Wireshark is a open source Network Protocol Analyzer under GNU License.

learn more… | top users | synonyms

4
votes
1answer
555 views

how to view hostnames in traffic entering my webserver (Apache)?

Is there any way I can view the hostnames used by incoming traffic that is accepted by my apache webserver? For example, say the webserver is set up to process incoming traffic for an IP address, ...
1
vote
1answer
345 views

PCAP to Syslog utility

I am looking for a tool which sniff all the traffic on an interface and produce a syslog like Cisco log in real time. Example : Feb 16 10:19:05 tcp S.S.S.S(6083) -> D.D.D.D(80), 1 packet Feb 16 ...
1
vote
2answers
1k views

Can't decrypt imaps traffic in Wireshark

I have currently problems to decrypt IMAPS Traffic in Wireshark. I set up the SSL Key with the correct IP Address, Port 993 and Protocol imap. The Key is the correct one. That is what I see in the ...
2
votes
2answers
2k views

Is there some capture filter (or alternatives) that is especially useful for wireless capture?

I'm capturing wireless traffic in monitor mode with WireShark. I want to capture traffic only for a certain BSS. While wlan.bssid == xx:xx:xx:xx:xx:xx works well as a display filter, I don't want my ...
1
vote
0answers
118 views

Why adding capture filters breaks the traffic dump in wireshark / windump?

I have a strange issue while trying to capture RTP (UDP) traffic. I have a phone using IP 192.168.9.4 and a Windows 2003 PC connected to the same switch (actually to the monitor port of the switch - ...
2
votes
1answer
144 views

CouchDB plugin for Wireshark?

I am trying to understand CouchDB network traffic with Wireshark and find it very difficult. A simple transaction with plain-text content seems to result in many lines in Wireshark, most of them ...
2
votes
1answer
1k views

Debugging slow SMB packets from a specific desktop client

I'm having some serious problems locating a slowdown, and I hope you could assist me with this. We have an office network with ~50 clients and a main file server running Windows Server 2008 R2 ...
1
vote
0answers
288 views

Wireshark like app for embeded Windows CE

Greetings Im looking for a standalone wireshark like app that I can run on a embedded Windows CE device in order to debug some network issues. Is anyone aware of such a thing. I know version 5 has ...
3
votes
1answer
3k views

Wireshark - Filter for Inbound HTTP Requests on Port 80 Only

We are integrating with an outside company in which we have had to make certain IP and port restrictions. First, I am novice at network administration, so If I butcher anything, please forgive me. ...
0
votes
1answer
293 views

What is Reverse Gossip Transfer Protocol?

Playing with wireshark, I see a bunch of packets that say something like rgtp > https [ACK] Seq=???? Ack=?????? Win=????? Len=0 What is a Reverse Gossip Ttransfer Protocol? What is it used for, ...
0
votes
2answers
380 views

Needs help to understand the wireshark results of a data transferring

In my LAN, I have a router that runs a Samba server and my PC connects to the router. I wiresharked during uploading a file from my PC to the samba server. Below is a shortcut of the wireshark ...
3
votes
5answers
8k views

Wireshark filter to only capture Incoming Packets?

I am trying to setup a Filter (so my log files aren't massive) that will capture only incoming traffic. I have looked on http://wiki.wireshark.org/CaptureFilters but so far have been unable to find a ...
1
vote
1answer
2k views

Configuring Wireshark for Rolling Captures during DDoS Attack

We have been getting hit with DDoS Attacks on various machines for months. The datacenter either null routes or sets up an ACL for us. However, it just came to my attention there's a tool floating ...
0
votes
1answer
215 views

Communication problems on secondary interface tap0

I am using UDP over ipv6 as communication stack. I have network client running on secondary virtual interface tap0. It generates messages for server which is supposed to run on the same interface but ...
1
vote
1answer
451 views

Catalyst 3560G SPAN session not mirroring IGMP packets

I am developing a device which acts as a multicast host, and want to observe it as it responds to IGMP Queries. My Catalyst 3560G is set up as follows (full config below): Port 0/1 is a TFTP server ...
1
vote
7answers
5k views

Firewall blocks traffic - how to find out what ports / ip addresses are used by software?

