Wireshark is a open source Network Protocol Analyzer under GNU License.

learn more… | top users | synonyms

1
vote
3answers
556 views

Dropped packets in Linux

I'am using a machine as a router, it works sort of fine, however if I do a ping -t whatever.server it will always cause a 3-4% package loss, no matter what server. Looking at ifconfig or netstat -i ...
3
votes
2answers
17k views

How to filter on a the contents of a packet in Wireshark?

I've got an application that is communicating with an Oracle database, it's logging is pretty crappy so the only way I can workout what SQL it is sending to our database is by packet sniffing for TNS....
1
vote
1answer
1k views

tshark (wireshark) to pinpoint connect reset / retransmitted issue

Windows server 2003. I have the latest WireShark installed on the server and need to capture packets on the server to pinpoint a randomly happened connection reset /retransmitted issue. When the ...
2
votes
3answers
6k views

Wireshark won't pick up packets sent from localhost to localhost via network [duplicate]

I'm running on Windows and trying to get Wireshark to pick up my network traffic. It picks up all outbound and inbound traffic fine, except for a client/server I'm running on my local system. As it is,...
1
vote
1answer
478 views

tshark (wireshark) filters: Where are they located?

While troubleshooting a MySQL issue, I came across this command at commandlinefu: tshark -i any -T fields -R mysql.query -e mysql.query I am trying to understand it before I actually use it. ...
-3
votes
1answer
2k views

Why can't I “decode” packets using Wireshark and some wireless network?

Re, I have no problem capturing packets on various wireless hotspots but there are a couple in my town that I just cannot understand why packets aren't being captured, other than those of my own. ...
2
votes
1answer
1k views

Extract files from traffic captured with WireShark

Is there a way to extract image, video files from WireShark capture files? Is there a tool to achieve this?
0
votes
1answer
418 views

Network Monitoring from one port on switch

Monitoring the all network traffic from one port on the switch and captured the all traffic by using wireshark. Here i found all packet captured in the summary result and it has dropped packet ...
0
votes
2answers
301 views

Cisco switch sending out excessive STP packets

I have a Catalyst 2900 that's sending out an STP packet about once ever 1-2 seconds. Is that excessive?
10
votes
2answers
15k views

How can I search the info column in WireShark?

WireShark | Windows I want to search a packet capture of SMTP traffic for specific addresses/messages. Normally, I just sort the info column and browse but it would be nice if I could just run a ...
0
votes
3answers
8k views

Debugging UPnP / DLNA via Wireshark

Is there any way to parse / interpret the XMLs sent as part of a DLNA / UPnP using Wireshark, or any other network sniffer? I can get the raw packets, but it would be nice to see them parsed, to make ...
0
votes
1answer
8k views

Convert .txt file to .cap to open it by Wireshark

I have packet in a text file how I can convert it to .cap file? I need to analyze this packet by Wireshark. Thanks
8
votes
4answers
16k views

Can Wireshark read data being sent to/from other computers?

Let's say WireShark is installed on computer A. And let's say I am looking at a Youtube video on the computer B. Can WireShark see what computer B is doing?
0
votes
1answer
519 views

wireshark extract w3c log file

Does anyone know how I would go about extracting urls in w3c extended log format from a wireshark pcap capture file?
0
votes
2answers
2k views

When analyzing packets with Wireshark, is there a way to know which program is sending which packet?

is there an easy way to know from where the packets come from? Which program? My pc which is on 192.168.0.100 is continuously sending packets (TCP and SMB) to an unknown host (192.168.1.99) and I can'...
4
votes
5answers
5k views

Parse HTTP requests through Wireshark?

Is there any way to parse HTTP request data in wireshark? For example, can I expose the request parameters upon an HTTP GET request (being sent by my machine), so that I don't need to read the (...
0
votes
1answer
1k views

RST ACK over SSL in FireFox POST request

The original question is here. In short, for few users several POST requests hangs and are aborted after couple of minutes, when working over SSL (http is OK). What I'm asking here is an explanation ...
0
votes
1answer
712 views

Is it possible to export Wireshark syslogs to another device?

