Wireshark is a open source Network Protocol Analyzer under GNU License.

learn more… | top users | synonyms

0
votes
3answers
620 views

Wireshark Promiscuous Mode and multiple Subnets

Is it possible to Sniff traffic with Wireshark where the source IP and Destination IP are on different subnets (of the same network) and neither of them are your IP? NIC is Intel 82579LM.
-1
votes
1answer
114 views

DHCP messages in LAN [closed]

I run a Mac and release/renew my IP with: sudo ipconfig set en0 DHCP In wireshark I get the following with udp.port==67 as filter: Why are the messages sent from my computer broadcasted, but ...
1
vote
1answer
766 views

FTP Error 500 Illegal Port Command - PORT command sending different IP than source of request

The problem I'm experiencing is that I'm getting a "500 Illegal PORT command" Response from an FTP server when attempting to upload a file programmatically. This program is a small c# application ...
0
votes
2answers
113 views

Multiple ICMP destination unreachable messages

I'm load testing some web services hosted on IIS7. The web services make network calls to underlying services in response to client requests. The client requests are simple HTTP requests but the ...
1
vote
1answer
229 views

mysql logging activity from specific user or ip

I have mysql server. The server is accessed by my application, and by external auditor (person using mysql workbench). The auditor has specific user and password and dedicated IP and it is granted ...
0
votes
1answer
141 views

Application traffic classification with tcpdump

I have a trace file from my network. I would like to identify the top 10 applications used by us . Does tcpdump provide any application based filtering options ? Any details regarding this would be ...
5
votes
2answers
423 views

Is it possible for Wireshark to drop packets purposely?

I would like to test something like VoIP. I would like to test with some "artificial packet loss". Is Wireshark able to do this? Or is there any good solutions?
0
votes
1answer
190 views

Filtering inbound traffic without knowing the destination subnet

I have a linux machine configured as a router with two interfaces facing LAN A and LAN B. I want to filter traffic passing from LAN A to LAN B (inbound traffic) using tcpdump, but I don't have the ...
0
votes
1answer
282 views

tshark conversation statistic not resolving hostnames

Executing the -z conv,ip command does not display the hostnames (like in wireshark). I execute the command, and after a bit of traffic was monitored, I stop tshark with Ctrl-C and then the ...
2
votes
2answers
743 views

Filter tcpdump file AFTER capturing

I captured a really big tcpdump file which now always crashes my wireshark. It was captured with no filters and I need to apply some afterwards to make the file smaller. Is this somehow possible?
2
votes
2answers
2k views

using wireshark/tshark in command line to ignore ssh connections

I'm trying to debug some by looking at the packets and I would like to avoid getting all the SSH traffic to the server. Is there a way to ignore? I tried to do something like tshark -f "port !22" but ...
0
votes
0answers
265 views

Method to capture traffic going through a wireless router (802.11)

I am interested in monitoring and saving all wireless traffic going through a router (that includes the management frames sent from and the router too) but I am not sure what is the optimal strategy ...
2
votes
2answers
1k views

Correct way to show only TCP packages in wireshark

I needed to write a filter that correctly outputs only TCP packets, the obvious way, and the way written in wireshark is just tcp but when I tried it, it showed me also http, tls (as far as I ...
2
votes
0answers
1k views

Issue with Netgear GS108T Managed Switch and Jumbo Frames

I recently purchased a Netgear GS108T managed switch and I am trying to configure jumbo packets between my NAS (Thecus N4100Pro), PC and managed switch. I should mention the fact that I was able to ...
-1
votes
1answer
390 views

does ping command to a dns name uses DNS PTR type messages?

Okay I cant understand this, when I try to ping to a machine on my network using the name associated I get a response from that machine, thats normal.. But there are messages that the sender sends to ...
2
votes
2answers
811 views

Can you run a packet capture (wireshark) while rdped to a server?

