Questions tagged [wireshark]
Wireshark is an open source Network Protocol Analyzer under GNU License.
511
questions
2
votes
0
answers
5k
views
Does wireshark can capture https request?
I have been working in wireshark. And I can able to capture the http request and capturing http packets using wireshark. And now I am capturing the https request. It seems does not capture the packets ...
1
vote
0
answers
739
views
Traffic to and from mongodb using SSL is still visible in wireshark in plaintext
EDIT: There was nothing wrong. I was an idiot. The below settings are
correct.
I've set up an instance of mongodb (3.4) on windows, configured like this:
net:
port: 27017
ssl:
mode: ...
-1
votes
2
answers
6k
views
Is it possible to decrypt SSL traffic on OpenVPN server?
I have an VPN server running OpenVPN. I want to log all of my VPN traffic. I can capture the packets on server on tun0 interface.
I wonder if it possible to see SSL traffic in plain text?
1
vote
0
answers
858
views
Wireshark not decrypting TLS packet
I am unable to understand why decryption does not work here.
Consider the scenario in this pcap file - https://drive.google.com/open?id=0Bz5corUPBatBWWpXTFYwWjdfS0k
I have a network setup such that
...
-1
votes
2
answers
2k
views
Why can't I see http request in wireshark?
I am working in wireshark. I am monitoring the wifi traffic on the same network. We have 6 pc's there and one machine was installed on wireshark to capture wifi traffic. I got my team mates Ip ...
0
votes
1
answer
201
views
What application is connecting to a remote site?
I can see with Wireshark that every 5 minutes I have a connection from my computer to ip 165.254.162.243 on udp/8253. This has been going for months. I cannot identify what application or process is ...
1
vote
0
answers
503
views
server stops sending SYN ACK after several normal connections
I have a few thousand devices behind a NAT talking to two servers. Each device is behind a local router (think modem/router), at which they get NATed to a private network that has thousands of these ...
0
votes
1
answer
23k
views
Wireshark doesn't detect any of my interfaces
I know this question has been asked on ServerFault and Stackoverflow but none of the discussions and solutions have worked for me. (Not linking to the question directly as I can only post 2 links at ...
-3
votes
1
answer
204
views
Why tcp.dstport==8127 doesn't capture traffic [closed]
I have a simple node.js server running on locahost:8127:
const http = require('http');
http.createServer(function (req, res) {
console.log('incoming');
}).listen(8127);
Now I make requests from ...
1
vote
1
answer
846
views
What's the correct syntax for tcp.dstport in display filters
I've put the following display filter:
tcp.dstport=8127
But it's showing as incorrect (red background):
What am I doing wrong?
3
votes
2
answers
3k
views
Heavy TCP traffic on loopback
While trying to generate some test traffic on my loopback interface, I noticed there was so much noise there that the output from Wireshark was essentially useless, with tons of SYN/RST, ACK packets ...
0
votes
1
answer
7k
views
TCP Handshake error: SYN and SYN/ACK packets are not recognised
I have very interesting problem:
I have Proxmox hypervisor and two linux vms on it:
First vm have several nics in main bridge, each nic added to vm with certain vlan tag on hypervisor.
Second vm ...
0
votes
1
answer
989
views
How to filter wireshark capture to have only packets with local ip as source or destination
How to filter wireshark capture to have only packets with local ip as source or destination?
The expression should be valid for both ipv4 and ipv6.
I am obviously asking for an other solution than ...
0
votes
1
answer
2k
views
How to display only the source port with tshark
I can display the source and destination tcp ports with
tshark -T fields -e tcp.port
1111,2222
2222,1111
[...]
How can I display only the source port in order to get
1111
2222
1
vote
0
answers
845
views
NFS stuck in ack loop
I have a situation where one of three different NFS clients will break after a period of time (some number of days). I find that the broken host and server are continually sending 'ack' packets (to ...
0
votes
1
answer
767
views
decrypting ssl/tsl packets using tshark/wireshark
I am a novice with networking and unix and trying to debug an issue but I have been able to capture packets using tshark in order to analyze and inspect why clients are receiving 401 errors on initial ...
2
votes
1
answer
449
views
What is running on port 49181 Windows 7
I have an application that relies on port 63000 for communicating with other devices over the network.
Some while ago this app stopped working on the PC.
