Questions tagged [wireshark]

Wireshark is an open source Network Protocol Analyzer under GNU License.

Filter by
Sorted by
Tagged with
0 votes
1 answer
928 views

Where is the ACK to the packet in frame 76? [closed]

I am working through Kurose's book as part of a class and this particular exercise involves submitting a .txt file to the server and capturing this transfer and the server's response. In one exercise ...
Segmentation fault's user avatar
1 vote
1 answer
949 views

VoIP one-way audio, only when call initiated from one side

I am setting up some new switches and VLANs and I am getting trouble with our pre-existing Asterisk VoIP set-up. Most calls work ok. Some get just one-way audio. I tried to narrow it down to this ...
pgr's user avatar
  • 459
-1 votes
1 answer
915 views

Python sockets: TCP errors in linux, while same program works fine on Windows10

I'm trying to communicate with a commercial power supply device via TCP/IP using python sockets. I tried using both a virtual linux(centos8stream) and virtual windows10, both running at the same ...
Cenkoloji's user avatar
1 vote
1 answer
176 views

Why is my PC doing more than one DNS query for www.ietf.org? [closed]

I'm doing an exercise for a class where I have to flush the DNS cache and then visit www.ietf.org and capture the packets. I got this: The selected query and response are the "main" ones. ...
Segmentation fault's user avatar
1 vote
0 answers
264 views

TLS 1.2 Failure

I am using Webinspect to scan sites. When going through Webinspect, I get "the client and server cannot communicate because they do not possess a common algorithm". From the same system, ...
Katt8m19's user avatar
0 votes
0 answers
469 views

Slow connection to production MongoDB due to TLS handshake retransmits

I have question about something that had me tearing my hair out for the past two days. Long story short: specifically over my home network, my connection to our work MongoDB is stupidly slow. Over my ...
umutberkbilgic's user avatar
0 votes
1 answer
762 views

How can wireshark.exe on windows read from a pcap file stream?

This is probably less a wireshark question and more a "how do I pipe a file into an application" on windows. On linux, I can capture a pcap file on another host with tcpdump and pipe it back ...
I grok it's user avatar
2 votes
1 answer
298 views

Measuring network bandwidth usage

One VM is sending data to another VM using rsync, both VMs are hosted on the same machine. I've got the task to measure the network bandwidth usage between both VMs and plot it. Plotting is easy once ...
user14610638's user avatar
0 votes
1 answer
1k views

tshark : in a HTTP POST request how get form datas in a pretty output?

I'm a teacher and I want to simulate with my students a MITM attack. The goal is to show why the https protocol must be always used. On debian, I installed tshark. All works fine, when I run the ...
spacecodeur's user avatar
0 votes
1 answer
972 views

How can I isolate a single TCP connection on Wireshark?

I just started using Wireshark for network troubleshooting purposes and I am a little confused about one thing. I requested a webpage and for the next 10s I monitored the data. I then used the filter ...
user avatar
0 votes
1 answer
173 views

Can I determine a EWOULDBLOCK/EAGAIN situation from a pcap/tcpdump

Is there a way I can determine if a certain message resulted in an EWOULDBLOCK/EAGAIN return code to the server which sent the packet? The server was sending messages to the client At time 10,the ...
PasanW's user avatar
  • 133
0 votes
0 answers
43 views

Can't track applications network communication under same machine

I have a network application environment of 7 applications communicating with eachother through UDP and TCP. All of them using either the machine's local network IP or 127.0.0.1 (localhost) to listen ...
underthevoid's user avatar
0 votes
0 answers
800 views

Postfix behind NAT

my network looks like this: Internet <-> Gateway router(nat) <-> enp0s3 Linux enp0s8(NAT) <-> SMTP server Without Linux NAT it works ok, but I need it. When I try to send mail to ...
Bomzi's user avatar
  • 1
-1 votes
1 answer
116 views

Dumpcap - Ram still reserved after stop

System: Win 10 Pro and latest updates (Sept. 2020) 64Bit. Problem: Using dumpcap (Dumpcap (Wireshark) 3.2.5 (v3.2.5-0-ged20ddea8138)) with a ringbuffer reserves RAM even after closing the dumpcap.exe. ...
Eggi's user avatar
  • 109
3 votes
2 answers
14k views

How to decrypt TLS traffic with Wireshark using RSA asynchronous encryption?