Well I get a "host was not accessible" error when trying to use a software. I don't know which port they use nor which address they are trying to reach. Is there a more or less easy way to figure that ...
1
vote
3answers
20k views

Troubleshoot large number of TCP retransmits / dup ack / segment lost

I have a problem with RDC slowing to a crawl or disconnecting entirely. Client is XP SP3 w/ RDC 6, server is Win 2k8 R2. Both have been scanned thoroughly and found to be virus free. I downloaded ...
0
votes
1answer
100 views

What does the C3 portion of 0xC308(BE) mean in an ICMP identifier?

I am using Wireshark to analyze traffic. I know that the 8 refers to the echo (ping) type. I have been unsuccesful with finding information regarding the C3 byte. Identifier (BE): 49928 (0xc308)
2
votes
3answers
542 views

Cannot connect to SQL Server and Wireshark don't listen anything

I'm trying to connect to a SQL Server from outside the LAN, so I opened port 1433 (default SQL Server port) in the firewall. On the server side I'm listening with Wireshark and I can listen ping ...
0
votes
1answer
1k views

ICMP Data Field Modified - What does it Mean?

Normal ICMP Data fields are composed of a pretty standard 32 byte string of alphabet characters. abcdefghijklmnopqrstuvwabcdefghi I have captured a series of ICMP echo requests using WireShark with ...
-1
votes
1answer
182 views

Measuring delays between various components on a localhost

I need to profile a web application from a system performance standpoint and find out for typical user actions (accessing the home page, logging in...) where the delay comes from. The website uses the ...
0
votes
1answer
431 views

Tcp retransmission tcp session reconstruction

Im trying to write a program that reconstructs tcp sessions. I have a pcap file which have packets. The problem is i dont know which packets i should use to construct sessions when there is a ...
1
vote
1answer
8k views

Why can't I start the WinPCap npf service when I'm the administrator?

I recently installed Wireshark on a Win 7 host, but now it won't let me start the NPF service. I get: C:\Windows\system32>net start npf System error 5 has occurred. Access is denied. That's ...
0
votes
1answer
294 views

Using tshark to generate traffic logs every X seconds

I'm trying to use tshark to maintain a running history of all the packets that are going through an interface, for say 30 seconds. I want it to be human readable. This is a linux machine, and without ...
1
vote
2answers
64 views

How can I filter packets from a port monitor?

I have some data going from Point A to Point B. I have a SPAN monitor set up to a monitoring device C. To recreate some real world scenarios, I want to filter out all traffic which is a certain type ...
0
votes
2answers
766 views

How to use tshark to do this task

I don't have any base knowledge about tshark, and it is hard to find any tutorial to help me with this. So now I have a pcap file which consists a lot of network flows; a time range; an ip addr; a ...
0
votes
2answers
187 views

SYN packets sent from one server but never arrives at destination

I am troubleshooting network problems for a client, remotely. The problem they have is that they get "connection timed out" occasionally between a web server and and a back-end search server. They can ...
12
votes
3answers
12k views

Stopping the WinPcap Packet capture service

I just installed WireShark, which also installed WinPcap. During the installation it said "do you want xxx to start automatically", which I answered yes. Now I would like to stop the service when I ...
4
votes
2answers
9k views

How to debug “HTTP request sent, awaiting response”?

I have a Linux server on an ADSL connection, and I just noticed that sometimes I get Connecting to example.com|xxx.xxx.xxx.122|:80... connected. HTTP request sent, awaiting response... when I use ...
1
vote
1answer
452 views

How can I display-filter the correspondant response to a specific display-filtered request in wireshark?

I am just tracing a very sporadic error in responses to HTTP requests to a specific resource on an embedded device's webserver. So my plan is to run a test over night (or even weekend), capture the ...
2
votes
2answers
2k views

IP Conflicts from mikrotik router for multiple ip addresses (that it isnt assigned)

I have a point to point wireless connection using two mikrotiks. When I plug the mikrotik into a switch with just my laptop I get an IP address conflict on my machine no matter what IP I am assigned. ...
22
votes
2answers
41k views

How to make wireshark filter POST-requests only?

