Wireshark is a open source Network Protocol Analyzer under GNU License.

learn more… | top users | synonyms

0
votes
1answer
1k views

Why am I seeing so many MAPI “Unknown?!” request/response in a packet capture?

We are experiencing user reported slowness with our Exchange 2007 server. We thought it was associated with a new application that we're testing. (This application uses MAPI to look at all of the ...
1
vote
0answers
92 views

UDP sends 6 additional packets in Wireshark

I am sending UDP packets using ttcp to another machine which is connected via a Cisco router. However, when I analyze the packets sent in Wireshark, there is a UDP packet sent before the payload ...
-3
votes
2answers
1k views

Alternatives to wireshark? [closed]

What would be a good option to troubleshoot an interaction of browser with a server besides wireshark? I mean being able to see what the browser sends and receives. Is firebug a good alternative or is ...
-1
votes
1answer
63 views

can netgear RP614 be configured to enable promisc listening? [closed]

can I confugure NetGear RP614 to be able to receive all packets (packets from and to all machines on my LAN) and inspect them in Wireshark? I enabled promisc on eth0 and in Wireshark but still can ...
0
votes
1answer
52 views

Is there an app that can provide details about wifi access point config?

I'm wondering if there is an easier way to determine of the following parameters of a wifi network. For users who already have say a laptop connected to a wifi network. Does wifi network support ...
1
vote
2answers
1k views

Wireshark does not capture HTTP on 8080

I am running Wireshark on my linux machine and i have simple python web server running on localhost:8080 I am capturing only local port 8080. When i open browser on localhost:8080 wireshark captures ...
0
votes
1answer
498 views

syn flood attack — packet hits on shared ip

How can I dump the TCP packets to get a better idea to know which website is being attacked? Here is what I have in my logs: May 4 23:10:26 host kernel: [2130002.635000] Firewall: *SYNFLOOD ...
2
votes
6answers
564 views

Wireshark Capture Between Two Routers

How would one go about capturing OSPF traffic in Wireshark between two routers? I'm looking to do something like this: [RTR A] - - - [LAPTOP] - - - [RTR B]
0
votes
0answers
1k views

NetGroup Packet Filter Driver isn't installed with WinPcap on Windows Server 2008 R2 64bit

I'm running Windows Server 2008 R2, 64 bit on a Virtual Server. There I want to install Wireshark to capture some of my network traffic for debugging purpose. During installation of Wireshark and ...
1
vote
2answers
1k views

TCPDump and IPTables DROP by string

by using tcpdump -nlASX -s 0 -vvv port 80 I get something like: 14:58:55.121160 IP (tos 0x0, ttl 64, id 49764, offset 0, flags [DF], proto TCP (6), length 1480) 206.72.206.58.http > ...
2
votes
1answer
1k views

tcpdump not picking up traffic redirected by iptables

The following iptables rule is used to redirect all internet traffic coming in from eth1 to port 3000 at localhost (interface lo with ip 127.0.0.1): iptables -t nat -A PREROUTING -i eth1 -p tcp ...
-1
votes
1answer
69 views

IP testing tool similar to wireshark website [closed]

I am looking to implement a tool similar to the one linked below on my personal server/website what are the steps I would need to get started? http://www.wireshark.org/tools/v46status.html I ...
0
votes
0answers
647 views

How to interpret findings on TCP Send/Recv Buffers

I have an application running on a CentOS machine that connects to a remote DB server on another CentOS machine. Every once in a while, without any discernable warning signs, the application seems to ...
2
votes
2answers
205 views

Is TCP RWIN set by application or OS?

I have a situation where an application is listening on a TCP port and every once in a while, as seen in tcp dumps, gets its Receiving Window (RWIN) set to zero. When this happens, its Recv-Q stops ...
-2
votes
2answers
1k views

Using tcpdump to find strings [closed]

I need to block certain TCP packets by trying to find a string match in and on them. Is there a way to do that with TCPDump? Or do I need wireshare install on my linux server? One I have the string ...
-1
votes
1answer
78 views

Continuous conversion to text file using Wireshark [closed]

What is the procedure to convert captured files to text files on a continuous basis ? Export in Wireshark is a manual technique, any way to automate the process ?
-1
votes
1answer
102 views

Wireshark not displaying GET or POST data [closed]

I'm a student and I'm taking my first networking class. I'm working on an assignment designed to get me used to using Wireshark and understanding packet transfers. Part of the assignment is to collect ...
1
vote
1answer
137 views

centos6 - wireshark

1) Is there any easy way to install wireshark-1.8.3 on centos 6 ? I try the wget utility and i get the dependency on gtk..which inturn has dependency on glib, atk , pango and cairo.. 2) Looks like ...
3
votes
1answer
296 views

How to use a switch as a network tap?

