Wireshark is a open source Network Protocol Analyzer under GNU License.

learn more… | top users | synonyms

0
votes
2answers
377 views

Needs help to understand the wireshark results of a data transferring

In my LAN, I have a router that runs a Samba server and my PC connects to the router. I wiresharked during uploading a file from my PC to the samba server. Below is a shortcut of the wireshark ...
3
votes
5answers
8k views

Wireshark filter to only capture Incoming Packets?

I am trying to setup a Filter (so my log files aren't massive) that will capture only incoming traffic. I have looked on http://wiki.wireshark.org/CaptureFilters but so far have been unable to find a ...
1
vote
1answer
1k views

Configuring Wireshark for Rolling Captures during DDoS Attack

We have been getting hit with DDoS Attacks on various machines for months. The datacenter either null routes or sets up an ACL for us. However, it just came to my attention there's a tool floating ...
0
votes
1answer
208 views

Communication problems on secondary interface tap0

I am using UDP over ipv6 as communication stack. I have network client running on secondary virtual interface tap0. It generates messages for server which is supposed to run on the same interface but ...
1
vote
1answer
435 views

Catalyst 3560G SPAN session not mirroring IGMP packets

I am developing a device which acts as a multicast host, and want to observe it as it responds to IGMP Queries. My Catalyst 3560G is set up as follows (full config below): Port 0/1 is a TFTP server ...
1
vote
7answers
4k views

Firewall blocks traffic - how to find out what ports / ip addresses are used by software?

Well I get a "host was not accessible" error when trying to use a software. I don't know which port they use nor which address they are trying to reach. Is there a more or less easy way to figure that ...
1
vote
3answers
19k views

Troubleshoot large number of TCP retransmits / dup ack / segment lost

I have a problem with RDC slowing to a crawl or disconnecting entirely. Client is XP SP3 w/ RDC 6, server is Win 2k8 R2. Both have been scanned thoroughly and found to be virus free. I downloaded ...
0
votes
1answer
100 views

What does the C3 portion of 0xC308(BE) mean in an ICMP identifier?

I am using Wireshark to analyze traffic. I know that the 8 refers to the echo (ping) type. I have been unsuccesful with finding information regarding the C3 byte. Identifier (BE): 49928 (0xc308)
2
votes
3answers
511 views

Cannot connect to SQL Server and Wireshark don't listen anything

I'm trying to connect to a SQL Server from outside the LAN, so I opened port 1433 (default SQL Server port) in the firewall. On the server side I'm listening with Wireshark and I can listen ping ...
0
votes
1answer
1k views

ICMP Data Field Modified - What does it Mean?

Normal ICMP Data fields are composed of a pretty standard 32 byte string of alphabet characters. abcdefghijklmnopqrstuvwabcdefghi I have captured a series of ICMP echo requests using WireShark with ...
-1
votes
1answer
182 views

Measuring delays between various components on a localhost

I need to profile a web application from a system performance standpoint and find out for typical user actions (accessing the home page, logging in...) where the delay comes from. The website uses the ...
0
votes
1answer
418 views

Tcp retransmission tcp session reconstruction

Im trying to write a program that reconstructs tcp sessions. I have a pcap file which have packets. The problem is i dont know which packets i should use to construct sessions when there is a ...
1
vote
1answer
8k views

Why can't I start the WinPCap npf service when I'm the administrator?

I recently installed Wireshark on a Win 7 host, but now it won't let me start the NPF service. I get: C:\Windows\system32>net start npf System error 5 has occurred. Access is denied. That's ...
0
votes
1answer
277 views

Using tshark to generate traffic logs every X seconds

I'm trying to use tshark to maintain a running history of all the packets that are going through an interface, for say 30 seconds. I want it to be human readable. This is a linux machine, and without ...
1
vote
2answers
64 views

How can I filter packets from a port monitor?