I want to be able to capture and decrypt TLS traffic that one off my internal application (that I don't have access) makes to the internet. (For testing I am using Postman to create a request to a ...
mavi's user avatar
  • 151
1 vote
0 answers
295 views

Sniffing packets over a wifi network, with or without monitor mode using wireshark

So, I am actually confused, there are some guides that say you can't just capture traffic on wireless LAN with promiscuous mode and you need to setup monitor mode, also enter the wifi password to be ...
Hormoz's user avatar
  • 111
1 vote
0 answers
986 views

TCP Window Size

Hoping someone can clarify a query I have in relation to TCP window size and whether it could be contributing to my slow throughput achieved via iPerf. I took a Wireshark capture from a client while ...
loneknight's user avatar
0 votes
0 answers
513 views

HTTP webservice no response

We have some issues on a connection between 2 devices through ASP webservices. On Wireshark, we saw that the request arrives to the destination computer and the IIS sends the response, but the origin ...
JoakDA's user avatar
  • 111
0 votes
0 answers
913 views

Wireshark TLS conversation for ldaps

I am trying to troubleshoot an issue with delays in LDAPS bind operations with tcpdump/wireshark. Here is what I get from client side on a conversation with delays: I see the following problems: I ...
trikelef's user avatar
  • 528
0 votes
1 answer
351 views

How does a web browser parse the raw bytes of each part of a DNS name to a human readable form? [closed]

My focus is to parse the structure of a DNS packet programmatically using python. Consider the snap where my browser send a large domain name through the pipe without even complaining. Let's take a ...
repzero's user avatar
  • 103
1 vote
0 answers
434 views

Debugging port forwarding in Docker

Manager I have a docker swarm setup on a mesh VPN. My manager is on 10.0.0.1. I have run: docker swarm init --advertise-addr=wg0 which then uses the VPN IP to listen on 10.0.0.1 opposed to the ...
maxisme's user avatar
  • 159
0 votes
2 answers
1k views

What is blocking my mysql connection?

We run several docker images on a VM. sudo iptables -S shows a lot of docker networking. We try to connect to an external MySQL database in another net. mysql --host=mysql.example.org --user=thisuser ...
Bodo's user avatar
  • 11
0 votes
1 answer
1k views

Decoding TCP packets as RTP in Wireshark

I'm troubleshooting a WebRTC video calling problem in my app and i'm using Wireshark. One end of my video call is a web app running in my browser window and the other end is a Unity based app on an ...
Salbrox's user avatar
  • 51
-1 votes
1 answer
862 views

SSH connection not established, but standard TCP/IP connection works

I'm working on a custom yocto Linux for a Raspberry PI 3 and try to get the WIFI connection working with SSH. However when trying to connect from my PC (Ubuntu 19.10, SSH OpenSSH_8.0p1 Ubuntu-6build1, ...
deets's user avatar
  • 1
0 votes
1 answer
96 views

Steamapi Dns calls without steam being open

So , after some time I re-opened wireshark to update it and I saw something pretty strange, now I'm really not sure what this is and that might just be a basic thing but I can't seem to understand why ...
Alex's user avatar
  • 103
0 votes
1 answer
206 views

Is it possible to capture packets of router which i connected through wifi of my laptop

I want to capture all traffic of router I can only connect with wifi no physical access and I do have access to configuration page of router
madan nikalje's user avatar
1 vote
2 answers
407 views

Record SSH commands sent to a Mac from Windows

I've got a bit of a puzzler - I am an administrator on both a Windows 10 and a Mac Catalina machine. The Windows machine is currently running software that has a known bug - SSH commands are sent to ...
Coruscate5's user avatar
3 votes
2 answers
14k views

Googlecast SSDP and MDNS queries on network despite not having any chromecast applications installed in main computer

As title states, Ive detected some MDNS queries from a googlecast address, which is strange since i don't have any googlecast apps or similar installed. Additionally My PC is sending SSDP packets to ...
N S's user avatar
  • 33
0 votes
1 answer
69 views

need help in finding original url - wireshark

I'm using wireshark to capture data. Now when I'm hitting sites, I can only see Source - IPv4,Dest - IPv4. Is there anyway I get to know the exact url it hit. Like : https://www.reddit.com/r/meme ...
Danial's user avatar
  • 103
0 votes
0 answers
209 views

AJAX POST fails - client sends RST response...why?

Problem We have a web application that is used by many thousands of users. However, since the latter part of Jan 2020, a tiny fraction of clients (but still a significant number) have reported a ...
DrGriff's user avatar
  • 99
0 votes
2 answers
447 views

PXE Boot laptop doesn't send out DHCP discover

ultimately im trying to get a PXE boot laptop to talk to the WDS server. While monitoring the switch using wireshark from laptop #2, it doesn't see ANY DHCP packet during a PXE boot. whereas, I would ...
Hexalogy's user avatar
0 votes
1 answer
863 views

Treat TCP as MQTT protocol

I have packets captured during not encrypted MQTT communication: Protocol is detected as TCP. How to ask Wireshark to analyze packets as MQTT? UPD In case I set MQTT server work on default 1883 ...
vico's user avatar
  • 99
0 votes
2 answers
784 views

Is it possible to sniff packets of other users on connected over LAN in a workspace or college lab? [closed]

I am asking this (for educational purposes) to be alert if this kind of thing happens to me.
Saurav's user avatar
  • 101
0 votes
1 answer
405 views

Troubleshooting Network Switching Connectivity

I am managing a network that sporadically has network outages that present as follows no TCP or ICMP traffic is working between any devices on the network. Two computers with valid ip addresses are ...
Jeff's user avatar
  • 146
2 votes
0 answers
70 views

Microsoft CA Problem for Windows 10 Clients with Wireshark Installed

This is a most bizarre scenario, but hoping someone else has ran into this at some point to shed some light. We are in the process of migrating to a new host Microsoft CA service. There are CA ...
Justin Andrusk's user avatar
1 vote
0 answers
4k views

How do i convert text capture files back to pcap files?