I would like to tcpdump all traffic that my router does when it makes a firmware update. So I have taken a HP ProCurve 1800-8G switch and mirrored port 7 to port 8. I have connected: Internet ...
3
votes
2answers
318 views

What are cables/boxes called for listening in on a RJ45 cable?

I would like to capture the traffic from a router, so I assume there must exist a cable or hardware box with 3 RJ45 socks, where two of them are IN and OUT, and the third is for capturing device (a ...
3
votes
2answers
1k views

How to use Linux to capture packets on eth0 and send everything to eth1?

Today I got an enterprise Internet connection together with a Sagemcom router. The first time it is connected to the Internet, it will spend 20 minutes upgrading the firmware. I would really like to ...
0
votes
1answer
262 views

No response from IIS

My problem is that the Default Web Site can be opened from the server machine (localhost), but cannot be opened from a test machine (which is in the same LAN). Netstat says that IIS 7.5 is listening ...
0
votes
2answers
92 views

How to measure Wireshark parsing time of PCAP file?

I need to find out how to measure the parsing time of a PCAP file when using Wireshark. Does anyone know how to do this?
0
votes
3answers
120 views

Which bit represents which TCP flag?

For instance, a WireShark capture filter example I found - tcp[13] & 8 == 8 represents packets with PSH flags. How do I count the 8 ? Based on the wikipedia image, PSH is in the middle of ...
0
votes
2answers
149 views

Caculating packet offset

In Wireshark, if I want to write a filter which accepts only ICMP destination unreachable ( type 3 ) messages, the filter is icmp[0] == 3 . How do I count the packet offset of 0 in this instance ? ...
0
votes
3answers
828 views

Wireshark Promiscuous Mode and multiple Subnets

Is it possible to Sniff traffic with Wireshark where the source IP and Destination IP are on different subnets (of the same network) and neither of them are your IP? NIC is Intel 82579LM.
-1
votes
1answer
115 views

DHCP messages in LAN [closed]

I run a Mac and release/renew my IP with: sudo ipconfig set en0 DHCP In wireshark I get the following with udp.port==67 as filter: Why are the messages sent from my computer broadcasted, but ...
1
vote
1answer
901 views

FTP Error 500 Illegal Port Command - PORT command sending different IP than source of request

The problem I'm experiencing is that I'm getting a "500 Illegal PORT command" Response from an FTP server when attempting to upload a file programmatically. This program is a small c# application ...
0
votes
2answers
129 views

Multiple ICMP destination unreachable messages

I'm load testing some web services hosted on IIS7. The web services make network calls to underlying services in response to client requests. The client requests are simple HTTP requests but the ...
1
vote
1answer
252 views

mysql logging activity from specific user or ip

I have mysql server. The server is accessed by my application, and by external auditor (person using mysql workbench). The auditor has specific user and password and dedicated IP and it is granted ...
0
votes
1answer
160 views

Application traffic classification with tcpdump

I have a trace file from my network. I would like to identify the top 10 applications used by us . Does tcpdump provide any application based filtering options ? Any details regarding this would be ...
5
votes
2answers
476 views

Is it possible for Wireshark to drop packets purposely?