I tried all sorts of firewall configs, ON/...
0
votes
1
answer
934
views
network traffic capture between 2 vms
I am not a pro with networking and am trying to understand the same better.
Below is the setup I have.
Host system is OSX running VirtualBox.
2 virtualbox VMs (VM1 and VM2), each running Ubuntu ...
2
votes
0
answers
3k
views
How to measure latency using wireshark
I'm trying to measure the wire-to-wire latency of a blackbox application. The application engages in tcp offloading (kernel bypass), it consumes incoming UDP packets via a NIC and in response, ...
1
vote
0
answers
3k
views
Wireshark decoding URL from M – SEARCH * HTTP/1.1
I am new to Wireshark and when I am running Wireshark it shows me the source address as the IP address but the destination address is 239.255.255.250 and at the info tab it shows M – SEARCH * HTTP/1.1....
1
vote
0
answers
2k
views
What is causing RST ACK in my connections?
75% of calls to a 3rd party API are getting dropped. When this happens is propagates up to my calling code as a The request was aborted: Could not create SSL/TLS secure channel error.
Here is a ...
1
vote
1
answer
4k
views
How to capture network packets that use SS7 protocol using Wireshark?
Since SS7 protocol stack is used in GSM mobile telephony network, we can't get the packets of SS7 protocols using Wireshark in Windows Computer and browsing in a web browser like Google chrome.
So ...
0
votes
1
answer
217
views
packet colorization in Wireshark
is there anyone who could sum up the packet colorization system in wireshark? My capture list is looking quite colourful, but I don't quite understand how the colorization scheme work.
Thank you
0
votes
1
answer
690
views
How to perform Wiresharks File->Extract Objects->HTTP through Tshark commandline interface?
Using TShark, I want to be able to extract the payload in HTTP response from packets data captured through tshark in a .pcap file.
In the Wireshark GUI, I was able to do that by File > Extract ...
0
votes
1
answer
369
views
can tcpdump detect higher level protocols like wireshark?
Wireshark will guess what higher level protocols are being used in a packet, but how can I get tcpdump to do likewise (or any other linux command line tool)?
For example, the following screenshot ...
0
votes
1
answer
1k
views
How to debug a "connection refused" error with tshark?
I'm trying to establish a simple TCP connection between two machines in the same subnet (wireless network). The tool used is netcat.
On machine A, I start a listener:
nc -l -p 4506
On machine B, I ...
15
votes
5
answers
110k
views
Wireshark is not showing my network interface?
I want to capture traffic on Ethernet 4 but you can see that Ethernet 4 is not present in Wireshark network interface though Ethernet 4 is present in Networking and sharing center.
Screenshot of ...
20
votes
2
answers
2k
views
What's the Wireshark packet receiving and processing procedure on a Windows machine?
I am about to use Wireshark for some traffic monitoring on my Windows computer. While working on it, I was wondering how Wireshark manages to catch low level network packets before Windows does.
...
2
votes
1
answer
8k
views
Using wireshark to determine which RSA PRIVATE KEY SSL conversation?
Situation
I have a client VM and server VM communicating using SSL.
The client VM runs wireshark capture using CLI
Wireshark GUI is running locally on a different machine.
Steps
As USER on the ...
1
vote
1
answer
230
views
Need help in understanding the packet analysis(wireshark) [closed]
The snapshot capture below contains a single HTTP request to a web server, in which the client web browser requests some files from server, and the server returns an HTTP/1.1 200 (OK) response which ...
0
votes
2
answers
691
views
Wireshark Packet Capture Data Data ACK Confusion
I understand how acks work and windowing works. What I am not getting is why am I seeing the following behavior in packet captures
Client Server
data1----->
data2----->
<--------ack ...
0
votes
1
answer
368
views
Capture traffic to/from a network node
I would like to capture all traffic to/from a network node. I don't know much about the network setup there, here's what I know:
The target node is a Linux server, which has no access to internet, ...
3
votes
0
answers
2k
views
FileZilla FTP Error - 426 Connection Closed; aborted transfer of "filename"
I'm trying to transfer a file to an FTP server but I get the error on the title: "426 Connection Closed; aborted transfer of "XYZ".
Here are some info:
I can establish the connection, change ...
