Wireshark is a open source Network Protocol Analyzer under GNU License.

learn more… | top users | synonyms

0
votes
1answer
233 views

What is nicetec-mgmt on port 2557?

I've been looking at wireshark, and have a lot of UDP traffic to port 2557 (from 25322), the port is reportedly used for nicetec-mgmt, does anyone know what this is?
3
votes
3answers
519 views

How do I find out what all this traffic is?

I have seen a consistent spike in traffic over my network since Monday morning and I don't know where it's coming from! I don't have netflow routers (like I would like), I have IPCop firewalls. ...
3
votes
5answers
7k views

How to capture Wireshark packets when using a switched network in Windows

I’ve been asked by our SIP trunk provider to run a Wireshark trace on the network when we receive calls. The issue I’m having is that if I run Wireshark from a laptop plugged into the main switch I ...
5
votes
1answer
1k views

tcpdump filter for tcp zero window messages

Is there a pcap filter for TCPDump that will allow be to filter zero window messages? I know how to filter these in a wireshark display filter (tcp.analysis.zero_window) but the amount of data I ...
2
votes
5answers
4k views

How can I use Wireshark to analyze slow Active Directory logins?

This page seems to imply that Wireshark can only begin capturing after boot, but it looks like someone else has run into this problem before and didn't get anywhere. It doesn't necessarily have to ...
1
vote
1answer
1k views

Error while decrypting https traffic in Wireshark

I configured Jetty with a self-generated private key and cert after a long struggle. Now, I'm having trouble decrypting the HTTPS traffic from the Jetty server that I captured for inspection. The ...
0
votes
2answers
1k views

Allow connections to only a specific URL via HTTPS with iptables, -m recent (potentially) and -m string (definitely)

Let's say that, for example, I want to allow connections only to subdomain.mydomain.com; I have it partially working, but it sometimes gets in a freaky loop with the client key exchange once the ...
5
votes
2answers
3k views

Why my laptop sends ARP request to itself?

I have just started to learn about protocols. While studying the packets in wireshark, I came across a ARP request sent by my machine to my own IP. Here is the details of the packet : No. Time ...
0
votes
2answers
694 views

unable to sniff traffic despite network interface being in monitor or promiscuous mode

I'm trying to sniff out my network's wireless traffic but am having issues. I'm able to put the card in monitor mode, but am unable to see any traffic except broadcasts, multicasts and probe/beacon ...
4
votes
1answer
8k views

Wireshark Display Filter protocol==TLSV1? (and PacketLength)

What would the filter expression be to just select the protocols where the protocol = TLSV1? Something obvious like protocol == "TLSV1" or TCP.protocol == "TLSV1" is apparently not the right way. ...
3
votes
2answers
3k views

What program sent which packet to the network [duplicate]

I would like to have a tcpdump like program that shows which program sent a specific packet, instead of just getting the port number. This is a generic problem I've had on and off sometimes when you ...
1
vote
3answers
522 views

Dropped packets in Linux

I'am using a machine as a router, it works sort of fine, however if I do a ping -t whatever.server it will always cause a 3-4% package loss, no matter what server. Looking at ifconfig or netstat -i ...
2
votes
2answers
9k views

How to filter on a the contents of a packet in Wireshark?

I've got an application that is communicating with an Oracle database, it's logging is pretty crappy so the only way I can workout what SQL it is sending to our database is by packet sniffing for ...
1
vote
1answer
1k views

tshark (wireshark) to pinpoint connect reset / retransmitted issue

Windows server 2003. I have the latest WireShark installed on the server and need to capture packets on the server to pinpoint a randomly happened connection reset /retransmitted issue. When the ...
2
votes
3answers
4k views

Wireshark won't pick up packets sent from localhost to localhost via network [duplicate]

I'm running on Windows and trying to get Wireshark to pick up my network traffic. It picks up all outbound and inbound traffic fine, except for a client/server I'm running on my local system. As it ...
1
vote
1answer
355 views

tshark (wireshark) filters: Where are they located?