I would like to test something like VoIP. I would like to test with some "artificial packet loss". Is Wireshark able to do this? Or is there any good solutions?
0
votes
1answer
209 views

Filtering inbound traffic without knowing the destination subnet

I have a linux machine configured as a router with two interfaces facing LAN A and LAN B. I want to filter traffic passing from LAN A to LAN B (inbound traffic) using tcpdump, but I don't have the ...
0
votes
1answer
370 views

tshark conversation statistic not resolving hostnames

Executing the -z conv,ip command does not display the hostnames (like in wireshark). I execute the command, and after a bit of traffic was monitored, I stop tshark with Ctrl-C and then the ...
3
votes
2answers
1k views

Filter tcpdump file AFTER capturing

I captured a really big tcpdump file which now always crashes my wireshark. It was captured with no filters and I need to apply some afterwards to make the file smaller. Is this somehow possible?
2
votes
2answers
2k views

using wireshark/tshark in command line to ignore ssh connections

I'm trying to debug some by looking at the packets and I would like to avoid getting all the SSH traffic to the server. Is there a way to ignore? I tried to do something like tshark -f "port !22" but ...
3
votes
2answers
2k views

Correct way to show only TCP packages in wireshark

I needed to write a filter that correctly outputs only TCP packets, the obvious way, and the way written in wireshark is just tcp but when I tried it, it showed me also http, tls (as far as I ...
2
votes
0answers
1k views

Issue with Netgear GS108T Managed Switch and Jumbo Frames

I recently purchased a Netgear GS108T managed switch and I am trying to configure jumbo packets between my NAS (Thecus N4100Pro), PC and managed switch. I should mention the fact that I was able to ...
-1
votes
1answer
509 views

does ping command to a dns name uses DNS PTR type messages?

Okay I cant understand this, when I try to ping to a machine on my network using the name associated I get a response from that machine, thats normal.. But there are messages that the sender sends to ...
2
votes
2answers
1k views

Can you run a packet capture (wireshark) while rdped to a server?

I want to run a packet capture while rdped into a box. I'm pretty sure it won't drop the connection to the server (a server with one nic). I tested on VMs and it seems fine. Am I missing something?
2
votes
2answers
159 views

Wireshark and mirrored ports bringing in 10k+ packets a second

I've got wireshark setup on a monitoring machine to monitor our offices internet traffic (approx 40 machines). However, whenever I start wireshark within about 30-40 seconds it has crashed - I think ...
2
votes
1answer
232 views

Printing to shared printers across VPN

I have a program that prints labels at five remote sites. Two sites, aren't working, but the rest are with an identical (as far as I can tell) setup. Using Wireshark, I have determined that the ...
0
votes
2answers
307 views

Analyse custom Ethernet frame with WireShark

WireShark can conveniently dissect Ethernet frames, and tell you exactly what each byte means. For example, it tells you where the TCP/IP headers are, how they have been populated and if the checksums ...
2
votes
0answers
552 views

Wireshark (WinPCap) does not see Intel X520-DA2 10 GbE NIC teaming intermittently

I am running a team of two 10 GigE ports on Intel X520-DA2 network card. They work well in tandem and achieve the desired throughput. However, I see an intermittent issue whereby WireShark and my ...
1
vote
0answers
234 views

tshark not recognizing wpa psk option

I'm trying to decrypt captured wpa-psk traffic with tshark, but it's not recognizing the option I'm trying to override. This option allows me to specify a PSK to use for decrypting. I'm using tshark ...
1
vote
1answer
1k views

configure wireshark to automatically save captured packets every X hours

I am capturing traffic using wireshark. Everything works nice, but for some reason after I capture more than 2 mlns packets, wireshark just crashes. I am not sure what can be the reason, but I tried ...
5
votes
2answers
2k views

How to decrypt IKVe2 in Wireshark using StrongSwan log info?

Wireshark has the ability to decrypt IKEv2, if you do Preferences, select ISAKMP, it offers an IKEv2 decrypt table which wants the initiator's and responder's SPIs, the encryption and authentication ...
1
vote
0answers
119 views

Website latency and bad tcp packets

I have multiple websites hosted on a Linode VPS and I'm having an issue with one of them: every page that I try to load has about 10 seconds latency. Apache logs are clean and the other websites on ...
2
votes
2answers
595 views

Network flooded with seemingly empty packets

Let me preface this with the fact that I'm just a web developer at my company with little networking knowledge. Earlier today there was a department that lost all of their network connections so I ...
3
votes
3answers
577 views

Layer 3 Protocol only in wireshark

I have a simple question: is there any way in wireshark to avoid resolution of protocol besides the protocol of layer 3 ? For example, in the column protocol, instead of showing http, I want it to ...