How to make wireshark filter POST-requests only?
0
votes
1answer
303 views

Strange UDP/TFTP Problem

My TFTP client only seems to be getting responses from the TFTP server to its RRQ (download requests) if I watch the traffic in wireshark. If I shut down wireshark (running on the TFTP server), the ...
3
votes
2answers
5k views

How can I monitor HTTPS traffic with Wireshark? [duplicate]

Possible Duplicate: How can I filter https when monitoring traffic with Wireshark? I want to verify that the analytics package I've added to my iOS app is attempting to talk to the ...
5
votes
4answers
4k views

Capturing multicast data with Wireshark with IGMP Snooping Enabled at the switch

I am trying to capture multicast traffic via Wireshark (actually TShark), however the switch has IGMP snooping enabled and will only send Multicast traffic on the ports that have an active IGMP ...
0
votes
1answer
465 views

In WireShark, what exactly is X-FCCKV2?

When I filtered HTTP traffic in Wireshark I bumped into a X-FCCKV2 HTTP header in the collected info under the Hypertext Transfer Protocol. I've researched it on Google but found nothing. What does ...
2
votes
1answer
1k views

Wireshark Display Filtered for Unreplied ICMP Echo Packets

Is there a wireshark display filter that will find ICMP echo requests that didn't have a reply?
4
votes
2answers
9k views

Best way to analyze pcap files from Wireshark?

I've got 50-100MB pcap files captured from Wireshark and need to analyze where most of the traffic is going to/coming from. What's the best way of doing this? Ideally I'd like to end up with an ...
0
votes
2answers
1k views

Capturing local traffic on Windows Server 2008 R2

I've got three different applications running on the same Windows Server 2008 R2 machine that communicate with eachother over TCP/IP. All three applications use the actual IP address of the server (vs ...
3
votes
1answer
3k views

WireShark - Capturing Packets on Multiple IP Address (FIlter)

I'm looking for the syntax to do a capture filter on WireShark, by capturing the traffic on several (specific) IP addresses. I understand how to capture a range, and an individual IP address. However, ...
2
votes
4answers
501 views

How can i measure the load of a WAN Connection with Wireshark?

I have a 100 Mbit WAN connection and want to check the load on it for a week. So I put a hub (10/100Mbit) behind the WAN connection and connected a laptop with wireshark on it. Here is now my ...
1
vote
1answer
4k views

Capture HTTP GET requests

In the Wireshark wiki is an example for filtering HTTP GET requests: Capture HTTP GET requests. This looks for the bytes 'G', 'E', 'T', and ' ' (hex values 47, 45, 54, and 20) just after the TCP ...
4
votes
1answer
622 views

SSL Packet inspection on Linux

I'm trying to build a web client for an HTTPS website. I think I've done everything right, yet obviously I get a different result in the browser than with my crawler. As far as I understand, there is ...
15
votes
4answers
76k views

What causes duplicate ACK records?

We're reviewing Wireshark captures from a few client machines that are showing multiple duplicate ACK records which then triggers retransmit and out-of-sequence packets. These are shown in the ...
4
votes
3answers
533 views

determining what ports a program uses

I'm trying to use wireshark to determine what ports a certain program uses. The program connects to the server fine if we are on the same network, but I obviously need to forward the ports on the ...
15
votes
4answers
36k views

How can I filter https when monitoring traffic with Wireshark?

I want to observe the HTTPs protocol. How can I use a Wireshark filter to do that?
4
votes
2answers
2k views

Silently start Wireshark

I have a computer in our office that always gets infected by viruses. Because of this, I would like to use Wireshark (or at least something) to monitor internet traffic for a while on this machine. ...
0
votes
2answers
2k views

Problem with WireShark (MySQL sniffing)

How can I snif MySQL data using WireShark? Also I used «mysqlsniffer» and have no results. There are no any packets from MySQL. I've filtered by «MySQL.isPresent» in WireShark but nothing happened. ...
0
votes
2answers
2k views

Getting wireshark to see network (uplink) traffic?

I have wireshark on a win 7 toshiba laptop plugged in to a hp procurve switch. I set the port the laptop is plugged in to as a 'monitor' port, monitoring all the other ports. I have 1 other computer ...
2
votes
2answers
2k views

wireshark not seeing all packets on WiFi

I'm using Wireshark on OSX, trying to sniff my home network over WiFi. While I can see packets that are sent to/from the host I'm sniffing on, I'm not seeing anything else that goes over the WiFi. ...