Wireshark is a open source Network Protocol Analyzer under GNU License.

learn more… | top users | synonyms

2
votes
4answers
965 views

Extremely high arp fllooding from the router

My subnet is 10.162.0.0/16. We have a router with a couple of interfaces. Gateway for my subnet is 10.162.0.1. The router is situated in another building and I haven't direct access to it. Line from ...
1
vote
1answer
886 views

How can I find out the source of arp request if it is in another subnet?

Our subnet is connected with other subnets with router. Using wireshark I see some arp requests coming to ip addresses of our subnet from the router. Such as Broadcast ARP 60 Who has ...
3
votes
1answer
1k views

huge packet loss and checksum errors

Our 2008 server began to work very slowly within 2 weeks. Our web sites (iis 7.5) are loading very slowly and sometimes its freezing. We began testing with wireshark and saw that our packets are ...
0
votes
1answer
525 views

Router is continually broadcasting the same ARP request, with the exact contents

I hope the question is clear and that this is correct place to post the question. My router is broadcasting the same ARP frame over and over (once every second). It's probably not a big deal, but I ...
3
votes
2answers
623 views

How to separate PCAP by unique IP address

I have an hour long PCAP file which has about 60 individual network attacks done on our test network here at work. Each attack comes from a unique IP address which was not used elsewhere during the ...
1
vote
0answers
294 views

Creating keytab for computer account to decrypt packet capture

We are having an issue with our blackberry server (EWSTest fails at autodiscover lookup) and I am running a packet capture with Wireshark in an attempt to diagnose the issue. There is a conversation ...
-1
votes
1answer
1k views

Stealing internet by changing MAC address? [closed]

OK - I have a static IP - and I have been on the same provider for years - its a wired network (a cable goes directly to my network card) - and the cable is connected to a switch on a pole in the ...
4
votes
2answers
2k views

syn/ack sequence number confusion

I was looking at some random traffic in wireshark and came across this (using relative seq/ack numbers): 1. myIP -> 74.125.227.96 [SYN] seq=0 2. 74.125.227.96 -> myIP ...
2
votes
2answers
14k views

How to monitor VPN traffic with Wireshark on Windows 7?

I'm running Wireshark 1.6.7 (latest available release) x64 on Windows 7 x64. I only have a single network card on this computer, and Wireshark shows only it as an available adapter to capture packets ...
0
votes
1answer
667 views

Wireshark/encryption and openvpn

I have a linux openvpn router and a home dsl modem. The dsl modem has port 1234 open and forwards it onto eth0 on the linux router. I can connect to the router from a remote location no problem. All ...
0
votes
1answer
3k views

Why Wireshark does not recognize this HTTP response?

I have a trivial CGI script that outputs simple text content. It's written in Perl and using CGI module and it specifies only the most basic headers: print $q->header( -type ...
-1
votes
1answer
249 views

Checking HTTP response for website using Wireshark

Is there a specific way to know if the file that we download through a web server (e.g.: Java) can be verified through Wireshark? I want to check if the file is working perfectly from internal and ...
0
votes
1answer
503 views

wireshark windows - how to remote capture/analyze from a tshark or similar install?

I would like to set up some small, low-end hardware wireshark capture points on my network. I am hoping I can use something like command-line linux (ubuntu mini for example) to keep it light-weight. ...
1
vote
1answer
600 views

how to generate the graph in wireshark?

$ sudo tshark -i eth0 -R 'http.request.method == "GET"' "port 80" Running as user "root" and group "root". This could be dangerous. Capturing on eth0 5.641015 10.53.0.66 -> 209.85.143.104 HTTP ...
0
votes
2answers
5k views

NBSS Continuation Message - Wireshark - Definition?

Looking at a capture and seeing a "NBSS Continuation Message" port 445, but I cannot find any reference anywhere to what this might mean. I assume it's a normal message for the NetBIOS Session ...
1
vote
6answers
4k views

How to record SIP traffic / calls for future auditing?

We have a VOIP (SIP?) phone system and have to record all calls for specific phones in the company. It may be required at a future date to listen to these calls for auditing. These phones happen to ...
7
votes
5answers
15k views

How can I sniff the traffic of remote machine with wireshark?

