local network (192.168.1.100) and my LAN interface (em1) is a private network of its own (10.0.0.1). The end goal is to have the ...
3
votes
3answers
536 views

How would a PCAP filter look like to capture all DHCP related traffic?

As I understand it, for IPv4 I would need to capture UDP port 67 and 68, ARP, ICMP echo request and reply, and for IPv6 I would need UDP port 546 and 547, all DHCP-related multicast addresses, ...
1
vote
0answers
197 views

How to efficiently re-order packets in PCAP files based on timestamp?

I have a PCAP file which contains many packets. They are however out of order based on the timestamp (it is actually randomized). What is the best way to efficiently sort the PCAP packets based on ...
1
vote
1answer
134 views

Multiple syn's packets before handshake?

I have a scenario, I'm analyzing ssl (decrpyt) traffic to my webserver. I'm investigating server and end-to-end delay issues. In between this I'm stuck at following traffic pattern for which I need ...