Wireshark is a open source Network Protocol Analyzer under GNU License.

learn more… | top users | synonyms

0
votes
1answer
98 views

What does the C3 portion of 0xC308(BE) mean in an ICMP identifier?

I am using Wireshark to analyze traffic. I know that the 8 refers to the echo (ping) type. I have been unsuccesful with finding information regarding the C3 byte. Identifier (BE): 49928 (0xc308)
2
votes
3answers
371 views

Cannot connect to SQL Server and Wireshark don't listen anything

I'm trying to connect to a SQL Server from outside the LAN, so I opened port 1433 (default SQL Server port) in the firewall. On the server side I'm listening with Wireshark and I can listen ping ...
0
votes
1answer
777 views

ICMP Data Field Modified - What does it Mean?

Normal ICMP Data fields are composed of a pretty standard 32 byte string of alphabet characters. abcdefghijklmnopqrstuvwabcdefghi I have captured a series of ICMP echo requests using WireShark with ...
-1
votes
1answer
148 views

Measuring delays between various components on a localhost

I need to profile a web application from a system performance standpoint and find out for typical user actions (accessing the home page, logging in...) where the delay comes from. The website uses the ...
0
votes
1answer
310 views

Tcp retransmission tcp session reconstruction

Im trying to write a program that reconstructs tcp sessions. I have a pcap file which have packets. The problem is i dont know which packets i should use to construct sessions when there is a ...
1
vote
1answer
4k views

Why can't I start the WinPCap npf service when I'm the administrator?

I recently installed Wireshark on a Win 7 host, but now it won't let me start the NPF service. I get: C:\Windows\system32>net start npf System error 5 has occurred. Access is denied. That's ...
0
votes
1answer
176 views

Using tshark to generate traffic logs every X seconds

I'm trying to use tshark to maintain a running history of all the packets that are going through an interface, for say 30 seconds. I want it to be human readable. This is a linux machine, and without ...
1
vote
2answers
61 views

How can I filter packets from a port monitor?

I have some data going from Point A to Point B. I have a SPAN monitor set up to a monitoring device C. To recreate some real world scenarios, I want to filter out all traffic which is a certain type ...
0
votes
2answers
616 views

How to use tshark to do this task

I don't have any base knowledge about tshark, and it is hard to find any tutorial to help me with this. So now I have a pcap file which consists a lot of network flows; a time range; an ip addr; a ...
0
votes
2answers
161 views

SYN packets sent from one server but never arrives at destination

I am troubleshooting network problems for a client, remotely. The problem they have is that they get "connection timed out" occasionally between a web server and and a back-end search server. They can ...
4
votes
2answers
4k views

Stopping the WinPcap Packet capture service

I just installed WireShark, which also installed WinPcap. During the installation it said "do you want xxx to start automatically", which I answered yes. Now I would like to stop the service when I ...
2
votes
2answers
4k views

How to debug “HTTP request sent, awaiting response”?

I have a Linux server on an ADSL connection, and I just noticed that sometimes I get Connecting to example.com|xxx.xxx.xxx.122|:80... connected. HTTP request sent, awaiting response... when I use ...
1
vote
1answer
205 views

How can I display-filter the correspondant response to a specific display-filtered request in wireshark?

I am just tracing a very sporadic error in responses to HTTP requests to a specific resource on an embedded device's webserver. So my plan is to run a test over night (or even weekend), capture the ...
2
votes
0answers
907 views

IP Conflicts from mikrotik router for multiple ip addresses (that it isnt assigned)

I have a point to point wireless connection using two mikrotiks. When I plug the mikrotik into a switch with just my laptop I get an IP address conflict on my machine no matter what IP I am assigned. ...
11
votes
2answers
18k views

How to make wireshark filter POST-requests only?

How to make wireshark filter POST-requests only?
0
votes
1answer
228 views

Strange UDP/TFTP Problem

My TFTP client only seems to be getting responses from the TFTP server to its RRQ (download requests) if I watch the traffic in wireshark. If I shut down wireshark (running on the TFTP server), the ...
0
votes
0answers
370 views

Why server is sending RST?

