Questions tagged [wireshark]
Wireshark is an open source Network Protocol Analyzer under GNU License.
511
questions
0
votes
1
answer
928
views
Where is the ACK to the packet in frame 76? [closed]
I am working through Kurose's book as part of a class and this particular exercise involves submitting a .txt file to the server and capturing this transfer and the server's response.
In one exercise ...
1
vote
1
answer
949
views
VoIP one-way audio, only when call initiated from one side
I am setting up some new switches and VLANs and I am getting trouble with our pre-existing Asterisk VoIP set-up.
Most calls work ok. Some get just one-way audio. I tried to narrow it down to this ...
-1
votes
1
answer
915
views
Python sockets: TCP errors in linux, while same program works fine on Windows10
I'm trying to communicate with a commercial power supply device via TCP/IP using python sockets.
I tried using both a virtual linux(centos8stream) and virtual windows10, both running at the same ...
1
vote
1
answer
176
views
Why is my PC doing more than one DNS query for www.ietf.org? [closed]
I'm doing an exercise for a class where I have to flush the DNS cache and then visit www.ietf.org and capture the packets. I got this:
The selected query and response are the "main" ones. ...
1
vote
0
answers
264
views
TLS 1.2 Failure
I am using Webinspect to scan sites. When going through Webinspect, I get "the client and server cannot communicate because they do not possess a common algorithm".
From the same system, ...
0
votes
0
answers
469
views
Slow connection to production MongoDB due to TLS handshake retransmits
I have question about something that had me tearing my hair out for the past two days.
Long story short: specifically over my home network, my connection to our work MongoDB is stupidly slow. Over my ...
0
votes
1
answer
762
views
How can wireshark.exe on windows read from a pcap file stream?
This is probably less a wireshark question and more a "how do I pipe a file into an application" on windows.
On linux, I can capture a pcap file on another host with tcpdump and pipe it back ...
2
votes
1
answer
298
views
Measuring network bandwidth usage
One VM is sending data to another VM using rsync, both VMs are hosted on the same machine. I've got the task to measure the network bandwidth usage between both VMs and plot it.
Plotting is easy once ...
0
votes
1
answer
1k
views
tshark : in a HTTP POST request how get form datas in a pretty output?
I'm a teacher and I want to simulate with my students a MITM attack. The goal is to show why the https protocol must be always used.
On debian, I installed tshark. All works fine, when I run the ...
0
votes
1
answer
972
views
How can I isolate a single TCP connection on Wireshark?
I just started using Wireshark for network troubleshooting purposes and I am a little confused about one thing. I requested a webpage and for the next 10s I monitored the data. I then used the filter ...
0
votes
1
answer
173
views
Can I determine a EWOULDBLOCK/EAGAIN situation from a pcap/tcpdump
Is there a way I can determine if a certain message resulted in an EWOULDBLOCK/EAGAIN return code to the server which sent the packet?
The server was sending messages to the client
At time 10,the ...
0
votes
0
answers
43
views
Can't track applications network communication under same machine
I have a network application environment of 7 applications communicating with eachother through UDP and TCP. All of them using either the machine's local network IP or 127.0.0.1 (localhost) to listen ...
0
votes
0
answers
800
views
Postfix behind NAT
my network looks like this:
Internet <-> Gateway router(nat) <-> enp0s3 Linux enp0s8(NAT) <-> SMTP server
Without Linux NAT it works ok, but I need it.
When I try to send mail to ...
-1
votes
1
answer
116
views
Dumpcap - Ram still reserved after stop
System: Win 10 Pro and latest updates (Sept. 2020) 64Bit.
Problem: Using dumpcap (Dumpcap (Wireshark) 3.2.5 (v3.2.5-0-ged20ddea8138)) with a ringbuffer reserves RAM even after closing the dumpcap.exe. ...
3
votes
2
answers
14k
views
How to decrypt TLS traffic with Wireshark using RSA asynchronous encryption?
I want to be able to capture and decrypt TLS traffic that one off my internal application (that I don't have access) makes to the internet. (For testing I am using Postman to create a request to a ...
1
vote
0
answers
295
views
Sniffing packets over a wifi network, with or without monitor mode using wireshark
So, I am actually confused, there are some guides that say you can't just capture traffic on wireless LAN with promiscuous mode and you need to setup monitor mode, also enter the wifi password to be ...
