Questions tagged [wireshark]

Wireshark is an open source Network Protocol Analyzer under GNU License.

Filter by
Sorted by
Tagged with
8 votes
3 answers
93k views

Excessive 'TCP Dup ACK' & 'TCP Fast Retransmission' causing issues on network. What's causing this?

I'm getting excessive TCP Dup ACK and TCP Fast Retransmission on our network when I transfer files over the MetroEthernet link. The two sites are connected by one sonicwall router, so the sites are ...
Ingram's user avatar
  • 153
0 votes
1 answer
649 views

tshark duration of a conversation for a ip address

i can retrieve the follow info from a .pcap : ================================================================================ IPv4 Conversations Filter:ip.addr==1xx.1xx.0.1xx ...
drd0sp.pt's user avatar
0 votes
1 answer
1k views

Wireshark - Difference between fixed parameters and tagged parameters

I'm new to Wireshark. I'd like to know what are fixed and tagged parameters and the difference between them. Web search didn't help. Kindly explain it to me in simple terms.
Gomu's user avatar
  • 113
1 vote
2 answers
7k views

trace ftp file data in wireshark

I am trying to analyze ftp traffic in Wireshark. I can see commands like Request: List, PORT. But after FTP Response 150: Opening data channel for directory list. what I see immediately is ...
user avatar
2 votes
3 answers
15k views

Can Wireshark capture an entire Ethernet frame including preamble, CRC and Interframe spacing?

I am examining an Ethernet frame in Wireshark. According to the "Ethernet frame" Wikipedia article and accompanying diagrams, "A frame starts with a 7-octet preamble and 1-octet start frame delimiter (...
synack's user avatar
  • 23
0 votes
1 answer
2k views

Incoming Outgoing Packets Wireshark

Is there a way to have a column or a filter that marks each packet as incoming (download) or outgoing (upload) in Wireshark? I guess this should be relative to the selected capture interface device.
Ventolinmono's user avatar
1 vote
2 answers
4k views

Source and Destination Packets on Wireshark Relative or Absolute?

New in Packet Analysis. Sniffing on the Ethernet device of my computer. Does the Source and Destination columns on Wireshark tell the source and destination from where the packet was originated and ...
Ventolinmono's user avatar
4 votes
2 answers
5k views

How to parse OpenFlow packets using tcpdump capture file programmatically

I am working with OpenFlow packets and am analyzing the network via tcpdump. Currently, I use the WireShark GUI to parse the generated capture file and it does serve my need. However, I was ...
spiritusozeans's user avatar
7 votes
1 answer
45k views

tcpdump capturing tcp resets by host

I am trying to figure out where my tcp resets on my webserver happen. I have the following capture: tcpdump -fnni bond0:-nnvvS -w dump.pcap 'tcp[tcpflags] & (tcp-rst) !=0' When I look at the ...
rahrahruby's user avatar
9 votes
1 answer
42k views

Why does WireShark think this frame is a TCP segment of a reassembled PDU

Please find a small pcap file here illustrating my problem. I have a three-way TCP handshake, followed by two FIX logons. (FIX is a protocol used in trading.) The first FIX logon (frame 4) is ...
Randomblue's user avatar
  • 1,175
2 votes
3 answers
3k views

While analyzing a network interface using WireShark, which device's timestamp is recorded?

OK, this may seem trivial but due to the nature of testing required for my application, I need to get precise timestamps. I am using WireShark to analyze packets. Suppose I have a network with 2 ...
spiritusozeans's user avatar
11 votes
3 answers
50k views

Wireshark running on a server seeing lots of `ARP who has` with different tells

We're seeing some suspicious network activity, and when I was trying to see if it was one particular server of ours I ran a Wireshark trace. I noted a lot of ARP packets asking who has x.x.x.x, but ...
Cylindric's user avatar
  • 1,127
0 votes
1 answer
3k views

Why am I seeing so many MAPI "Unknown?!" request/response in a packet capture?

We are experiencing user reported slowness with our Exchange 2007 server. We thought it was associated with a new application that we're testing. (This application uses MAPI to look at all of the ...
Kevin Buchan's user avatar
1 vote
0 answers
166 views

UDP sends 6 additional packets in Wireshark

I am sending UDP packets using ttcp to another machine which is connected via a Cisco router. However, when I analyze the packets sent in Wireshark, there is a UDP packet sent before the payload ...
Parzifal's user avatar
  • 175
0 votes
2 answers
11k views

Alternatives to wireshark? [closed]

What would be a good option to troubleshoot an interaction of browser with a server besides wireshark? I mean being able to see what the browser sends and receives. Is firebug a good alternative or is ...
user76678's user avatar
  • 349
0 votes
1 answer
78 views

Is there an app that can provide details about wifi access point config?