3
votes
2
answers
5k
views
TCP connection RST after FIN, ACK
I have a situation that would like to clarify with the experts here. I am no network expert so maybe it's normal, but i rather ask.
We are trying to diagnose a problem between two servers, both are ...
0
votes
1
answer
897
views
Transferring data to Active FTP server fails from DMZ but works fine from LAN
I know there are a ton of similar questions already, but I've read through just about everything I could find and am still having trouble resolving my specific issue.
Problem: I am having difficulty ...
1
vote
1
answer
2k
views
Debugging why network packets are being dropped
Preface:
I have an application that I am currently testing out that runs on RHEL 6. The setup for my test is the application installed on a embedded device, connected by an Ethernet cable to PC that ...
4
votes
2
answers
24k
views
How do I see absolute time stamps in Wireshark?
There is an example of pcap file opened in wireshark
The second column is time. Is it possible to see absolute timestamps here instead of relative?
1
vote
1
answer
728
views
Is there a quick way to determine what applications are present within a Wireshark capture? If so how
Is there a quick way to determine what applications are present within a Wireshark capture? If so how
As most captures contain over 10 thousand lines, I can't expect people would by hand check which ...
-2
votes
2
answers
124
views
Why do different packet analyzers sometimes produce different results?
I ran wireshark and windump at the same time. Both packet analyzers use the same winpcap library.
However after doing a row by row comparison of the results I noticed both every column between the 2 ...
2
votes
1
answer
2k
views
Meaning of [MASKED] in pcap file
What does [MASKED] mean? Is it related to websocket proto? Can i state that x.x.7.151 initiated connection closing?
1
vote
2
answers
257
views
tcpdump http containing non expected payload bytes
I am monitoring an openvpn link with tcpdump a la
tcpdump -i tun5 -w capture.dump -W 100 -C 100M -s 0 -n
There is http/xml traffic going over that link which is basically caputered just fine.
However, ...
6
votes
4
answers
11k
views
How do you continuously run Wireshark without eating up all of my RAM?
I need to run Wireshark all night to capture packets from a certain IP address. I notice the longer Wireshark runs, the more RAM it takes up because it stores all of the packets found during the run. ...
-1
votes
1
answer
117
views
Is it possible for SYN/ACK to not be immediately proceeded by a SYN in a network trace
I'm writing a simple program to calculate initial RTTs from a network capture I took using Wireshark. To do this I wan't to calculate the difference in time between the SYN and the SYN/ACK. I don't ...
0
votes
0
answers
385
views
TCP sockets dying on LTE
I have about 25 audio streaming clients built on an i.mx6 arm platform, running linux version 4.3.0-rc2-00019-gbcee19f-dirty #36 SMP Tue Feb 9 15:27:51 EST 2016 armv7l
I find on two specific units ...
0
votes
1
answer
841
views
How can I see what is the number of embedded objects used by a site in html from a wireshark trace?
I have recorded a wireshark trace and visited some websites. I exported the trace as a CSV file. How can I see the number of embedded objects in each of the sites I visited? Thanks.
-1
votes
1
answer
992
views
the MAC header of captured wireshark packets
I have been reading about the IEEE 802.11 and especially on the MAC layer, and i noticed that it contains a lot of informations, but when i start to capture with wireshark with my wireless card, the ...
1
vote
1
answer
474
views
udp broadcast on port 25860
I used wireshark on my local network (to test it), and i noticed that there is a lot of udp packets send one broadcast, and the majority is coming from only one host. Theses udp packets are send on ...
0
votes
1
answer
444
views
PCAP traffic frame length short
I'm trying to make traffic and capture it using pcap file. I get pcap file from CAIDA(caida.org) site. This pcap file too big and doesn't have ethernet header. So i splitted pcap file to small size(40 ...
0
votes
1
answer
126
views
Wireshark returns error on filters from Windows command prompt
It works when i use GUI with the following filter http.request.method == "GET" but when i run tshark is aways returns error
tshark -i 1 -Y 'http.request.method == "GET"'
tshark: Syntax error near "...
0
votes
1
answer
67
views
Can a remote connetion from outside a LAN be invisible to protocol analyzers such as Wireshark, Process Hacker, Nbtstat? [closed]
When studying the behavior of trojans and (RAT) Remote Access Trojans this question came up.
Can an attacker create a trojan that could trick the OS or the NIC into hiding a remote connection to a ...