Wireshark is a open source Network Protocol Analyzer under GNU License.

learn more… | top users | synonyms

0
votes
1answer
252 views

tshark conversation statistic not resolving hostnames

Executing the -z conv,ip command does not display the hostnames (like in wireshark). I execute the command, and after a bit of traffic was monitored, I stop tshark with Ctrl-C and then the ...
2
votes
2answers
620 views

Filter tcpdump file AFTER capturing

I captured a really big tcpdump file which now always crashes my wireshark. It was captured with no filters and I need to apply some afterwards to make the file smaller. Is this somehow possible?
2
votes
2answers
2k views

using wireshark/tshark in command line to ignore ssh connections

I'm trying to debug some by looking at the packets and I would like to avoid getting all the SSH traffic to the server. Is there a way to ignore? I tried to do something like tshark -f "port !22" but ...
0
votes
0answers
240 views

Method to capture traffic going through a wireless router (802.11)

I am interested in monitoring and saving all wireless traffic going through a router (that includes the management frames sent from and the router too) but I am not sure what is the optimal strategy ...
2
votes
2answers
1k views

Correct way to show only TCP packages in wireshark

I needed to write a filter that correctly outputs only TCP packets, the obvious way, and the way written in wireshark is just tcp but when I tried it, it showed me also http, tls (as far as I ...
2
votes
0answers
1k views

Issue with Netgear GS108T Managed Switch and Jumbo Frames

I recently purchased a Netgear GS108T managed switch and I am trying to configure jumbo packets between my NAS (Thecus N4100Pro), PC and managed switch. I should mention the fact that I was able to ...
-1
votes
1answer
343 views

does ping command to a dns name uses DNS PTR type messages?

Okay I cant understand this, when I try to ping to a machine on my network using the name associated I get a response from that machine, thats normal.. But there are messages that the sender sends to ...
2
votes
2answers
725 views

Can you run a packet capture (wireshark) while rdped to a server?

I want to run a packet capture while rdped into a box. I'm pretty sure it won't drop the connection to the server (a server with one nic). I tested on VMs and it seems fine. Am I missing something?
2
votes
2answers
142 views

Wireshark and mirrored ports bringing in 10k+ packets a second

I've got wireshark setup on a monitoring machine to monitor our offices internet traffic (approx 40 machines). However, whenever I start wireshark within about 30-40 seconds it has crashed - I think ...
2
votes
1answer
147 views

Printing to shared printers across VPN

I have a program that prints labels at five remote sites. Two sites, aren't working, but the rest are with an identical (as far as I can tell) setup. Using Wireshark, I have determined that the ...
0
votes
2answers
237 views

Analyse custom Ethernet frame with WireShark

WireShark can conveniently dissect Ethernet frames, and tell you exactly what each byte means. For example, it tells you where the TCP/IP headers are, how they have been populated and if the checksums ...
2
votes
0answers
399 views

Wireshark (WinPCap) does not see Intel X520-DA2 10 GbE NIC teaming intermittently

I am running a team of two 10 GigE ports on Intel X520-DA2 network card. They work well in tandem and achieve the desired throughput. However, I see an intermittent issue whereby WireShark and my ...
1
vote
0answers
191 views

tshark not recognizing wpa psk option

I'm trying to decrypt captured wpa-psk traffic with tshark, but it's not recognizing the option I'm trying to override. This option allows me to specify a PSK to use for decrypting. I'm using tshark ...
1
vote
1answer
1k views

configure wireshark to automatically save captured packets every X hours

I am capturing traffic using wireshark. Everything works nice, but for some reason after I capture more than 2 mlns packets, wireshark just crashes. I am not sure what can be the reason, but I tried ...
5
votes
2answers
2k views

How to decrypt IKVe2 in Wireshark using StrongSwan log info?

