Wireshark is a open source Network Protocol Analyzer under GNU License.

learn more… | top users | synonyms

1
vote
2answers
213 views

Can I capture ISP SNMP information with Wireshark?

I am trying to do some heavy digging into SNMP, BPI+, ISP networks. Since wireshark can be used to capture network data, would I be able to use it to remotely capture my ISP SNMP agent information and ...
0
votes
1answer
126 views

Linux unfriendly IIS/ASP.NET :-) : Quick download on windows but slow on linux [closed]

This particular web site (gops.tay.be) serves objects quick if I try to request the page using windows, but I get them very slow if trying using linux. There is no difference if I use browser or curl: ...
0
votes
2answers
561 views

How can I create a packet capture file on a headless server for a single process?

I'm writing a python script on a headless server, and I'd like to see the packet capture output for the script. I can't run ettercap or Wireshark on the server as there is too much other noise ...
2
votes
1answer
322 views

Strange Ethernet II packets in wireshark

Looking at a wireshark capture, I'm seeing something really strange. Ethernet II packets with random data are being sent on the network. The larger packets in the capture seem to contain bits and ...
0
votes
2answers
97 views

Occasional Delay on Website Resources: Packet Loss Due to Bandwidth Cap?

My website loads more slowly than I think it should, due to a few of the assets taking an absurdly long time to download from the server. I've been trying to track down the cause of this. I'm about ...
-6
votes
1answer
232 views

How to monitor all network traffic [closed]

I have installled wireshark on my server but can only monitor traffic through the local nic but all network traffic does not go through the server. I would like to monitor all network traffic. Are ...
0
votes
1answer
718 views

Wireshark - Capture syslog traffic form local workstation

I am using wireshark version 1.10.3 on windows 7 x64 enterprise. I am trying to capture all outbound UDP traffic, in particular syslog traffic. I have tried a capture filter UDP, but all I can see ...
0
votes
1answer
110 views

Network card capable of capturing a tonne of packets and not dropping them?

Edit: Our server is trying to capture packets at between 500-600Mb/s, but is dropping packets 'due to kernel'. Data is being written to SSDs, and isn't bottleneck there. What things should I look ...
2
votes
1answer
173 views

How to block own rpcap traffic where tshark is running?

Platform :- Fedora 13 32-bit machine RemoteMachine$ ./rpcapd -n ClientMachine$ tshark -w "filename" -i "any interface name" As soon as capture starts without any capture filter, thousands of ...
1
vote
0answers
112 views

NFSv3 Asynchronous Write Depends on Block Size?

I am trying to figure out if my NFSv3 deployment is performing SAFE asynchronous writes. I suspect that it is doing strictly synchronous writes, as I am getting poor performance in general. I used ...
1
vote
1answer
206 views

“tshark: There are no interfaces on which a capture can be done” in Amazon Linux AMI

My goal is to capture packets with tshark in Amazon Linux AMI. While typing tshark in the command line there's an error: "tshark: There are no interfaces on which a capture can be done" How to ...
1
vote
1answer
146 views

How can I measure the cumulative network usage of a process, from execution beginning to end

I want to measure how much bandwidth git pull uses, preferably by prefixing git command with desired program, i.e. nettally git pull Alternatively, is there some sneaky way to accumulate nethogs / ...
2
votes
2answers
2k views

Wireshark filtering-trying to filter out my own local ip

i'm trying to filter out my ip address(local address) "192.168.5.22" I used "ip.src != 192.168.5.22|| ip.dst !=192.168.5.22"(without quotes) and I keep seeing my address pop up im in a heavy traffic ...
0
votes
0answers
715 views

Window Size goes to zero

We are seeing an issue with our web servers where a client is doing a HTTP POST and sending xml files. We are seeing weird behavior where we are sometimes only receiving part of the data. (Sometimes ...
1
vote
1answer
89 views

Wireshark not found after installing RHEL 5.5 [closed]

After installing Wireshark in RHEL 5.5 (32bit) with following command: yum install wireshark Wireshark not found: [root@localhost ~]# wireshark bash: wireshark: command not found What ...
0
votes
2answers
237 views

server sending hpoms-dps-lstn packets to unknown IP

I have a server running pacemaker with corosync and some standard services as mails, web, ssh... When I run wireshard in my network I keep getting those packets that my server is sending to the IP ...
2
votes
3answers
14k views

Excessive 'TCP Dup ACK' & 'TCP Fast Retransmission' causing issues on network. What's causing this?

