Wireshark is a open source Network Protocol Analyzer under GNU License.

learn more… | top users | synonyms

0
votes
1answer
28 views

Capturing un-encrypted HTTPS traffic using wireshark

I am trying to capture HTTPS traffic between a client (windows machine) and a server. I would like to do this before the traffic is encrypted as I would like to analysis its contents. Is there an ...
1
vote
1answer
41 views

SVN over SSL: Many reconnects on commit

The SVN server in our company, which is self setup and hosted on EC2, is pretty slow. The setup is based on Apache and mod_dav_svn. There is also a svnserve running that seems to be used by the CI ...
18
votes
5answers
33k views

How can I sniff the traffic of remote machine with wireshark?

I can sniff the traffic of my local pc but I would like to know how to I sniff the traffic of a remote machine by wireshark? When in capture option I select remote interface and enter my remote ip ...
5
votes
1answer
3k views

Client not getting address from some DHCP server

I'm working on some embedded devices which should be connected to a large network (hundreds of devices) via ethernet and that should be configured using the DHCP protocol. What I'm experiencing is ...
0
votes
0answers
14 views

(Windows Media Encoder) TCP connection randomly fails/succeeds

We have a windows media server running and are pushing a stream using Windows Media Encoder 9 software on the client. Sometimes, it can't connect to the server and sometimes it can. I ran wireshark ...
1
vote
1answer
146 views

Multiple syn's packets before handshake?

I have a scenario, I'm analyzing ssl (decrpyt) traffic to my webserver. I'm investigating server and end-to-end delay issues. In between this I'm stuck at following traffic pattern for which I need ...
1
vote
0answers
48 views

Packet capture on ESXi host

I have an issue I am trying to track down and I believe the problem is with physical networking hardware. I have read the VMWare documentation on the pktcap-uw command and I know I can use it to dump ...
0
votes
0answers
115 views

TCP Out-of-order packets over GRE causing disconnect

I'm experiencing an issue with a small percentage of TCP connections over a GRE tunnel between two servers. The topology is basically Internet <-> GRE Tunnel <-> Backend The GRE tunnel and the ...
1
vote
0answers
90 views

Wireshark RST against TCP Zero Window

During application sharing with Microsoft Lync Client (Mac OS X), TCP ACK with RST flag is sent from my application end to Lync end against TCP Zero Window packets and call gets dropped. Image Link. ...
1
vote
2answers
51 views

What is the cause for TCP flow control misinterpretation?

The client cannot connect to our web server. I sniffed the client and web server only to found out that the client sees the TCP connection to be successful while the server see it as a failure. What ...
-2
votes
2answers
600 views

Promiscuous mode not working with ubuntu and wireshark [closed]

I am running Ubuntu Linux and have installed wireshark on it. I can see the incoming and outgoing traffic just fine. Now I want to see the traffic from other devices which are on my LAN. So, I did: ...
3
votes
4answers
2k views

pfSense not forwarding back packets

I have a pfSense box setup where my WAN interface (em0) is set up in my local network (192.168.1.100) and my LAN interface (em1) is a private network of its own (10.0.0.1). The end goal is to have the ...
14
votes
5answers
27k views

Is there a way to get wireshark to capture packets sent from/to localhost on Windows?

Is there a way to get wireshark to capture packets sent from/to localhost? When I monitor traffic going from my computer to another, or from another computer to my computer, then it works. But ...
3
votes
3answers
694 views

How would a PCAP filter look like to capture all DHCP related traffic?

As I understand it, for IPv4 I would need to capture UDP port 67 and 68, ARP, ICMP echo request and reply, and for IPv6 I would need UDP port 546 and 547, all DHCP-related multicast addresses, ...
1
vote
0answers
226 views

How to efficiently re-order packets in PCAP files based on timestamp?