1
vote
0
answers
986
views
TCP Window Size
Hoping someone can clarify a query I have in relation to TCP window size and whether it could be contributing to my slow throughput achieved via iPerf.
I took a Wireshark capture from a client while ...
0
votes
0
answers
513
views
HTTP webservice no response
We have some issues on a connection between 2 devices through ASP webservices. On Wireshark, we saw that the request arrives to the destination computer and the IIS sends the response, but the origin ...
0
votes
0
answers
913
views
Wireshark TLS conversation for ldaps
I am trying to troubleshoot an issue with delays in LDAPS bind operations with tcpdump/wireshark.
Here is what I get from client side on a conversation with delays:
I see the following problems:
I ...
0
votes
1
answer
351
views
How does a web browser parse the raw bytes of each part of a DNS name to a human readable form? [closed]
My focus is to parse the structure of a DNS packet programmatically using python.
Consider the snap where my browser send a large domain name through the pipe without even complaining.
Let's take a ...
1
vote
0
answers
434
views
Debugging port forwarding in Docker
Manager
I have a docker swarm setup on a mesh VPN. My manager is on 10.0.0.1. I have run:
docker swarm init --advertise-addr=wg0
which then uses the VPN IP to listen on 10.0.0.1 opposed to the ...
0
votes
2
answers
1k
views
What is blocking my mysql connection?
We run several docker images on a VM.
sudo iptables -S shows a lot of docker networking.
We try to connect to an external MySQL database in another net.
mysql --host=mysql.example.org --user=thisuser ...
0
votes
1
answer
1k
views
Decoding TCP packets as RTP in Wireshark
I'm troubleshooting a WebRTC video calling problem in my app and i'm using Wireshark.
One end of my video call is a web app running in my browser window and the other end is a Unity based app on an ...
-1
votes
1
answer
862
views
SSH connection not established, but standard TCP/IP connection works
I'm working on a custom yocto Linux for a Raspberry PI 3 and try to get the WIFI connection working with SSH. However when trying to connect from my PC (Ubuntu 19.10, SSH OpenSSH_8.0p1 Ubuntu-6build1, ...
0
votes
1
answer
96
views
Steamapi Dns calls without steam being open
So , after some time I re-opened wireshark to update it and I saw something pretty strange, now I'm really not sure what this is and that might just be a basic thing but I can't seem to understand why ...
0
votes
1
answer
206
views
Is it possible to capture packets of router which i connected through wifi of my laptop
I want to capture all traffic of router I can only connect with wifi no physical access and I do have access to configuration page of router
1
vote
2
answers
407
views
Record SSH commands sent to a Mac from Windows
I've got a bit of a puzzler - I am an administrator on both a Windows 10 and a Mac Catalina machine.
The Windows machine is currently running software that has a known bug - SSH commands are sent to ...
3
votes
2
answers
14k
views
Googlecast SSDP and MDNS queries on network despite not having any chromecast applications installed in main computer
As title states,
Ive detected some MDNS queries from a googlecast address, which is strange since i don't have any googlecast apps or similar installed.
Additionally My PC is sending SSDP packets to ...
0
votes
1
answer
69
views
need help in finding original url - wireshark
I'm using wireshark to capture data.
Now when I'm hitting sites, I can only see Source - IPv4,Dest - IPv4.
Is there anyway I get to know the exact url it hit.
Like :
https://www.reddit.com/r/meme
...
0
votes
0
answers
209
views
AJAX POST fails - client sends RST response...why?
Problem
We have a web application that is used by many thousands of users. However, since the latter part of Jan 2020, a tiny fraction of clients (but still a significant number) have reported a ...
0
votes
2
answers
447
views
PXE Boot laptop doesn't send out DHCP discover
ultimately im trying to get a PXE boot laptop to talk to the WDS server. While monitoring the switch using wireshark from laptop #2, it doesn't see ANY DHCP packet during a PXE boot. whereas, I would ...
0
votes
1
answer
863
views
Treat TCP as MQTT protocol
I have packets captured during not encrypted MQTT communication:
Protocol is detected as TCP. How to ask Wireshark to analyze packets as MQTT?
UPD
In case I set MQTT server work on default 1883 ...
0
votes
2
answers
784
views
Is it possible to sniff packets of other users on connected over LAN in a workspace or college lab? [closed]
I am asking this (for educational purposes) to be alert if this kind of thing happens to me.
