Questions tagged [wireshark]
Wireshark is an open source Network Protocol Analyzer under GNU License.
511
questions
8
votes
3
answers
93k
views
Excessive 'TCP Dup ACK' & 'TCP Fast Retransmission' causing issues on network. What's causing this?
I'm getting excessive TCP Dup ACK and TCP Fast Retransmission on our network when I transfer files over the MetroEthernet link. The two sites are connected by one sonicwall router, so the sites are ...
0
votes
1
answer
649
views
tshark duration of a conversation for a ip address
i can retrieve the follow info from a .pcap :
================================================================================
IPv4 Conversations
Filter:ip.addr==1xx.1xx.0.1xx
...
0
votes
1
answer
1k
views
Wireshark - Difference between fixed parameters and tagged parameters
I'm new to Wireshark. I'd like to know what are fixed and tagged parameters and the difference between them. Web search didn't help. Kindly explain it to me in simple terms.
1
vote
2
answers
7k
views
trace ftp file data in wireshark
I am trying to analyze ftp traffic in Wireshark. I can see commands like Request: List, PORT.
But after FTP
Response 150: Opening data channel for directory list.
what I see immediately is
...
2
votes
3
answers
15k
views
Can Wireshark capture an entire Ethernet frame including preamble, CRC and Interframe spacing?
I am examining an Ethernet frame in Wireshark. According to the "Ethernet frame" Wikipedia article and accompanying diagrams, "A frame starts with a 7-octet preamble and 1-octet start frame delimiter (...
0
votes
1
answer
2k
views
Incoming Outgoing Packets Wireshark
Is there a way to have a column or a filter that marks each packet as incoming (download) or outgoing (upload) in Wireshark?
I guess this should be relative to the selected capture interface device.
1
vote
2
answers
4k
views
Source and Destination Packets on Wireshark Relative or Absolute?
New in Packet Analysis.
Sniffing on the Ethernet device of my computer.
Does the Source and Destination columns on Wireshark tell the source and destination from where the packet was originated and ...
4
votes
2
answers
5k
views
How to parse OpenFlow packets using tcpdump capture file programmatically
I am working with OpenFlow packets and am analyzing the network via tcpdump.
Currently, I use the WireShark GUI to parse the generated capture file and it does serve my need.
However, I was ...
7
votes
1
answer
45k
views
tcpdump capturing tcp resets by host
I am trying to figure out where my tcp resets on my webserver happen. I have the following capture:
tcpdump -fnni bond0:-nnvvS -w dump.pcap 'tcp[tcpflags] & (tcp-rst) !=0'
When I look at the ...
9
votes
1
answer
42k
views
Why does WireShark think this frame is a TCP segment of a reassembled PDU
Please find a small pcap file here illustrating my problem.
I have a three-way TCP handshake, followed by two FIX logons. (FIX is a protocol used in trading.) The first FIX logon (frame 4) is ...
2
votes
3
answers
3k
views
While analyzing a network interface using WireShark, which device's timestamp is recorded?
OK, this may seem trivial but due to the nature of testing required for my application, I need to get precise timestamps.
I am using WireShark to analyze packets.
Suppose I have a network with 2 ...
11
votes
3
answers
50k
views
Wireshark running on a server seeing lots of `ARP who has` with different tells
We're seeing some suspicious network activity, and when I was trying to see if it was one particular server of ours I ran a Wireshark trace. I noted a lot of ARP packets asking who has x.x.x.x, but ...
0
votes
1
answer
3k
views
Why am I seeing so many MAPI "Unknown?!" request/response in a packet capture?
We are experiencing user reported slowness with our Exchange 2007 server. We thought it was associated with a new application that we're testing. (This application uses MAPI to look at all of the ...
1
vote
0
answers
166
views
UDP sends 6 additional packets in Wireshark
I am sending UDP packets using ttcp to another machine which is connected via a Cisco router. However, when I analyze the packets sent in Wireshark, there is a UDP packet sent before the payload ...
0
votes
2
answers
11k
views
Alternatives to wireshark? [closed]
What would be a good option to troubleshoot an interaction of browser with a server besides wireshark?
I mean being able to see what the browser sends and receives.
Is firebug a good alternative or is ...
0
votes
1
answer
78
views
Is there an app that can provide details about wifi access point config?
I'm wondering if there is an easier way to determine of the following parameters of a wifi network. For users who already have say a laptop connected to a wifi network.