Scenario is : We have a server machine behind a DSL router to which multiple clients are connecting over internet. For few days it worked fine but from today we have observed frequent disconnection. ...
1
vote
2answers
3k views

How can I monitor HTTPS traffic with Wireshark? [duplicate]

Possible Duplicate: How can I filter https when monitoring traffic with Wireshark? I want to verify that the analytics package I've added to my iOS app is attempting to talk to the ...
5
votes
2answers
1k views

Capturing multicast data with Wireshark with IGMP Snooping Enabled at the switch

I am trying to capture multicast traffic via Wireshark (actually TShark), however the switch has IGMP snooping enabled and will only send Multicast traffic on the ports that have an active IGMP ...
0
votes
1answer
361 views

In WireShark, what exactly is X-FCCKV2?

When I filtered HTTP traffic in Wireshark I bumped into a X-FCCKV2 HTTP header in the collected info under the Hypertext Transfer Protocol. I've researched it on Google but found nothing. What does ...
2
votes
1answer
625 views

Wireshark Display Filtered for Unreplied ICMP Echo Packets

Is there a wireshark display filter that will find ICMP echo requests that didn't have a reply?
4
votes
2answers
6k views

Best way to analyze pcap files from Wireshark?

I've got 50-100MB pcap files captured from Wireshark and need to analyze where most of the traffic is going to/coming from. What's the best way of doing this? Ideally I'd like to end up with an ...
0
votes
2answers
595 views

Capturing local traffic on Windows Server 2008 R2

I've got three different applications running on the same Windows Server 2008 R2 machine that communicate with eachother over TCP/IP. All three applications use the actual IP address of the server (vs ...
3
votes
1answer
2k views

WireShark - Capturing Packets on Multiple IP Address (FIlter)

I'm looking for the syntax to do a capture filter on WireShark, by capturing the traffic on several (specific) IP addresses. I understand how to capture a range, and an individual IP address. However, ...
2
votes
4answers
378 views

How can i measure the load of a WAN Connection with Wireshark?

I have a 100 Mbit WAN connection and want to check the load on it for a week. So I put a hub (10/100Mbit) behind the WAN connection and connected a laptop with wireshark on it. Here is now my ...
1
vote
1answer
2k views

Capture HTTP GET requests

In the Wireshark wiki is an example for filtering HTTP GET requests: Capture HTTP GET requests. This looks for the bytes 'G', 'E', 'T', and ' ' (hex values 47, 45, 54, and 20) just after the TCP ...
3
votes
1answer
435 views

SSL Packet inspection on Linux

I'm trying to build a web client for an HTTPS website. I think I've done everything right, yet obviously I get a different result in the browser than with my crawler. As far as I understand, there is ...
7
votes
4answers
42k views

What causes duplicate ACK records?

We're reviewing Wireshark captures from a few client machines that are showing multiple duplicate ACK records which then triggers retransmit and out-of-sequence packets. These are shown in the ...
0
votes
0answers
474 views

Socket Error 10054 & 10060

We are experiencing a problem after moving some software from one server to another. the client has remained on the same machine. Old Server: Windows 2003 server Physical machine New Server: Windows ...
4
votes
3answers
393 views

determining what ports a program uses

I'm trying to use wireshark to determine what ports a certain program uses. The program connects to the server fine if we are on the same network, but I obviously need to forward the ports on the ...
11
votes
2answers
15k views

How can I filter https when monitoring traffic with Wireshark?

I want to observe the HTTPs protocol. How can I use a Wireshark filter to do that?
3
votes
2answers
1k views

Silently start Wireshark

I have a computer in our office that always gets infected by viruses. Because of this, I would like to use Wireshark (or at least something) to monitor internet traffic for a while on this machine. ...
0
votes
2answers
1k views

Problem with WireShark (MySQL sniffing)

How can I snif MySQL data using WireShark? Also I used «mysqlsniffer» and have no results. There are no any packets from MySQL. I've filtered by «MySQL.isPresent» in WireShark but nothing happened. ...
0
votes
2answers
1k views

Getting wireshark to see network (uplink) traffic?