0
votes
1
answer
405
views
Troubleshooting Network Switching Connectivity
I am managing a network that sporadically has network outages that present as follows
no TCP or ICMP traffic is working between any devices on the network. Two computers with valid ip addresses are ...
2
votes
0
answers
70
views
Microsoft CA Problem for Windows 10 Clients with Wireshark Installed
This is a most bizarre scenario, but hoping someone else has ran into this at some point to shed some light.
We are in the process of migrating to a new host Microsoft CA service. There are CA ...
1
vote
0
answers
4k
views
How do i convert text capture files back to pcap files?
I have opened Wireshark, selected the a.pcap file, and then went to File->Export and chose (K12 text file) to convert to text. Result is a.txt file.
How can I convert back a.txt file to original pcap ...
0
votes
1
answer
1k
views
Retrieve data from wireshark (PCAPNG)
I have a PCAPNG file and I need to retrieve two files from it, one is a TXT and the other one is a PNG. The provided file does not have FTP-DATA, it only have ARP, DHCP, DNS, FTP, HTTP, IGMPv3, OCSP, ...
0
votes
1
answer
887
views
NBNS Query = ICMP Destination Unreachable
I am having some difficulties when I am trying to get the NetBIOS Name of a machine by it's IP Address with the command (On Windows) nbtstat -A 192.168.1.1, In this example I am trying to get the name ...
1
vote
2
answers
4k
views
What are the numbers preceeding a DNS packets flags for?
What does the Flags: 0x0500 section of this DNS query packet mean?
Domain Name System (query)
Transaction ID: 0x4242
Flags: 0x0500 Standard query
0... .... .... .... = Response: ...
0
votes
1
answer
150
views
Wireless Packet captures - VMware
Software: Wireshark
Is it possible to analyse Wireless Packet captures on VMWare using Linux Ubuntu OS? I ask this as I’m using Windows for my computer but I’m struggling to get all the information I ...
0
votes
1
answer
560
views
Are TCP RTO value and RTT value influenced by the packet size?
I am doing troubleshooting in my network.
I found some re-transmission by using wireshark.
The segment 1400 bytes are well transmitted but
The segment 800 bytes are lost and re-transmitted.
I know ...
1
vote
2
answers
921
views
I have a loopback traffic in linux involving port 631 and I have no idea what is causing it
So I did some packet capturing in my networking and everything else is actually fine except for this weird communication where source and destination is literally 127.0.0.1, source port is 631, and ...
1
vote
1
answer
50
views
How to characterize a physical device on my network?
I have inherited a data centre with very little documentation. The network is split up into multiple vlans (and subnets which don't tally with the vlans). I have a lot of physical devices, some which ...
2
votes
2
answers
3k
views
Get network data transfer rate / throughput for use in Wireshark
I'm trying to get the ethernet NIC throughput rate / data transfer rate on a VPS in order to start a capture on Wireshark during DOS/DDOS attacks so I can analyze the nature of the packets.
I'm ...
2
votes
0
answers
3k
views
Fatal error TLS client credential
I have disabled SSLv3, TLS1.0 and 1.1 on a Windows 10 domain joined laptop, I also disabled triple DES 168 and MD5 to comply with our PCI scans and since then the system logs are full of the same ...
0
votes
0
answers
61
views
HTML code trying to load PDF file from Site using ssl with self signed certificate
My employer has a web application that loads a pdf file onto the client browser by having a code that does the ff:
embed src="https://somepage.somesite.com/folderpath/somefile.pdf" width="100%" ...
0
votes
1
answer
863
views
Capture packets on loopback
I'm running web service on my windows 10 machine. I decided to look at the packets between my service and client running on the same machine by using Wireshark. I know that it is not possible to get ...
1
vote
0
answers
37
views
the strange value of SRE in a D-SACK packet
I'm troubleshooting a strange network issue in our production environment.
The dumped pcap file comes from the full NAT mode LVS , and the toploy of the ip address in the dump file is:
172.19.132.90(...
1
vote
1
answer
384
views
Wireshark capture filter from list file
Is it possible to pass Wireshark or tcpdump a file containing a list of host IP addresses and/or networks to be captured?
0
votes
0
answers
1k
views
Unable to use VNC when connected to OpenVPN
When I try to VNC to a particular machine #1 (192.168.1.221) from within the network I am able to connect to it without issue. When I try to connect from outside the network from my OpenVPN VPN I am ...