I'm wondering if there is an easier way to determine of the following parameters of a wifi network. For users who already have say a laptop connected to a wifi network. Does wifi network support PS-...
blak3r's user avatar
  • 731
1 vote
2 answers
6k views

Wireshark does not capture HTTP on 8080

I am running Wireshark on my linux machine and i have simple python web server running on localhost:8080 I am capturing only local port 8080. When i open browser on localhost:8080 wireshark captures ...
martin85's user avatar
  • 115
0 votes
1 answer
847 views

syn flood attack -- packet hits on shared ip

How can I dump the TCP packets to get a better idea to know which website is being attacked? Here is what I have in my logs: May 4 23:10:26 host kernel: [2130002.635000] Firewall: *SYNFLOOD ...
John Miachels's user avatar
2 votes
6 answers
2k views

Wireshark Capture Between Two Routers

How would one go about capturing OSPF traffic in Wireshark between two routers? I'm looking to do something like this: [RTR A] - - - [LAPTOP] - - - [RTR B]
THE DOCTOR's user avatar
0 votes
0 answers
3k views

NetGroup Packet Filter Driver isn't installed with WinPcap on Windows Server 2008 R2 64bit

I'm running Windows Server 2008 R2, 64 bit on a Virtual Server. There I want to install Wireshark to capture some of my network traffic for debugging purpose. During installation of Wireshark and ...
oktopus's user avatar
  • 51
1 vote
2 answers
4k views

TCPDump and IPTables DROP by string

by using tcpdump -nlASX -s 0 -vvv port 80 I get something like: 14:58:55.121160 IP (tos 0x0, ttl 64, id 49764, offset 0, flags [DF], proto TCP (6), length 1480) 206.72.206.58.http > 2.187.196....
Tiffany Walker's user avatar
3 votes
1 answer
16k views

tcpdump not picking up traffic redirected by iptables

The following iptables rule is used to redirect all internet traffic coming in from eth1 to port 3000 at localhost (interface lo with ip 127.0.0.1): iptables -t nat -A PREROUTING -i eth1 -p tcp --...
tonytz's user avatar
  • 153
-1 votes
1 answer
79 views

IP testing tool similar to wireshark website [closed]

I am looking to implement a tool similar to the one linked below on my personal server/website what are the steps I would need to get started? http://www.wireshark.org/tools/v46status.html I ...
hinekyle's user avatar
  • 103
2 votes
2 answers
519 views

Is TCP RWIN set by application or OS?

I have a situation where an application is listening on a TCP port and every once in a while, as seen in tcp dumps, gets its Receiving Window (RWIN) set to zero. When this happens, its Recv-Q stops ...
Mara's user avatar
  • 139
-2 votes
2 answers
13k views

Using tcpdump to find strings [closed]

I need to block certain TCP packets by trying to find a string match in and on them. Is there a way to do that with TCPDump? Or do I need wireshare install on my linux server? One I have the string ...
Jake Thomas's user avatar
-1 votes
1 answer
211 views

Continuous conversion to text file using Wireshark [closed]

What is the procedure to convert captured files to text files on a continuous basis ? Export in Wireshark is a manual technique, any way to automate the process ?
user170085's user avatar
-1 votes
1 answer
629 views

Wireshark not displaying GET or POST data [closed]

I'm a student and I'm taking my first networking class. I'm working on an assignment designed to get me used to using Wireshark and understanding packet transfers. Part of the assignment is to collect ...
user82130's user avatar
  • 103
1 vote
1 answer
307 views

centos6 - wireshark

1) Is there any easy way to install wireshark-1.8.3 on centos 6 ? I try the wget utility and i get the dependency on gtk..which inturn has dependency on glib, atk , pango and cairo.. 2) Looks like ...
pdk's user avatar
  • 11
3 votes
1 answer
963 views

How to use a switch as a network tap?

I would like to tcpdump all traffic that my router does when it makes a firmware update. So I have taken a HP ProCurve 1800-8G switch and mirrored port 7 to port 8. I have connected: Internet ...
Sandra's user avatar
  • 10.5k
3 votes
3 answers
897 views

What are cables/boxes called for listening in on a RJ45 cable?

I would like to capture the traffic from a router, so I assume there must exist a cable or hardware box with 3 RJ45 socks, where two of them are IN and OUT, and the third is for capturing device (a ...
Sandra's user avatar
  • 10.5k
4 votes
2 answers
10k views

How to use Linux to capture packets on eth0 and send everything to eth1?

Today I got an enterprise Internet connection together with a Sagemcom router. The first time it is connected to the Internet, it will spend 20 minutes upgrading the firmware. I would really like to ...
Sandra's user avatar
  • 10.5k
0 votes
1 answer
1k views

No response from IIS

My problem is that the Default Web Site can be opened from the server machine (localhost), but cannot be opened from a test machine (which is in the same LAN). Netstat says that IIS 7.5 is listening ...
kol's user avatar
  • 211
0 votes
2 answers
349 views

How to measure Wireshark parsing time of PCAP file?