I can sniff the traffic of my local pc but I would like to know how to I sniff the traffic of a remote machine by wireshark? When in capture option I select remote interface and enter my remote ip ...
4
votes
1answer
517 views

how to view hostnames in traffic entering my webserver (Apache)?

Is there any way I can view the hostnames used by incoming traffic that is accepted by my apache webserver? For example, say the webserver is set up to process incoming traffic for an IP address, ...
1
vote
1answer
270 views

PCAP to Syslog utility

I am looking for a tool which sniff all the traffic on an interface and produce a syslog like Cisco log in real time. Example : Feb 16 10:19:05 tcp S.S.S.S(6083) -> D.D.D.D(80), 1 packet Feb 16 ...
1
vote
2answers
982 views

Can't decrypt imaps traffic in Wireshark

I have currently problems to decrypt IMAPS Traffic in Wireshark. I set up the SSL Key with the correct IP Address, Port 993 and Protocol imap. The Key is the correct one. That is what I see in the ...
2
votes
2answers
2k views

Is there some capture filter (or alternatives) that is especially useful for wireless capture?

I'm capturing wireless traffic in monitor mode with WireShark. I want to capture traffic only for a certain BSS. While wlan.bssid == xx:xx:xx:xx:xx:xx works well as a display filter, I don't want my ...
1
vote
0answers
111 views

Why adding capture filters breaks the traffic dump in wireshark / windump?

I have a strange issue while trying to capture RTP (UDP) traffic. I have a phone using IP 192.168.9.4 and a Windows 2003 PC connected to the same switch (actually to the monitor port of the switch - ...
2
votes
1answer
139 views

CouchDB plugin for Wireshark?

I am trying to understand CouchDB network traffic with Wireshark and find it very difficult. A simple transaction with plain-text content seems to result in many lines in Wireshark, most of them ...
2
votes
1answer
964 views

Debugging slow SMB packets from a specific desktop client

I'm having some serious problems locating a slowdown, and I hope you could assist me with this. We have an office network with ~50 clients and a main file server running Windows Server 2008 R2 ...
1
vote
0answers
257 views

Wireshark like app for embeded Windows CE

Greetings Im looking for a standalone wireshark like app that I can run on a embedded Windows CE device in order to debug some network issues. Is anyone aware of such a thing. I know version 5 has ...
2
votes
1answer
2k views

Wireshark - Filter for Inbound HTTP Requests on Port 80 Only

We are integrating with an outside company in which we have had to make certain IP and port restrictions. First, I am novice at network administration, so If I butcher anything, please forgive me. ...
0
votes
1answer
264 views

What is Reverse Gossip Transfer Protocol?

Playing with wireshark, I see a bunch of packets that say something like rgtp > https [ACK] Seq=???? Ack=?????? Win=????? Len=0 What is a Reverse Gossip Ttransfer Protocol? What is it used for, ...
0
votes
2answers
363 views

Needs help to understand the wireshark results of a data transferring

In my LAN, I have a router that runs a Samba server and my PC connects to the router. I wiresharked during uploading a file from my PC to the samba server. Below is a shortcut of the wireshark ...
3
votes
5answers
7k views

Wireshark filter to only capture Incoming Packets?

I am trying to setup a Filter (so my log files aren't massive) that will capture only incoming traffic. I have looked on http://wiki.wireshark.org/CaptureFilters but so far have been unable to find a ...
1
vote
1answer
1k views

Configuring Wireshark for Rolling Captures during DDoS Attack

We have been getting hit with DDoS Attacks on various machines for months. The datacenter either null routes or sets up an ACL for us. However, it just came to my attention there's a tool floating ...
0
votes
1answer
196 views

Communication problems on secondary interface tap0

I am using UDP over ipv6 as communication stack. I have network client running on secondary virtual interface tap0. It generates messages for server which is supposed to run on the same interface but ...
1
vote
1answer
378 views

Catalyst 3560G SPAN session not mirroring IGMP packets

I am developing a device which acts as a multicast host, and want to observe it as it responds to IGMP Queries. My Catalyst 3560G is set up as follows (full config below): Port 0/1 is a TFTP server ...
1
vote
7answers
4k views

Firewall blocks traffic - how to find out what ports / ip addresses are used by software?