I want to run a packet capture while rdped into a box. I'm pretty sure it won't drop the connection to the server (a server with one nic). I tested on VMs and it seems fine. Am I missing something?
2
votes
2answers
146 views

Wireshark and mirrored ports bringing in 10k+ packets a second

I've got wireshark setup on a monitoring machine to monitor our offices internet traffic (approx 40 machines). However, whenever I start wireshark within about 30-40 seconds it has crashed - I think ...
2
votes
1answer
173 views

Printing to shared printers across VPN

I have a program that prints labels at five remote sites. Two sites, aren't working, but the rest are with an identical (as far as I can tell) setup. Using Wireshark, I have determined that the ...
0
votes
2answers
254 views

Analyse custom Ethernet frame with WireShark

WireShark can conveniently dissect Ethernet frames, and tell you exactly what each byte means. For example, it tells you where the TCP/IP headers are, how they have been populated and if the checksums ...
2
votes
0answers
459 views

Wireshark (WinPCap) does not see Intel X520-DA2 10 GbE NIC teaming intermittently

I am running a team of two 10 GigE ports on Intel X520-DA2 network card. They work well in tandem and achieve the desired throughput. However, I see an intermittent issue whereby WireShark and my ...
1
vote
0answers
197 views

tshark not recognizing wpa psk option

I'm trying to decrypt captured wpa-psk traffic with tshark, but it's not recognizing the option I'm trying to override. This option allows me to specify a PSK to use for decrypting. I'm using tshark ...
1
vote
1answer
1k views

configure wireshark to automatically save captured packets every X hours

I am capturing traffic using wireshark. Everything works nice, but for some reason after I capture more than 2 mlns packets, wireshark just crashes. I am not sure what can be the reason, but I tried ...
5
votes
2answers
2k views

How to decrypt IKVe2 in Wireshark using StrongSwan log info?

Wireshark has the ability to decrypt IKEv2, if you do Preferences, select ISAKMP, it offers an IKEv2 decrypt table which wants the initiator's and responder's SPIs, the encryption and authentication ...
1
vote
0answers
113 views

Website latency and bad tcp packets

I have multiple websites hosted on a Linode VPS and I'm having an issue with one of them: every page that I try to load has about 10 seconds latency. Apache logs are clean and the other websites on ...
2
votes
2answers
440 views

Network flooded with seemingly empty packets

Let me preface this with the fact that I'm just a web developer at my company with little networking knowledge. Earlier today there was a department that lost all of their network connections so I ...
3
votes
3answers
456 views

Layer 3 Protocol only in wireshark

I have a simple question: is there any way in wireshark to avoid resolution of protocol besides the protocol of layer 3 ? For example, in the column protocol, instead of showing http, I want it to ...
1
vote
3answers
4k views

isolate application and check what packets it is sending over the internet

I am not sure that this sort of question is appropriate here, so forgive me if I'm wrong. Here is a problem: I want to see what a specific program is sending to the internet, but the thing is that on ...
0
votes
1answer
2k views

wireshark skype messages

I would like to analyse packets sent by skype from my computer. Particularly I am interested in packets that transmit messages. With what filter I can see this packets on wireshark. I know that ...
2
votes
3answers
3k views

wireshark capture the traffic of other devices in LAN

I am using wireshark on Windows to capture my traffic. Is there a way to capture the traffic of other computers which are connected to the same LAN. If it is not possible with wireshark, is there ...
5
votes
3answers
255 views

What causes a switch port to receive data not destined for it?

We are having an intermittent fault which is effecting one of our control systems on one of our HP Procurve switches. For some reason, this PLC (10mbit port - 192.168.6.56) which is attached directly ...
0
votes
2answers
676 views

Seeing traffic destined for other people's servers in wireshark

I rent a dedicated server from a hosting provider. I ran wireshark on my server so that I could see incoming HTTP traffic that was destined to my server. Once I ran wireshark and filtered for HTTP I ...
-3
votes
1answer
97 views

Inspecting the E-mail traffic of a Windows Server 2008 R2 [closed]

I have seen that the IP address of my mail server has added to blocked IP address list on http://psbl.org. I am using this server for personal use. So, it is not that much of an issue that I am, as a ...
5
votes
1answer
1k views

Client not getting address from some DHCP server

I'm working on some embedded devices which should be connected to a large network (hundreds of devices) via ethernet and that should be configured using the DHCP protocol. What I'm experiencing is ...
0
votes
1answer
556 views

Capturing network traffic (rtmp) between VMs or using loopback in the same VM using wireshark