While troubleshooting a MySQL issue, I came across this command at commandlinefu: tshark -i any -T fields -R mysql.query -e mysql.query I am trying to understand it before I actually use it. ...
-3
votes
1answer
2k views

Why can't I “decode” packets using Wireshark and some wireless network?

Re, I have no problem capturing packets on various wireless hotspots but there are a couple in my town that I just cannot understand why packets aren't being captured, other than those of my own. ...
2
votes
1answer
1k views

Extract files from traffic captured with WireShark

Is there a way to extract image, video files from WireShark capture files? Is there a tool to achieve this?
0
votes
1answer
347 views

Network Monitoring from one port on switch

Monitoring the all network traffic from one port on the switch and captured the all traffic by using wireshark. Here i found all packet captured in the summary result and it has dropped packet ...
0
votes
2answers
244 views

Cisco switch sending out excessive STP packets

I have a Catalyst 2900 that's sending out an STP packet about once ever 1-2 seconds. Is that excessive?
5
votes
2answers
8k views

How can I search the info column in WireShark?

WireShark | Windows I want to search a packet capture of SMTP traffic for specific addresses/messages. Normally, I just sort the info column and browse but it would be nice if I could just run a ...
0
votes
3answers
6k views

Debugging UPnP / DLNA via Wireshark

Is there any way to parse / interpret the XMLs sent as part of a DLNA / UPnP using Wireshark, or any other network sniffer? I can get the raw packets, but it would be nice to see them parsed, to make ...
0
votes
1answer
3k views

Convert .txt file to .cap to open it by Wireshark

I have packet in a text file how I can convert it to .cap file? I need to analyze this packet by Wireshark. Thanks
8
votes
4answers
12k views

Can Wireshark read data being sent to/from other computers?

Let's say WireShark is installed on computer A. And let's say I am looking at a Youtube video on the computer B. Can WireShark see what computer B is doing?
0
votes
1answer
454 views

wireshark extract w3c log file

Does anyone know how I would go about extracting urls in w3c extended log format from a wireshark pcap capture file? Thanks
0
votes
2answers
1k views

When analyzing packets with Wireshark, is there a way to know which program is sending which packet?

is there an easy way to know from where the packets come from? Which program? My pc which is on 192.168.0.100 is continuously sending packets (TCP and SMB) to an unknown host (192.168.1.99) and I ...
4
votes
5answers
4k views

Parse HTTP requests through Wireshark?

Is there any way to parse HTTP request data in wireshark? For example, can I expose the request parameters upon an HTTP GET request (being sent by my machine), so that I don't need to read the ...
0
votes
1answer
833 views

RST ACK over SSL in FireFox POST request

The original question is here. In short, for few users several POST requests hangs and are aborted after couple of minutes, when working over SSL (http is OK). What I'm asking here is an explanation ...
0
votes
1answer
527 views

Is it possible to export Wireshark syslogs to another device?

My company is trying to export the live captured packet syslogs to a device within the network. We were just wondering if it is actually possible to do it with the Wireshark acting as a syslog relay ...
4
votes
4answers
8k views

How to use sniffer to troubleshoot SMTP traffic?

We're having an issue where we are no longer receiving external emails. (We have an Exchange mail system, with a Barracuda spam filter and Watchguard hardware firewall.) The problem is that mail ...
0
votes
1answer
177 views

Need help getting StateServer to work, trying to decipher WireShark to figure out why

I'm using WireShark to try to figure out why I can't get my ASP.NET application (which is deployed to IIS6) to use a remote ASP.NET StateServer. For the record, StateServer works if my application is ...
1
vote
1answer
265 views

NTP and phones (need a useful ntp test)

I have a sip phone which gets its time from either an ntp server or the asterisk server. however the packets never seem to get replied to I put wireshark in the way and looked at anything with ...
0
votes
2answers
246 views

Identifying VoIP Users

I'm looking for a way to identify as many consumer VoIP users on my ISP network as possible using packet analysis. My setup is like this: On my core switch, all traffic going in and out of gigabit1 ...
1
vote
1answer
337 views

Using L7 to classify pcap data

I've recently become familiar with the Layer 7 Filter project, and it's ability to classify protocols is quite interesting. All of the information about its use, however, concerns using the filters ...
4
votes
6answers
2k views

Does Wireshark pose a threat when installed on a server in the DMZ?