Does wifi network support PS-...
1
vote
2
answers
6k
views
Wireshark does not capture HTTP on 8080
I am running Wireshark on my linux machine and i have simple python web server running on localhost:8080
I am capturing only local port 8080. When i open browser on localhost:8080 wireshark captures ...
0
votes
1
answer
847
views
syn flood attack -- packet hits on shared ip
How can I dump the TCP packets to get a better idea to know which website is being attacked?
Here is what I have in my logs:
May 4 23:10:26 host kernel: [2130002.635000] Firewall: *SYNFLOOD ...
2
votes
6
answers
2k
views
Wireshark Capture Between Two Routers
How would one go about capturing OSPF traffic in Wireshark between two routers?
I'm looking to do something like this:
[RTR A] - - - [LAPTOP] - - - [RTR B]
0
votes
0
answers
3k
views
NetGroup Packet Filter Driver isn't installed with WinPcap on Windows Server 2008 R2 64bit
I'm running Windows Server 2008 R2, 64 bit on a Virtual Server. There I want to install Wireshark to capture some of my network traffic for debugging purpose.
During installation of Wireshark and ...
1
vote
2
answers
4k
views
TCPDump and IPTables DROP by string
by using tcpdump -nlASX -s 0 -vvv port 80 I get something like:
14:58:55.121160 IP (tos 0x0, ttl 64, id 49764, offset 0, flags [DF], proto TCP (6), length 1480)
206.72.206.58.http > 2.187.196....
3
votes
1
answer
16k
views
tcpdump not picking up traffic redirected by iptables
The following iptables rule is used to redirect all internet traffic coming in from eth1 to port 3000 at localhost (interface lo with ip 127.0.0.1):
iptables -t nat -A PREROUTING -i eth1 -p tcp --...
-1
votes
1
answer
79
views
IP testing tool similar to wireshark website [closed]
I am looking to implement a tool similar to the one linked below on my personal server/website what are the steps I would need to get started?
http://www.wireshark.org/tools/v46status.html
I ...
2
votes
2
answers
519
views
Is TCP RWIN set by application or OS?
I have a situation where an application is listening on a TCP port and every once in a while, as seen in tcp dumps, gets its Receiving Window (RWIN) set to zero. When this happens, its Recv-Q stops ...
-2
votes
2
answers
13k
views
Using tcpdump to find strings [closed]
I need to block certain TCP packets by trying to find a string match in and on them. Is there a way to do that with TCPDump? Or do I need wireshare install on my linux server?
One I have the string ...
-1
votes
1
answer
211
views
Continuous conversion to text file using Wireshark [closed]
What is the procedure to convert captured files to text files on a continuous basis ? Export in Wireshark is a manual technique, any way to automate the process ?
-1
votes
1
answer
629
views
Wireshark not displaying GET or POST data [closed]
I'm a student and I'm taking my first networking class. I'm working on an assignment designed to get me used to using Wireshark and understanding packet transfers. Part of the assignment is to collect ...
1
vote
1
answer
307
views
centos6 - wireshark
1) Is there any easy way to install wireshark-1.8.3 on centos 6 ?
I try the wget utility and i get the dependency on gtk..which inturn has dependency on glib, atk , pango and cairo..
2) Looks like ...
3
votes
1
answer
963
views
How to use a switch as a network tap?
I would like to tcpdump all traffic that my router does when it makes a firmware update.
So I have taken a HP ProCurve 1800-8G switch and mirrored port 7 to port 8.
I have connected:
Internet ...
3
votes
3
answers
897
views
What are cables/boxes called for listening in on a RJ45 cable?
I would like to capture the traffic from a router, so I assume there must exist a cable or hardware box with 3 RJ45 socks, where two of them are IN and OUT, and the third is for capturing device (a ...
4
votes
2
answers
10k
views
How to use Linux to capture packets on eth0 and send everything to eth1?
Today I got an enterprise Internet connection together with a Sagemcom router. The first time it is connected to the Internet, it will spend 20 minutes upgrading the firmware.
I would really like to ...
0
votes
1
answer
1k
views
No response from IIS
My problem is that the Default Web Site can be opened from the server machine (localhost), but cannot be opened from a test machine (which is in the same LAN). Netstat says that IIS 7.5 is listening ...
0
votes
2
answers
349
views
How to measure Wireshark parsing time of PCAP file?