I have a PCAP file which contains many packets. They are however out of order based on the timestamp (it is actually randomized). What is the best way to efficiently sort the PCAP packets based on ...
-2
votes
1answer
42 views

Wireshark Data view

I would like to view the data from the capture in plain text, but when I do the "Follow UDP Stream" all I see is: ..........x..7..L....7.... ..7..Ver 6.41 Dec 21 2011...d..7..~PIN2Width...a..7..~...
2
votes
2answers
2k views

How to parse OpenFlow packets using tcpdump capture file programmatically

I am working with OpenFlow packets and am analyzing the network via tcpdump. Currently, I use the WireShark GUI to parse the generated capture file and it does serve my need. However, I was ...
3
votes
1answer
288 views

Windows Server FIrewall (2012) Ipsec tunnel problems

I am new to Ipsec tunnels. I have successfully created a tunnel to a Cisco offsite router using a preshare key at a supplier. In Endpoints 1 : I have the servers ip address and the remote servers ip ...
4
votes
5answers
10k views

Wireshark filter to only capture Incoming Packets?

I am trying to setup a Filter (so my log files aren't massive) that will capture only incoming traffic. I have looked on http://wiki.wireshark.org/CaptureFilters but so far have been unable to find a ...
1
vote
1answer
43 views

High Client Network Utilization Accessing File Share

When users try to access specific folders within our file server, their computer will sometimes lock up and stop responding. These folders have images that average 200KB in size. I've duplicated the ...
3
votes
3answers
27k views

How to monitor VPN traffic with Wireshark on Windows 7?

I'm running Wireshark 1.6.7 (latest available release) x64 on Windows 7 x64. I only have a single network card on this computer, and Wireshark shows only it as an available adapter to capture packets ...
0
votes
1answer
34 views

MCU packet capture

I am trying to do a packet capture of a video conference hosted with CISCO [Codian] MCU. The instructions for capturing SIP packets with Wireshark are available. I also configured MCU to accept SIP ...
0
votes
0answers
49 views

after 487 Requst terminated there is no ACK

We have a weird problem. After a non successfull call (like a very long number and such), the phone (Yealink-any) gets "call time out" and then loses it registration. I ran wireshark and noticed that ...
1
vote
0answers
77 views

How to get the serial console logs via ethernet port? [closed]

I have a board running Busybox linux and for my debugging activities I always have to connect physically to the serial port to get the serial console prints and logs.I believe using netcat tool we ...
18
votes
4answers
91k views

What causes duplicate ACK records?

We're reviewing Wireshark captures from a few client machines that are showing multiple duplicate ACK records which then triggers retransmit and out-of-sequence packets. These are shown in the ...
3
votes
2answers
7k views

Understand wireshark capture for ssh key exchange [closed]

I need to understand SSH key exchange, I have tried to read RFC document but it seems very difficult to understand so I have captured packets using wireshark ,I found various packets for ssh ...
19
votes
4answers
54k views

How can I filter https when monitoring traffic with Wireshark?

I want to observe the HTTPs protocol. How can I use a Wireshark filter to do that?
1
vote
0answers
101 views

Should I disable the Nagle Algorithm for Outlook / Exchange RPC/HTTP communication?

I'm investigating reasons why several Outlook clients in non-cached mode are having delays communicating... resulting in Outlook hanging. My suspicion is that a Netscaler, or intermediate device (? ...
-1
votes
1answer
122 views

Why is wireshark capturing packets not destined to my host? [closed]

My IP was configured as 192.168.101.91, I don't understand why my host is receiving packets which have a destination address of 192.168.87.203(and many other IPs which I didn't capture) given that I ...
5
votes
5answers
15k views

How to capture Wireshark packets when using a switched network in Windows

I’ve been asked by our SIP trunk provider to run a Wireshark trace on the network when we receive calls. The issue I’m having is that if I run Wireshark from a laptop plugged into the main switch I ...
5
votes
2answers
521 views

How can I easily locate a specific TCP conversation in two separate (and large) packet captures using wireshark?

Occasionally, I'll need to compare packet captures (usually wireshark or tcpdump) that are collected from both sides of a TCP conversation. Sometimes the two hosts involved are very "chatty" so I'll ...
6
votes
4answers
18k views

isolate application and check what packets it is sending over the internet

I am not sure that this sort of question is appropriate here, so forgive me if I'm wrong. Here is a problem: I want to see what a specific program is sending to the internet, but the thing is that on ...
0
votes
1answer
146 views

Too Many HTTP Requests from one source

We are having an issue at one of our customer sites where Tripwire is flagging events when more than 1000 HTTP connections are being individually created from different IP addresses within a span of ...
1
vote
0answers
105 views

How to find ACK for multiple segments using Wireshark?