I have opened Wireshark, selected the a.pcap file, and then went to File->Export and chose (K12 text file) to convert to text. Result is a.txt file. How can I convert back a.txt file to original pcap ...
Vinod's user avatar
  • 111
0 votes
1 answer
1k views

Retrieve data from wireshark (PCAPNG)

I have a PCAPNG file and I need to retrieve two files from it, one is a TXT and the other one is a PNG. The provided file does not have FTP-DATA, it only have ARP, DHCP, DNS, FTP, HTTP, IGMPv3, OCSP, ...
Mateo Gutierrez's user avatar
0 votes
1 answer
887 views

NBNS Query = ICMP Destination Unreachable

I am having some difficulties when I am trying to get the NetBIOS Name of a machine by it's IP Address with the command (On Windows) nbtstat -A 192.168.1.1, In this example I am trying to get the name ...
Dan's user avatar
  • 1
1 vote
2 answers
4k views

What are the numbers preceeding a DNS packets flags for?

What does the Flags: 0x0500 section of this DNS query packet mean? Domain Name System (query) Transaction ID: 0x4242 Flags: 0x0500 Standard query 0... .... .... .... = Response: ...
Justin's user avatar
  • 13
0 votes
1 answer
150 views

Wireless Packet captures - VMware

Software: Wireshark Is it possible to analyse Wireless Packet captures on VMWare using Linux Ubuntu OS? I ask this as I’m using Windows for my computer but I’m struggling to get all the information I ...
C.Mann's user avatar
  • 3
0 votes
1 answer
560 views

Are TCP RTO value and RTT value influenced by the packet size?

I am doing troubleshooting in my network. I found some re-transmission by using wireshark. The segment 1400 bytes are well transmitted but The segment 800 bytes are lost and re-transmitted. I know ...
nimdrak's user avatar
  • 139
1 vote
2 answers
921 views

I have a loopback traffic in linux involving port 631 and I have no idea what is causing it

So I did some packet capturing in my networking and everything else is actually fine except for this weird communication where source and destination is literally 127.0.0.1, source port is 631, and ...
cmakeislife's user avatar
1 vote
1 answer
50 views

How to characterize a physical device on my network?

I have inherited a data centre with very little documentation. The network is split up into multiple vlans (and subnets which don't tally with the vlans). I have a lot of physical devices, some which ...
symcbean's user avatar
  • 22.3k
2 votes
2 answers
3k views

Get network data transfer rate / throughput for use in Wireshark

I'm trying to get the ethernet NIC throughput rate / data transfer rate on a VPS in order to start a capture on Wireshark during DOS/DDOS attacks so I can analyze the nature of the packets. I'm ...
I'm Root James's user avatar
2 votes
0 answers
3k views

Fatal error TLS client credential

I have disabled SSLv3, TLS1.0 and 1.1 on a Windows 10 domain joined laptop, I also disabled triple DES 168 and MD5 to comply with our PCI scans and since then the system logs are full of the same ...
ThomasC.'s user avatar
0 votes
0 answers
61 views

HTML code trying to load PDF file from Site using ssl with self signed certificate

My employer has a web application that loads a pdf file onto the client browser by having a code that does the ff: embed src="https://somepage.somesite.com/folderpath/somefile.pdf" width="100%" ...
rjmendaxx's user avatar
0 votes
1 answer
863 views

Capture packets on loopback

I'm running web service on my windows 10 machine. I decided to look at the packets between my service and client running on the same machine by using Wireshark. I know that it is not possible to get ...
vico's user avatar
  • 99
1 vote
0 answers
37 views

the strange value of SRE in a D-SACK packet

I'm troubleshooting a strange network issue in our production environment. The dumped pcap file comes from the full NAT mode LVS , and the toploy of the ip address in the dump file is: 172.19.132.90(...
kongyk's user avatar
  • 111
1 vote
1 answer
384 views

Wireshark capture filter from list file

Is it possible to pass Wireshark or tcpdump a file containing a list of host IP addresses and/or networks to be captured?
NOYB's user avatar
  • 41
0 votes
0 answers
1k views

Unable to use VNC when connected to OpenVPN

When I try to VNC to a particular machine #1 (192.168.1.221) from within the network I am able to connect to it without issue. When I try to connect from outside the network from my OpenVPN VPN I am ...
Coldgate32's user avatar

1
2
3 4 5
11