I'm getting excessive TCP Dup ACK and TCP Fast Retransmission on our network when I transfer files over the MetroEthernet link. The two sites are connected by one sonicwall router, so the sites are ...
0
votes
1answer
85 views

tshark duration of a conversation for a ip address

i can retrieve the follow info from a .pcap : ================================================================================ IPv4 Conversations Filter:ip.addr==1xx.1xx.0.1xx ...
0
votes
1answer
149 views

Wireshark - Difference between fixed parameters and tagged parameters

I'm new to Wireshark. I'd like to know what are fixed and tagged parameters and the difference between them. Web search didn't help. Kindly explain it to me in simple terms.
0
votes
0answers
188 views

Apache logs or tcpdump slow loris

i know about the question : How can I detect Slowloris? but that does not apply. Now i have a big server that receives more then 10.000 events on the IDS per each 10 minutes, and i have suffered in ...
1
vote
1answer
671 views

trace ftp file data in wireshark

I am trying to analyze ftp traffic in Wireshark. I can see commands like Request: List, PORT. But after FTP Response 150: Opening data channel for directory list. what I see immediately is ...
1
vote
3answers
3k views

Can Wireshark capture an entire Ethernet frame including preamble, CRC and Interframe spacing?

I am examining an Ethernet frame in Wireshark. According to the "Ethernet frame" Wikipedia article and accompanying diagrams, "A frame starts with a 7-octet preamble and 1-octet start frame delimiter ...
-1
votes
1answer
318 views

Incoming Outgoing Packets Wireshark

Is there a way to have a column or a filter that marks each packet as incoming (download) or outgoing (upload) in Wireshark? I guess this should be relative to the selected capture interface device.
0
votes
1answer
286 views

Source and Destination Packets on Wireshark Relative or Absolute?

New in Packet Analysis. Sniffing on the Ethernet device of my computer. Does the Source and Destination columns on Wireshark tell the source and destination from where the packet was originated and ...
1
vote
1answer
792 views

How to parse OpenFlow packets using tcpdump capture file programmatically

I am working with OpenFlow packets and am analyzing the network via tcpdump. Currently, I use the WireShark GUI to parse the generated capture file and it does serve my need. However, I was ...
2
votes
1answer
3k views

tcpdump capturing tcp resets by host

I am trying to figure out where my tcp resets on my webserver happen. I have the following capture: tcpdump -fnni bond0:-nnvvS -w dump.pcap 'tcp[tcpflags] & (tcp-rst) !=0' When I look at the ...
5
votes
1answer
14k views

Why does WireShark think this frame is a TCP segment of a reassembled PDU

Please find a small pcap file here illustrating my problem. I have a three-way TCP handshake, followed by two FIX logons. (FIX is a protocol used in trading.) The first FIX logon (frame 4) is ...
2
votes
3answers
867 views

While analyzing a network interface using WireShark, which device's timestamp is recorded?

OK, this may seem trivial but due to the nature of testing required for my application, I need to get precise timestamps. I am using WireShark to analyze packets. Suppose I have a network with 2 ...
4
votes
3answers
3k views

Wireshark running on a server seeing lots of `ARP who has` with different tells

We're seeing some suspicious network activity, and when I was trying to see if it was one particular server of ours I ran a Wireshark trace. I noted a lot of ARP packets asking who has x.x.x.x, but ...
0
votes
1answer
1k views

Why am I seeing so many MAPI “Unknown?!” request/response in a packet capture?

We are experiencing user reported slowness with our Exchange 2007 server. We thought it was associated with a new application that we're testing. (This application uses MAPI to look at all of the ...
1
vote
0answers
84 views

UDP sends 6 additional packets in Wireshark

I am sending UDP packets using ttcp to another machine which is connected via a Cisco router. However, when I analyze the packets sent in Wireshark, there is a UDP packet sent before the payload ...
-3
votes
2answers
1k views

Alternatives to wireshark? [closed]

What would be a good option to troubleshoot an interaction of browser with a server besides wireshark? I mean being able to see what the browser sends and receives. Is firebug a good alternative or is ...
-1
votes
1answer
60 views

can netgear RP614 be configured to enable promisc listening? [closed]

can I confugure NetGear RP614 to be able to receive all packets (packets from and to all machines on my LAN) and inspect them in Wireshark? I enabled promisc on eth0 and in Wireshark but still can ...
0
votes
1answer
50 views

Is there an app that can provide details about wifi access point config?