I have wireshark on a win 7 toshiba laptop plugged in to a hp procurve switch. I set the port the laptop is plugged in to as a 'monitor' port, monitoring all the other ports. I have 1 other computer ...
2
votes
2answers
1k views

wireshark not seeing all packets on WiFi

I'm using Wireshark on OSX, trying to sniff my home network over WiFi. While I can see packets that are sent to/from the host I'm sniffing on, I'm not seeing anything else that goes over the WiFi. ...
1
vote
3answers
105 views

Server access through switch port

I am using wireshark to monitor traffic on a server - Problem is, the computer I am using is only a terminal wired through the switch. Main line comes into the server which is relayed to multi-port ...
2
votes
4answers
8k views

Wireshark - Graphic analysis tool. anyone knows?

Does anyone knows a graphical tool to analyse wireshark captures? Like something that can agregate traffic by ip's and by protocol and show's it graphicly. Anyone knows a freeware/opensource ...
0
votes
3answers
125 views

How to tell which interface was used for capturing data in a wireshark capture file

I have an old capture file that needs analysis, and I need to know which interface was chosen to capture the traffic, is there a way to find out?
1
vote
1answer
2k views

What causes the issue (possibly packet loss) in this scenario

I'm trying to diagnose a network related problem - please understand these points before suggesting an answer (apologies if more information is required, I will add anything people ask). We have a ...
0
votes
1answer
224 views

What is nicetec-mgmt on port 2557?

I've been looking at wireshark, and have a lot of UDP traffic to port 2557 (from 25322), the port is reportedly used for nicetec-mgmt, does anyone know what this is?
3
votes
3answers
487 views

How do I find out what all this traffic is?

I have seen a consistent spike in traffic over my network since Monday morning and I don't know where it's coming from! I don't have netflow routers (like I would like), I have IPCop firewalls. ...
3
votes
5answers
6k views

How to capture Wireshark packets when using a switched network in Windows

I’ve been asked by our SIP trunk provider to run a Wireshark trace on the network when we receive calls. The issue I’m having is that if I run Wireshark from a laptop plugged into the main switch I ...
4
votes
1answer
1k views

tcpdump filter for tcp zero window messages

Is there a pcap filter for TCPDump that will allow be to filter zero window messages? I know how to filter these in a wireshark display filter (tcp.analysis.zero_window) but the amount of data I ...
2
votes
5answers
4k views

How can I use Wireshark to analyze slow Active Directory logins?

This page seems to imply that Wireshark can only begin capturing after boot, but it looks like someone else has run into this problem before and didn't get anywhere. It doesn't necessarily have to ...
1
vote
1answer
1k views

Error while decrypting https traffic in Wireshark

I configured Jetty with a self-generated private key and cert after a long struggle. Now, I'm having trouble decrypting the HTTPS traffic from the Jetty server that I captured for inspection. The ...
0
votes
2answers
1k views

Allow connections to only a specific URL via HTTPS with iptables, -m recent (potentially) and -m string (definitely)

Let's say that, for example, I want to allow connections only to subdomain.mydomain.com; I have it partially working, but it sometimes gets in a freaky loop with the client key exchange once the ...
5
votes
2answers
3k views

Why my laptop sends ARP request to itself?

I have just started to learn about protocols. While studying the packets in wireshark, I came across a ARP request sent by my machine to my own IP. Here is the details of the packet : No. Time ...
0
votes
2answers
649 views

unable to sniff traffic despite network interface being in monitor or promiscuous mode

I'm trying to sniff out my network's wireless traffic but am having issues. I'm able to put the card in monitor mode, but am unable to see any traffic except broadcasts, multicasts and probe/beacon ...
4
votes
1answer
8k views

Wireshark Display Filter protocol==TLSV1? (and PacketLength)

What would the filter expression be to just select the protocols where the protocol = TLSV1? Something obvious like protocol == "TLSV1" or TCP.protocol == "TLSV1" is apparently not the right way. ...
2
votes
2answers
2k views

What program sent which packet to the network [duplicate]

I would like to have a tcpdump like program that shows which program sent a specific packet, instead of just getting the port number. This is a generic problem I've had on and off sometimes when you ...