If you install wireshark on a web server sitting in the DMZ, is there a hack that can be used to get backdoor entrace to that server even when RDP is disblaed? I'm trying to monitor the wire on the ...
8
votes
4answers
22k views

How do i convert wireshark capture files to text files?

How can I convert wirshark captures (.cap) files to text files or some format from which I can read the file and parse its contents ? Regards, Mithun
1
vote
1answer
1k views

TCP RST Reset Every 5 Minutes on Windows 2003 sp2

Recently I had a web developer come to me and ask why he was receiving connection errors in his app that was accessing a sql database. So, I went through my normal trouble shooting steps to isolate ...
1
vote
0answers
843 views

TCP Zero Window with no corresponding Window Update

I am trying to debug a network issue and am using Wireshark and tcpdump to grab packets from my server. I have one client application that is grabbing all my available connections and then holding ...
1
vote
3answers
3k views

debugging spiking netstat “failed connection attempts” with iptables

http://farm4.static.flickr.com/3305/4588110530_a60c934289_o.png This graph is munin collecting netstat -s output. I want to determine where the connections are coming from. There is nothing obvious ...
3
votes
1answer
5k views

How to filter for HTTP 500 responses and their requests in Wireshark?

How do I filter for HTTP 500 responses and their requests in Wireshark? I'm able to use http.response.code == 500 to find all the responses which got the return code 500 but I want to be able to see ...
0
votes
2answers
2k views

Track IP Messenger's chatting by wireshark

We have Linux server ( RHEL 5 ), and some client machines ( Windows XP ) in local area network. We using server as proxy server. I am using squid proxy. My windows machines using internet by proxy. ...
2
votes
1answer
1k views

WireShark - wireshark trace traffic from my local browser to a local .net application I have with a HttpListener? (e.g. local to local)

Can wireshark trace traffic from my local browser to a local .net application I have with a HttpListener? (e.g. local to local) I can't seem to detect this traffic at the moment with wireshark. Is ...
3
votes
3answers
10k views

wireshark http POST

I would like to have a http POST request method CAPTURE filter. I know it is easy to do it by display filter http.request.method==POST but I need tcpdump compatible. I wrote tcp dst port 80 and ...
4
votes
2answers
1k views

Saving Wireshark capture settings for future use

Is there any way to save Wireshark capture options? So it can be reuse after restart Wireshark. Also, if the saved file is in plain text, it's possible to use scripts generating bunch of capture ...
1
vote
1answer
738 views

Checking rtp stream audio quality

We are working in a test environment and need to monitor the audio quality of an rtp stream that is being captured using tshark. Right now we are able to capture the audio and access the file through ...
6
votes
2answers
8k views

No interface available for Wireshark running on Ubuntu with wireless connection

I'm completely new to wireshark. I have Ubuntu on a Dell with wireless connection. When I go to Wireshark Capture Option, I cannot select any interface since no interface is listed. What is the ...
3
votes
2answers
10k views

With wireshark how can I filter by packet size?

I can filter for packet lengths using a display filter containing data.len >= XXX, but I'd really like to use a capture filter for this for efficiency... is there a way to do it?
3
votes
1answer
1k views

Wireshark arp packets

In wireshark, after capturing some arp packets, what is the significance of all 1's in the destination field. of an Ethernet II frame?
4
votes
4answers
2k views

Wireshark and IPSec

I am trying to troubleshoot communication between two servers on a Windows network where IPSEC is encrypting everything. I installed wireshark on the source server and captured traffic at the point ...
2
votes
2answers
1k views

wireshark captures different on two computers from the same port

I Have a Windows XP Machine Running wireshark, connected to a Mirror port on a network. I'm capturing with no filtering, and it can only see half of some two way TCP conversations. I had thought it ...