I need to find out how to measure the parsing time of a PCAP file when using Wireshark. Does anyone know how to do this?
Okrx's user avatar
  • 73
0 votes
3 answers
2k views

Which bit represents which TCP flag?

For instance, a WireShark capture filter example I found - tcp[13] & 8 == 8 represents packets with PSH flags. How do I count the 8 ? Based on the wikipedia image, PSH is in the middle of ...
iridescent's user avatar
0 votes
2 answers
1k views

Caculating packet offset

In Wireshark, if I want to write a filter which accepts only ICMP destination unreachable ( type 3 ) messages, the filter is icmp[0] == 3 . How do I count the packet offset of 0 in this instance ? ...
iridescent's user avatar
0 votes
3 answers
4k views

Wireshark Promiscuous Mode and multiple Subnets

Is it possible to Sniff traffic with Wireshark where the source IP and Destination IP are on different subnets (of the same network) and neither of them are your IP? NIC is Intel 82579LM.
user avatar
-1 votes
1 answer
175 views

DHCP messages in LAN [closed]

I run a Mac and release/renew my IP with: sudo ipconfig set en0 DHCP In wireshark I get the following with udp.port==67 as filter: Why are the messages sent from my computer broadcasted, but the ...
Francis9910's user avatar
1 vote
1 answer
4k views

FTP Error 500 Illegal Port Command - PORT command sending different IP than source of request

The problem I'm experiencing is that I'm getting a "500 Illegal PORT command" Response from an FTP server when attempting to upload a file programmatically. This program is a small c# application ...
Gage Trader's user avatar
0 votes
2 answers
396 views

Multiple ICMP destination unreachable messages

I'm load testing some web services hosted on IIS7. The web services make network calls to underlying services in response to client requests. The client requests are simple HTTP requests but the ...
Krishter's user avatar
  • 101
1 vote
1 answer
2k views

mysql logging activity from specific user or ip

I have mysql server. The server is accessed by my application, and by external auditor (person using mysql workbench). The auditor has specific user and password and dedicated IP and it is granted ...
darko petreski's user avatar
0 votes
1 answer
431 views

Application traffic classification with tcpdump

I have a trace file from my network. I would like to identify the top 10 applications used by us . Does tcpdump provide any application based filtering options ? Any details regarding this would be ...
DaTaBomB's user avatar
  • 133
5 votes
2 answers
2k views

Is it possible for Wireshark to drop packets purposely?

I would like to test something like VoIP. I would like to test with some "artificial packet loss". Is Wireshark able to do this? Or is there any good solutions?
Harold Chan's user avatar
0 votes
1 answer
595 views

Filtering inbound traffic without knowing the destination subnet

I have a linux machine configured as a router with two interfaces facing LAN A and LAN B. I want to filter traffic passing from LAN A to LAN B (inbound traffic) using tcpdump, but I don't have the ...
Yasser's user avatar
  • 101
0 votes
1 answer
1k views

tshark conversation statistic not resolving hostnames

Executing the -z conv,ip command does not display the hostnames (like in wireshark). I execute the command, and after a bit of traffic was monitored, I stop tshark with Ctrl-C and then the ...
Daniel's user avatar
  • 163
12 votes
2 answers
14k views

Filter tcpdump file AFTER capturing

I captured a really big tcpdump file which now always crashes my wireshark. It was captured with no filters and I need to apply some afterwards to make the file smaller. Is this somehow possible?
Zulakis's user avatar
  • 4,233
5 votes
2 answers
18k views

using wireshark/tshark in command line to ignore ssh connections

I'm trying to debug some by looking at the packets and I would like to avoid getting all the SSH traffic to the server. Is there a way to ignore? I tried to do something like tshark -f "port !22" but ...
Tiffany Walker's user avatar
5 votes
2 answers
17k views

Correct way to show only TCP packets in wireshark

I needed to write a filter that correctly outputs only TCP packets, the obvious way, and the way written in wireshark is just tcp but when I tried it, it showed me also http, tls (as far as I ...
Salvador Dali's user avatar
2 votes
0 answers
3k views

Issue with Netgear GS108T Managed Switch and Jumbo Frames

I recently purchased a Netgear GS108T managed switch and I am trying to configure jumbo packets between my NAS (Thecus N4100Pro), PC and managed switch. I should mention the fact that I was able to ...
Richie086's user avatar
  • 238
-1 votes
1 answer
4k views

does ping command to a dns name uses DNS PTR type messages?

Okay I cant understand this, when I try to ping to a machine on my network using the name associated I get a response from that machine, thats normal.. But there are messages that the sender sends to ...
TiagoM's user avatar
  • 1
2 votes
2 answers
4k views

Can you run a packet capture (wireshark) while rdped to a server?

I want to run a packet capture while rdped into a box. I'm pretty sure it won't drop the connection to the server (a server with one nic). I tested on VMs and it seems fine. Am I missing something?
gar09's user avatar
  • 23

1
5 6
7
8 9
11