Well I get a "host was not accessible" error when trying to use a software. I don't know which port they use nor which address they are trying to reach. Is there a more or less easy way to figure that ...
1
vote
3answers
15k views

Troubleshoot large number of TCP retransmits / dup ack / segment lost

I have a problem with RDC slowing to a crawl or disconnecting entirely. Client is XP SP3 w/ RDC 6, server is Win 2k8 R2. Both have been scanned thoroughly and found to be virus free. I downloaded ...
0
votes
1answer
99 views

What does the C3 portion of 0xC308(BE) mean in an ICMP identifier?

I am using Wireshark to analyze traffic. I know that the 8 refers to the echo (ping) type. I have been unsuccesful with finding information regarding the C3 byte. Identifier (BE): 49928 (0xc308)
2
votes
3answers
458 views

Cannot connect to SQL Server and Wireshark don't listen anything

I'm trying to connect to a SQL Server from outside the LAN, so I opened port 1433 (default SQL Server port) in the firewall. On the server side I'm listening with Wireshark and I can listen ping ...
0
votes
1answer
1k views

ICMP Data Field Modified - What does it Mean?

Normal ICMP Data fields are composed of a pretty standard 32 byte string of alphabet characters. abcdefghijklmnopqrstuvwabcdefghi I have captured a series of ICMP echo requests using WireShark with ...
-1
votes
1answer
176 views

Measuring delays between various components on a localhost

I need to profile a web application from a system performance standpoint and find out for typical user actions (accessing the home page, logging in...) where the delay comes from. The website uses the ...
0
votes
1answer
376 views

Tcp retransmission tcp session reconstruction

Im trying to write a program that reconstructs tcp sessions. I have a pcap file which have packets. The problem is i dont know which packets i should use to construct sessions when there is a ...
1
vote
1answer
7k views

Why can't I start the WinPCap npf service when I'm the administrator?

I recently installed Wireshark on a Win 7 host, but now it won't let me start the NPF service. I get: C:\Windows\system32>net start npf System error 5 has occurred. Access is denied. That's ...
0
votes
1answer
252 views

Using tshark to generate traffic logs every X seconds

I'm trying to use tshark to maintain a running history of all the packets that are going through an interface, for say 30 seconds. I want it to be human readable. This is a linux machine, and without ...
1
vote
2answers
64 views

How can I filter packets from a port monitor?

I have some data going from Point A to Point B. I have a SPAN monitor set up to a monitoring device C. To recreate some real world scenarios, I want to filter out all traffic which is a certain type ...
0
votes
2answers
701 views

How to use tshark to do this task

I don't have any base knowledge about tshark, and it is hard to find any tutorial to help me with this. So now I have a pcap file which consists a lot of network flows; a time range; an ip addr; a ...
0
votes
2answers
171 views

SYN packets sent from one server but never arrives at destination

I am troubleshooting network problems for a client, remotely. The problem they have is that they get "connection timed out" occasionally between a web server and and a back-end search server. They can ...
8
votes
3answers
8k views

Stopping the WinPcap Packet capture service

I just installed WireShark, which also installed WinPcap. During the installation it said "do you want xxx to start automatically", which I answered yes. Now I would like to stop the service when I ...
4
votes
2answers
7k views

How to debug “HTTP request sent, awaiting response”?

I have a Linux server on an ADSL connection, and I just noticed that sometimes I get Connecting to example.com|xxx.xxx.xxx.122|:80... connected. HTTP request sent, awaiting response... when I use ...
1
vote
1answer
316 views

How can I display-filter the correspondant response to a specific display-filtered request in wireshark?

I am just tracing a very sporadic error in responses to HTTP requests to a specific resource on an embedded device's webserver. So my plan is to run a test over night (or even weekend), capture the ...
2
votes
2answers
1k views

IP Conflicts from mikrotik router for multiple ip addresses (that it isnt assigned)

I have a point to point wireless connection using two mikrotiks. When I plug the mikrotik into a switch with just my laptop I get an IP address conflict on my machine no matter what IP I am assigned. ...
15
votes
2answers
30k views

How to make wireshark filter POST-requests only?

How to make wireshark filter POST-requests only?
0
votes
1answer
264 views

Strange UDP/TFTP Problem

My TFTP client only seems to be getting responses from the TFTP server to its RRQ (download requests) if I watch the traffic in wireshark. If I shut down wireshark (running on the TFTP server), the ...