I have some data going from Point A to Point B. I have a SPAN monitor set up to a monitoring device C. To recreate some real world scenarios, I want to filter out all traffic which is a certain type ...
0
votes
2answers
752 views

How to use tshark to do this task

I don't have any base knowledge about tshark, and it is hard to find any tutorial to help me with this. So now I have a pcap file which consists a lot of network flows; a time range; an ip addr; a ...
0
votes
2answers
180 views

SYN packets sent from one server but never arrives at destination

I am troubleshooting network problems for a client, remotely. The problem they have is that they get "connection timed out" occasionally between a web server and and a back-end search server. They can ...
12
votes
3answers
11k views

Stopping the WinPcap Packet capture service

I just installed WireShark, which also installed WinPcap. During the installation it said "do you want xxx to start automatically", which I answered yes. Now I would like to stop the service when I ...
4
votes
2answers
8k views

How to debug “HTTP request sent, awaiting response”?

I have a Linux server on an ADSL connection, and I just noticed that sometimes I get Connecting to example.com|xxx.xxx.xxx.122|:80... connected. HTTP request sent, awaiting response... when I use ...
1
vote
1answer
411 views

How can I display-filter the correspondant response to a specific display-filtered request in wireshark?

I am just tracing a very sporadic error in responses to HTTP requests to a specific resource on an embedded device's webserver. So my plan is to run a test over night (or even weekend), capture the ...
2
votes
2answers
2k views

IP Conflicts from mikrotik router for multiple ip addresses (that it isnt assigned)

I have a point to point wireless connection using two mikrotiks. When I plug the mikrotik into a switch with just my laptop I get an IP address conflict on my machine no matter what IP I am assigned. ...
21
votes
2answers
37k views

How to make wireshark filter POST-requests only?

How to make wireshark filter POST-requests only?
0
votes
1answer
294 views

Strange UDP/TFTP Problem

My TFTP client only seems to be getting responses from the TFTP server to its RRQ (download requests) if I watch the traffic in wireshark. If I shut down wireshark (running on the TFTP server), the ...
3
votes
2answers
5k views

How can I monitor HTTPS traffic with Wireshark? [duplicate]

Possible Duplicate: How can I filter https when monitoring traffic with Wireshark? I want to verify that the analytics package I've added to my iOS app is attempting to talk to the ...
5
votes
4answers
3k views

Capturing multicast data with Wireshark with IGMP Snooping Enabled at the switch

I am trying to capture multicast traffic via Wireshark (actually TShark), however the switch has IGMP snooping enabled and will only send Multicast traffic on the ports that have an active IGMP ...
0
votes
1answer
452 views

In WireShark, what exactly is X-FCCKV2?

When I filtered HTTP traffic in Wireshark I bumped into a X-FCCKV2 HTTP header in the collected info under the Hypertext Transfer Protocol. I've researched it on Google but found nothing. What does ...
2
votes
1answer
984 views

Wireshark Display Filtered for Unreplied ICMP Echo Packets

Is there a wireshark display filter that will find ICMP echo requests that didn't have a reply?
4
votes
2answers
9k views

Best way to analyze pcap files from Wireshark?

I've got 50-100MB pcap files captured from Wireshark and need to analyze where most of the traffic is going to/coming from. What's the best way of doing this? Ideally I'd like to end up with an ...
0
votes
2answers
979 views

Capturing local traffic on Windows Server 2008 R2

I've got three different applications running on the same Windows Server 2008 R2 machine that communicate with eachother over TCP/IP. All three applications use the actual IP address of the server (vs ...
3
votes
1answer
2k views

WireShark - Capturing Packets on Multiple IP Address (FIlter)

I'm looking for the syntax to do a capture filter on WireShark, by capturing the traffic on several (specific) IP addresses. I understand how to capture a range, and an individual IP address. However, ...
2
votes
4answers
493 views

How can i measure the load of a WAN Connection with Wireshark?

I have a 100 Mbit WAN connection and want to check the load on it for a week. So I put a hub (10/100Mbit) behind the WAN connection and connected a laptop with wireshark on it. Here is now my ...
1
vote
1answer
4k views

Capture HTTP GET requests

In the Wireshark wiki is an example for filtering HTTP GET requests: Capture HTTP GET requests. This looks for the bytes 'G', 'E', 'T', and ' ' (hex values 47, 45, 54, and 20) just after the TCP ...
4
votes
1answer
595 views

SSL Packet inspection on Linux

I'm trying to build a web client for an HTTPS website. I think I've done everything right, yet obviously I get a different result in the browser than with my crawler. As far as I understand, there is ...
15
votes
4answers
73k views

What causes duplicate ACK records?