Wireshark has the ability to decrypt IKEv2, if you do Preferences, select ISAKMP, it offers an IKEv2 decrypt table which wants the initiator's and responder's SPIs, the encryption and authentication ...
1
vote
0answers
113 views

Website latency and bad tcp packets

I have multiple websites hosted on a Linode VPS and I'm having an issue with one of them: every page that I try to load has about 10 seconds latency. Apache logs are clean and the other websites on ...
2
votes
2answers
389 views

Network flooded with seemingly empty packets

Let me preface this with the fact that I'm just a web developer at my company with little networking knowledge. Earlier today there was a department that lost all of their network connections so I ...
3
votes
3answers
398 views

Layer 3 Protocol only in wireshark

I have a simple question: is there any way in wireshark to avoid resolution of protocol besides the protocol of layer 3 ? For example, in the column protocol, instead of showing http, I want it to ...
1
vote
3answers
4k views

isolate application and check what packets it is sending over the internet

I am not sure that this sort of question is appropriate here, so forgive me if I'm wrong. Here is a problem: I want to see what a specific program is sending to the internet, but the thing is that on ...
0
votes
1answer
2k views

wireshark skype messages

I would like to analyse packets sent by skype from my computer. Particularly I am interested in packets that transmit messages. With what filter I can see this packets on wireshark. I know that ...
2
votes
3answers
2k views

wireshark capture the traffic of other devices in LAN

I am using wireshark on Windows to capture my traffic. Is there a way to capture the traffic of other computers which are connected to the same LAN. If it is not possible with wireshark, is there ...
5
votes
3answers
247 views

What causes a switch port to receive data not destined for it?

We are having an intermittent fault which is effecting one of our control systems on one of our HP Procurve switches. For some reason, this PLC (10mbit port - 192.168.6.56) which is attached directly ...
0
votes
2answers
638 views

Seeing traffic destined for other people's servers in wireshark

I rent a dedicated server from a hosting provider. I ran wireshark on my server so that I could see incoming HTTP traffic that was destined to my server. Once I ran wireshark and filtered for HTTP I ...
-3
votes
1answer
96 views

Inspecting the E-mail traffic of a Windows Server 2008 R2 [closed]

I have seen that the IP address of my mail server has added to blocked IP address list on http://psbl.org. I am using this server for personal use. So, it is not that much of an issue that I am, as a ...
5
votes
1answer
1k views

Client not getting address from some DHCP server

I'm working on some embedded devices which should be connected to a large network (hundreds of devices) via ethernet and that should be configured using the DHCP protocol. What I'm experiencing is ...
0
votes
1answer
529 views

Capturing network traffic (rtmp) between VMs or using loopback in the same VM using wireshark

I need to to capture RTMP traffic between two virtual machines (server and client) or atleast have the server and client on the same machine and capture the traffic. I am able to capture the traffic ...
1
vote
2answers
167 views

Capture SMTP traffic over long time period

We have an SMTP relay (just an XP box with SMTP) on our network. It's hanging around because some legacy apps used to use it so send emails from code. It hardly gets any traffic, I can see from the ...
3
votes
1answer
221 views

How Wireshark could read data from other ips

When I open wireshark I could see the packets send by machines other than mine. How could its possible? Example 8252 99.150192 somoeneip 239.255.255.250 SSDP NOTIFY * HTTP/1.1 8253 ...
5
votes
1answer
2k views

Can WireShark detect Ethernet PAUSE packets on network when running on Windows?

We have a Windows server which is connected to a switch processing a large quantity of data. We noticed that when we disabled FlowControl on the network adapter, that it appeared that we were getting ...
7
votes
2answers
2k views

tcpdump: snaplen set to 0 but still get “Packet size limited during capture”?

Due to this problem, I'm going to sniff some packets on the MySQL server backend to see what happens: # tcpdump -vv -s0 -c 100 -i bond0 tcp port 3306 and host 192.168.3.87 -w ...
1
vote
0answers
78 views

Divert TCP connection

I am trying to divert a TCP connection. Given a client (C) which is connected to a router R and two servers (S1 and S2) are connected to the router, C initially connects to S1. I am trying to write an ...
3
votes
1answer
339 views

What are capture interfaces in Wireshark?

I am really new to Wireshark, and I am little confused about the term capture interface. I see a list of about 9 to 10 so-called interfaces. What are they? I mean, I have only one Ethernet interface ...
1
vote
4answers
2k views

Sniffing packets of specific binaries / apps / process id?