I need to to capture RTMP traffic between two virtual machines (server and client) or atleast have the server and client on the same machine and capture the traffic. I am able to capture the traffic ...
1
vote
2answers
175 views

Capture SMTP traffic over long time period

We have an SMTP relay (just an XP box with SMTP) on our network. It's hanging around because some legacy apps used to use it so send emails from code. It hardly gets any traffic, I can see from the ...
3
votes
1answer
234 views

How Wireshark could read data from other ips

When I open wireshark I could see the packets send by machines other than mine. How could its possible? Example 8252 99.150192 somoeneip 239.255.255.250 SSDP NOTIFY * HTTP/1.1 8253 ...
5
votes
1answer
2k views

Can WireShark detect Ethernet PAUSE packets on network when running on Windows?

We have a Windows server which is connected to a switch processing a large quantity of data. We noticed that when we disabled FlowControl on the network adapter, that it appeared that we were getting ...
7
votes
2answers
2k views

tcpdump: snaplen set to 0 but still get “Packet size limited during capture”?

Due to this problem, I'm going to sniff some packets on the MySQL server backend to see what happens: # tcpdump -vv -s0 -c 100 -i bond0 tcp port 3306 and host 192.168.3.87 -w ...
1
vote
0answers
79 views

Divert TCP connection

I am trying to divert a TCP connection. Given a client (C) which is connected to a router R and two servers (S1 and S2) are connected to the router, C initially connects to S1. I am trying to write an ...
3
votes
1answer
351 views

What are capture interfaces in Wireshark?

I am really new to Wireshark, and I am little confused about the term capture interface. I see a list of about 9 to 10 so-called interfaces. What are they? I mean, I have only one Ethernet interface ...
1
vote
4answers
2k views

Sniffing packets of specific binaries / apps / process id?

Is there a way to associate packets with executing binaries? I would be open to traditional sniffing methods or even dtrace for that matter. I have a specific issue on a system with very high ...
0
votes
6answers
923 views

Wireshark running all the time [closed]

Would this cause an issue eventually or is always ok to leave running. SHould it's logs be saved every no and again and if so when?
1
vote
1answer
185 views

Wireshark, using “Decode as”, BACnet is missing as a choice

I'm trying to decode BACnet traffic that was sent on a non-standard port. It looks like I should be able to click "decode as" and choose BACnet or BACapp, but they don't appear in the selection list. ...
5
votes
3answers
11k views

How do I install Wireshark in Red Hat Linux?

How do I install Wireshark in Red Hat Linux? At the Wireshark download page, am I supposed to download "Standard package" for Red Hat under "Third-Party Package"? Does the Red Hat version have a ...
2
votes
1answer
480 views

Is Winpcap able to capture all packets going through a Gigabit NIC without missing any packets?

I want to use Winpcap to capture all network packets going through a Gigabit NIC of a server. Assuming that I am able to utilize the network link up to 100%, the maximum network speed is 1000Mbps. If ...
3
votes
3answers
1k views

TCP segments of an HTTP Request in wrong order

My web-services server sometimes does not receive correct HTTP requests and returns "500 - Internal Server Error". Using tcpdump and Wireshark on the server, I found out that HTTP requests are ...
2
votes
4answers
885 views

Extremely high arp fllooding from the router

My subnet is 10.162.0.0/16. We have a router with a couple of interfaces. Gateway for my subnet is 10.162.0.1. The router is situated in another building and I haven't direct access to it. Line from ...
1
vote
1answer
868 views

How can I find out the source of arp request if it is in another subnet?

Our subnet is connected with other subnets with router. Using wireshark I see some arp requests coming to ip addresses of our subnet from the router. Such as Broadcast ARP 60 Who has ...
3
votes
1answer
1k views

huge packet loss and checksum errors

Our 2008 server began to work very slowly within 2 weeks. Our web sites (iis 7.5) are loading very slowly and sometimes its freezing. We began testing with wireshark and saw that our packets are ...
0
votes
1answer
497 views

Router is continually broadcasting the same ARP request, with the exact contents

I hope the question is clear and that this is correct place to post the question. My router is broadcasting the same ARP frame over and over (once every second). It's probably not a big deal, but I ...