I'm wondering if there is an easier way to determine of the following parameters of a wifi network. For users who already have say a laptop connected to a wifi network. Does wifi network support ...
1
vote
2answers
1k views

Wireshark does not capture HTTP on 8080

I am running Wireshark on my linux machine and i have simple python web server running on localhost:8080 I am capturing only local port 8080. When i open browser on localhost:8080 wireshark captures ...
0
votes
1answer
434 views

syn flood attack — packet hits on shared ip

How can I dump the TCP packets to get a better idea to know which website is being attacked? Here is what I have in my logs: May 4 23:10:26 host kernel: [2130002.635000] Firewall: *SYNFLOOD ...
2
votes
6answers
441 views

Wireshark Capture Between Two Routers

How would one go about capturing OSPF traffic in Wireshark between two routers? I'm looking to do something like this: [RTR A] - - - [LAPTOP] - - - [RTR B]
0
votes
0answers
1k views

NetGroup Packet Filter Driver isn't installed with WinPcap on Windows Server 2008 R2 64bit

I'm running Windows Server 2008 R2, 64 bit on a Virtual Server. There I want to install Wireshark to capture some of my network traffic for debugging purpose. During installation of Wireshark and ...
1
vote
2answers
1k views

TCPDump and IPTables DROP by string

by using tcpdump -nlASX -s 0 -vvv port 80 I get something like: 14:58:55.121160 IP (tos 0x0, ttl 64, id 49764, offset 0, flags [DF], proto TCP (6), length 1480) 206.72.206.58.http > ...
1
vote
1answer
1k views

tcpdump not picking up traffic redirected by iptables

The following iptables rule is used to redirect all internet traffic coming in from eth1 to port 3000 at localhost (interface lo with ip 127.0.0.1): iptables -t nat -A PREROUTING -i eth1 -p tcp ...
-1
votes
1answer
67 views

IP testing tool similar to wireshark website [closed]

I am looking to implement a tool similar to the one linked below on my personal server/website what are the steps I would need to get started? http://www.wireshark.org/tools/v46status.html I ...
0
votes
0answers
490 views

How to interpret findings on TCP Send/Recv Buffers

I have an application running on a CentOS machine that connects to a remote DB server on another CentOS machine. Every once in a while, without any discernable warning signs, the application seems to ...
2
votes
2answers
182 views

Is TCP RWIN set by application or OS?

I have a situation where an application is listening on a TCP port and every once in a while, as seen in tcp dumps, gets its Receiving Window (RWIN) set to zero. When this happens, its Recv-Q stops ...
-2
votes
2answers
840 views

Using tcpdump to find strings [closed]

I need to block certain TCP packets by trying to find a string match in and on them. Is there a way to do that with TCPDump? Or do I need wireshare install on my linux server? One I have the string ...
-1
votes
1answer
76 views

Continuous conversion to text file using Wireshark [closed]

What is the procedure to convert captured files to text files on a continuous basis ? Export in Wireshark is a manual technique, any way to automate the process ?
-1
votes
1answer
94 views

Wireshark not displaying GET or POST data [closed]

I'm a student and I'm taking my first networking class. I'm working on an assignment designed to get me used to using Wireshark and understanding packet transfers. Part of the assignment is to collect ...
1
vote
1answer
123 views

centos6 - wireshark

1) Is there any easy way to install wireshark-1.8.3 on centos 6 ? I try the wget utility and i get the dependency on gtk..which inturn has dependency on glib, atk , pango and cairo.. 2) Looks like ...
3
votes
1answer
258 views

How to use a switch as a network tap?

I would like to tcpdump all traffic that my router does when it makes a firmware update. So I have taken a HP ProCurve 1800-8G switch and mirrored port 7 to port 8. I have connected: Internet ...
3
votes
2answers
268 views

What are cables/boxes called for listening in on a RJ45 cable?

I would like to capture the traffic from a router, so I assume there must exist a cable or hardware box with 3 RJ45 socks, where two of them are IN and OUT, and the third is for capturing device (a ...
3
votes
2answers
1k views

How to use Linux to capture packets on eth0 and send everything to eth1?

Today I got an enterprise Internet connection together with a Sagemcom router. The first time it is connected to the Internet, it will spend 20 minutes upgrading the firmware. I would really like to ...