Is there a way to associate packets with executing binaries? I would be open to traditional sniffing methods or even dtrace for that matter. I have a specific issue on a system with very high ...
0
votes
6answers
842 views

Wireshark running all the time [closed]

Would this cause an issue eventually or is always ok to leave running. SHould it's logs be saved every no and again and if so when?
1
vote
1answer
171 views

Wireshark, using “Decode as”, BACnet is missing as a choice

I'm trying to decode BACnet traffic that was sent on a non-standard port. It looks like I should be able to click "decode as" and choose BACnet or BACapp, but they don't appear in the selection list. ...
5
votes
3answers
10k views

How do I install Wireshark in Red Hat Linux?

How do I install Wireshark in Red Hat Linux? At the Wireshark download page, am I supposed to download "Standard package" for Red Hat under "Third-Party Package"? Does the Red Hat version have a ...
2
votes
1answer
457 views

Is Winpcap able to capture all packets going through a Gigabit NIC without missing any packets?

I want to use Winpcap to capture all network packets going through a Gigabit NIC of a server. Assuming that I am able to utilize the network link up to 100%, the maximum network speed is 1000Mbps. If ...
3
votes
3answers
1k views

TCP segments of an HTTP Request in wrong order

My web-services server sometimes does not receive correct HTTP requests and returns "500 - Internal Server Error". Using tcpdump and Wireshark on the server, I found out that HTTP requests are ...
2
votes
4answers
777 views

Extremely high arp fllooding from the router

My subnet is 10.162.0.0/16. We have a router with a couple of interfaces. Gateway for my subnet is 10.162.0.1. The router is situated in another building and I haven't direct access to it. Line from ...
1
vote
1answer
806 views

How can I find out the source of arp request if it is in another subnet?

Our subnet is connected with other subnets with router. Using wireshark I see some arp requests coming to ip addresses of our subnet from the router. Such as Broadcast ARP 60 Who has ...
3
votes
1answer
1k views

huge packet loss and checksum errors

Our 2008 server began to work very slowly within 2 weeks. Our web sites (iis 7.5) are loading very slowly and sometimes its freezing. We began testing with wireshark and saw that our packets are ...
0
votes
1answer
456 views

Router is continually broadcasting the same ARP request, with the exact contents

I hope the question is clear and that this is correct place to post the question. My router is broadcasting the same ARP frame over and over (once every second). It's probably not a big deal, but I ...
3
votes
2answers
556 views

How to separate PCAP by unique IP address

I have an hour long PCAP file which has about 60 individual network attacks done on our test network here at work. Each attack comes from a unique IP address which was not used elsewhere during the ...
1
vote
0answers
265 views

Creating keytab for computer account to decrypt packet capture

We are having an issue with our blackberry server (EWSTest fails at autodiscover lookup) and I am running a packet capture with Wireshark in an attempt to diagnose the issue. There is a conversation ...
-1
votes
1answer
931 views

Stealing internet by changing MAC address? [closed]

OK - I have a static IP - and I have been on the same provider for years - its a wired network (a cable goes directly to my network card) - and the cable is connected to a switch on a pole in the ...
4
votes
2answers
1k views

syn/ack sequence number confusion

I was looking at some random traffic in wireshark and came across this (using relative seq/ack numbers): 1. myIP -> 74.125.227.96 [SYN] seq=0 2. 74.125.227.96 -> myIP ...
2
votes
2answers
12k views

How to monitor VPN traffic with Wireshark on Windows 7?

I'm running Wireshark 1.6.7 (latest available release) x64 on Windows 7 x64. I only have a single network card on this computer, and Wireshark shows only it as an available adapter to capture packets ...
0
votes
1answer
595 views

Wireshark/encryption and openvpn

I have a linux openvpn router and a home dsl modem. The dsl modem has port 1234 open and forwards it onto eth0 on the linux router. I can connect to the router from a remote location no problem. All ...
0
votes
1answer
3k views

Why Wireshark does not recognize this HTTP response?

I have a trivial CGI script that outputs simple text content. It's written in Perl and using CGI module and it specifies only the most basic headers: print $q->header( -type ...
-1
votes
1answer
241 views

Checking HTTP response for website using Wireshark

Is there a specific way to know if the file that we download through a web server (e.g.: Java) can be verified through Wireshark? I want to check if the file is working perfectly from internal and ...