I need to find out how to measure the parsing time of a PCAP file when using Wireshark.
Does anyone know how to do this?
0
votes
3
answers
2k
views
Which bit represents which TCP flag?
For instance, a WireShark capture filter example I found - tcp[13] & 8 == 8 represents packets with PSH flags.
How do I count the 8 ?
Based on the wikipedia image,
PSH is in the middle of ...
0
votes
2
answers
1k
views
Caculating packet offset
In Wireshark, if I want to write a filter which accepts only ICMP destination unreachable ( type 3 ) messages, the filter is icmp[0] == 3 .
How do I count the packet offset of 0 in this instance ?
...
0
votes
3
answers
4k
views
Wireshark Promiscuous Mode and multiple Subnets
Is it possible to Sniff traffic with Wireshark where the source IP and Destination IP are on different subnets (of the same network) and neither of them are your IP? NIC is Intel 82579LM.
-1
votes
1
answer
175
views
DHCP messages in LAN [closed]
I run a Mac and release/renew my IP with:
sudo ipconfig set en0 DHCP
In wireshark I get the following with udp.port==67 as filter:
Why are the messages sent from my computer broadcasted, but the ...
1
vote
1
answer
4k
views
FTP Error 500 Illegal Port Command - PORT command sending different IP than source of request
The problem I'm experiencing is that I'm getting a "500 Illegal PORT command" Response from an FTP server when attempting to upload a file programmatically.
This program is a small c# application ...
0
votes
2
answers
396
views
Multiple ICMP destination unreachable messages
I'm load testing some web services hosted on IIS7. The web services make network calls to underlying services in response to client requests. The client requests are simple HTTP requests but the ...
1
vote
1
answer
2k
views
mysql logging activity from specific user or ip
I have mysql server.
The server is accessed by my application, and by external auditor (person using mysql workbench).
The auditor has specific user and password and dedicated IP and it is granted ...
0
votes
1
answer
431
views
Application traffic classification with tcpdump
I have a trace file from my network. I would like to identify the top 10 applications used by us . Does tcpdump provide any application based filtering options ? Any details regarding this would be ...
5
votes
2
answers
2k
views
Is it possible for Wireshark to drop packets purposely?
I would like to test something like VoIP. I would like to test with some "artificial packet loss". Is Wireshark able to do this? Or is there any good solutions?
0
votes
1
answer
595
views
Filtering inbound traffic without knowing the destination subnet
I have a linux machine configured as a router with two interfaces facing LAN A and LAN B. I want to filter traffic passing from LAN A to LAN B (inbound traffic) using tcpdump, but I don't have the ...
0
votes
1
answer
1k
views
tshark conversation statistic not resolving hostnames
Executing the -z conv,ip command does not display the hostnames (like in wireshark).
I execute the command, and after a bit of traffic was monitored, I stop tshark with Ctrl-C and then the ...
12
votes
2
answers
14k
views
Filter tcpdump file AFTER capturing
I captured a really big tcpdump file which now always crashes my wireshark. It was captured with no filters and I need to apply some afterwards to make the file smaller.
Is this somehow possible?
5
votes
2
answers
18k
views
using wireshark/tshark in command line to ignore ssh connections
I'm trying to debug some by looking at the packets and I would like to avoid getting all the SSH traffic to the server. Is there a way to ignore?
I tried to do something like tshark -f "port !22" but ...
5
votes
2
answers
17k
views
Correct way to show only TCP packets in wireshark
I needed to write a filter that correctly outputs only TCP packets, the obvious way, and the way written in wireshark is just tcp but when I tried it, it showed me also http, tls (as far as I ...
2
votes
0
answers
3k
views
Issue with Netgear GS108T Managed Switch and Jumbo Frames
I recently purchased a Netgear GS108T managed switch and I am trying to configure jumbo packets between my NAS (Thecus N4100Pro), PC and managed switch. I should mention the fact that I was able to ...
-1
votes
1
answer
4k
views
does ping command to a dns name uses DNS PTR type messages?
Okay I cant understand this, when I try to ping to a machine on my network using the name associated I get a response from that machine, thats normal..
But there are messages that the sender sends to ...
2
votes
2
answers
4k
views
Can you run a packet capture (wireshark) while rdped to a server?
I want to run a packet capture while rdped into a box. I'm pretty sure it won't drop the connection to the server (a server with one nic). I tested on VMs and it seems fine. Am I missing something?