I'm trying to use Wireshark to find a ACK (for TCP connections) send my the server which ACKs multiple segments as opposed to just ACKing 1 segment. Is there a wireshark filter than can help me with ...
2
votes
0answers
197 views

Wireshark only capturing broadcast packages [closed]

I've ran Wireshark multiple times on my notebook for wireless networks verifying mobile packages for my devices and it used to work most of the time. I haven't been able to monitor my traffic today ...
0
votes
0answers
109 views

Remote packet capturing using fifo and dumpcap

I'm currently working on two linux servers where one server is running in 2.6.18-274.el5(Server A) and the second one in CentOS 7 (Server B). My requirement is to capture the packets of the network ...
0
votes
1answer
151 views

How to ping a host with different MTU size to simulate icmpv6 packet too big scenario?

As the Title states,I want to check whether my host will actually send a ICMPv6 packet too big if i send a packet with beyond the defined MTU size.I don't have a cisco router(extended ping) to try out ...
0
votes
0answers
252 views

Unknown device showing up in network scan

I need some help finding a device that has been showing up whenever I scan my network using Spiceworks' "Inventory" scan. I can ping the device, but nslookup returns a non-existent domain, and ...
2
votes
3answers
2k views

While analyzing a network interface using WireShark, which device's timestamp is recorded?

OK, this may seem trivial but due to the nature of testing required for my application, I need to get precise timestamps. I am using WireShark to analyze packets. Suppose I have a network with 2 ...
1
vote
0answers
419 views

Creating a Network Diagram with .pcap [closed]

I have a Wireshark .pcap Capture of around 500k packets and I would like to enumerate a Network Diagram with all the Routers, Switches, PCs etc. Is there a tool that I could use to automatically ...
0
votes
0answers
489 views

Expanding HAProxy health check to monitor MongoDB primary and secondary state

Follow up question regarding the MongoDB health check with HAProxy How to construct a MongoDB Health Check in HAProxy? The current solution works well when the focus is on determining if mongo ...
6
votes
2answers
259 views

TCP acks are paused, then resumed, then paused again. Why?

I would like some help finding the reason for the reduced data transfer rate in my application. I have 12 embedded systems and a Linux server. The embedded systems send data to the server over TCP on ...
2
votes
0answers
125 views

Difference between ping time and time for first ACK answer

While creating a packet performance monitor I come across the follow problem: if I ping a server, I get about 4ms. If I calculate the time between a POST and its first ACK, I get about 25us (...
1
vote
1answer
506 views

Catalyst 3560G SPAN session not mirroring IGMP packets

I am developing a device which acts as a multicast host, and want to observe it as it responds to IGMP Queries. My Catalyst 3560G is set up as follows (full config below): Port 0/1 is a TFTP server ...
0
votes
1answer
519 views

wireshark extract w3c log file

Does anyone know how I would go about extracting urls in w3c extended log format from a wireshark pcap capture file?
1
vote
2answers
107 views

In WireShark, how can I filter results so that it shows only a single line per source?

I'm using WireShark to find any systems pointed to an old system we're decommissioning and rather than showing the same IP 1,000 times I'd like to use a filter that will only show each IP source once. ...
1
vote
1answer
92 views

Wireshark does not capture second IP address traffic

I have interface with ip address: 192.168.1.3. I'm adding a second ip address: 192.168.1.4 to that interface using: ip address add Then from other computer (192.168.1.10), I ping those address & ...
14
votes
3answers
17k views

Stopping the WinPcap Packet capture service

I just installed WireShark, which also installed WinPcap. During the installation it said "do you want xxx to start automatically", which I answered yes. Now I would like to stop the service when I ...
10
votes
1answer
8k views

Unable to open WireShark in CentOS 6.5

I have installed WireShark in CentOS 6.5 with the following packages using Yum. Dependencies Resolved ================================================================================ Package ...
2
votes
3answers
3k views

HTTP not finishing over LAN. Hardware cause?

On a customer server running Apache 2.2 on Windows server 2012 we're noticing that from time to time, some requests to the server never finish. Using wireshark I've found a bunch of duplicate ACKs get ...