We're reviewing Wireshark captures from a few client machines that are showing multiple duplicate ACK records which then triggers retransmit and out-of-sequence packets. These are shown in the ...
4
votes
3answers
515 views

determining what ports a program uses

I'm trying to use wireshark to determine what ports a certain program uses. The program connects to the server fine if we are on the same network, but I obviously need to forward the ports on the ...
15
votes
4answers
32k views

How can I filter https when monitoring traffic with Wireshark?

I want to observe the HTTPs protocol. How can I use a Wireshark filter to do that?
3
votes
2answers
2k views

Silently start Wireshark

I have a computer in our office that always gets infected by viruses. Because of this, I would like to use Wireshark (or at least something) to monitor internet traffic for a while on this machine. ...
0
votes
2answers
2k views

Problem with WireShark (MySQL sniffing)

How can I snif MySQL data using WireShark? Also I used «mysqlsniffer» and have no results. There are no any packets from MySQL. I've filtered by «MySQL.isPresent» in WireShark but nothing happened. ...
0
votes
2answers
1k views

Getting wireshark to see network (uplink) traffic?

I have wireshark on a win 7 toshiba laptop plugged in to a hp procurve switch. I set the port the laptop is plugged in to as a 'monitor' port, monitoring all the other ports. I have 1 other computer ...
2
votes
2answers
2k views

wireshark not seeing all packets on WiFi

I'm using Wireshark on OSX, trying to sniff my home network over WiFi. While I can see packets that are sent to/from the host I'm sniffing on, I'm not seeing anything else that goes over the WiFi. ...
1
vote
3answers
109 views

Server access through switch port

I am using wireshark to monitor traffic on a server - Problem is, the computer I am using is only a terminal wired through the switch. Main line comes into the server which is relayed to multi-port ...
3
votes
4answers
11k views

Wireshark - Graphic analysis tool. anyone knows? [closed]

Does anyone knows a graphical tool to analyse wireshark captures? Like something that can agregate traffic by ip's and by protocol and show's it graphicly. Anyone knows a freeware/opensource ...
0
votes
3answers
135 views

How to tell which interface was used for capturing data in a wireshark capture file

I have an old capture file that needs analysis, and I need to know which interface was chosen to capture the traffic, is there a way to find out?
1
vote
1answer
4k views

What causes the issue (possibly packet loss) in this scenario

I'm trying to diagnose a network related problem - please understand these points before suggesting an answer (apologies if more information is required, I will add anything people ask). We have a ...
0
votes
1answer
277 views

What is nicetec-mgmt on port 2557?

I've been looking at wireshark, and have a lot of UDP traffic to port 2557 (from 25322), the port is reportedly used for nicetec-mgmt, does anyone know what this is?
3
votes
3answers
617 views

How do I find out what all this traffic is?

I have seen a consistent spike in traffic over my network since Monday morning and I don't know where it's coming from! I don't have netflow routers (like I would like), I have IPCop firewalls. ...
5
votes
5answers
11k views

How to capture Wireshark packets when using a switched network in Windows

I’ve been asked by our SIP trunk provider to run a Wireshark trace on the network when we receive calls. The issue I’m having is that if I run Wireshark from a laptop plugged into the main switch I ...
6
votes
1answer
2k views

tcpdump filter for tcp zero window messages

Is there a pcap filter for TCPDump that will allow be to filter zero window messages? I know how to filter these in a wireshark display filter (tcp.analysis.zero_window) but the amount of data I ...
2
votes
5answers
6k views

How can I use Wireshark to analyze slow Active Directory logins?

This page seems to imply that Wireshark can only begin capturing after boot, but it looks like someone else has run into this problem before and didn't get anywhere. It doesn't necessarily have to ...
1
vote
1answer
2k views

Error while decrypting https traffic in Wireshark

I configured Jetty with a self-generated private key and cert after a long struggle. Now, I'm having trouble decrypting the HTTPS traffic from the Jetty server that I captured for inspection. The ...