My company is trying to export the live captured packet syslogs to a device within the network. We were just wondering if it is actually possible to do it with the Wireshark acting as a syslog relay ...
4
votes
4answers
13k views

How to use sniffer to troubleshoot SMTP traffic?

We're having an issue where we are no longer receiving external emails. (We have an Exchange mail system, with a Barracuda spam filter and Watchguard hardware firewall.) The problem is that mail ...
0
votes
1answer
195 views

Need help getting StateServer to work, trying to decipher WireShark to figure out why

I'm using WireShark to try to figure out why I can't get my ASP.NET application (which is deployed to IIS6) to use a remote ASP.NET StateServer. For the record, StateServer works if my application is ...
1
vote
1answer
338 views

NTP and phones (need a useful ntp test)

I have a sip phone which gets its time from either an ntp server or the asterisk server. however the packets never seem to get replied to I put wireshark in the way and looked at anything with ...
0
votes
2answers
271 views

Identifying VoIP Users

I'm looking for a way to identify as many consumer VoIP users on my ISP network as possible using packet analysis. My setup is like this: On my core switch, all traffic going in and out of gigabit1 ...
5
votes
6answers
5k views

Does Wireshark pose a threat when installed on a server in the DMZ?

If you install wireshark on a web server sitting in the DMZ, is there a hack that can be used to get backdoor entrace to that server even when RDP is disblaed? I'm trying to monitor the wire on the ...
9
votes
4answers
42k views

How do i convert wireshark capture files to text files?

How can I convert wirshark captures (.cap) files to text files or some format from which I can read the file and parse its contents ? Regards, Mithun
1
vote
1answer
1k views

TCP RST Reset Every 5 Minutes on Windows 2003 sp2

Recently I had a web developer come to me and ask why he was receiving connection errors in his app that was accessing a sql database. So, I went through my normal trouble shooting steps to isolate ...
1
vote
1answer
1k views

TCP Zero Window with no corresponding Window Update

I am trying to debug a network issue and am using Wireshark and tcpdump to grab packets from my server. I have one client application that is grabbing all my available connections and then holding ...
1
vote
3answers
5k views

debugging spiking netstat “failed connection attempts” with iptables

http://farm4.static.flickr.com/3305/4588110530_a60c934289_o.png This graph is munin collecting netstat -s output. I want to determine where the connections are coming from. There is nothing obvious ...
7
votes
1answer
10k views

How to filter for HTTP 500 responses and their requests in Wireshark?

How do I filter for HTTP 500 responses and their requests in Wireshark? I'm able to use http.response.code == 500 to find all the responses which got the return code 500 but I want to be able to see ...
0
votes
2answers
3k views

Track IP Messenger's chatting by wireshark

We have Linux server ( RHEL 5 ), and some client machines ( Windows XP ) in local area network. We using server as proxy server. I am using squid proxy. My windows machines using internet by proxy. ...
2
votes
1answer
1k views

WireShark - wireshark trace traffic from my local browser to a local .net application I have with a HttpListener? (e.g. local to local)

Can wireshark trace traffic from my local browser to a local .net application I have with a HttpListener? (e.g. local to local) I can't seem to detect this traffic at the moment with wireshark. Is ...
3
votes
3answers
10k views

wireshark http POST

I would like to have a http POST request method CAPTURE filter. I know it is easy to do it by display filter http.request.method==POST but I need tcpdump compatible. I wrote tcp dst port 80 and (tcp[...
4
votes
2answers
1k views

Saving Wireshark capture settings for future use

Is there any way to save Wireshark capture options? So it can be reuse after restart Wireshark. Also, if the saved file is in plain text, it's possible to use scripts generating bunch of capture ...
1
vote
1answer
2k views

Checking rtp stream audio quality

We are working in a test environment and need to monitor the audio quality of an rtp stream that is being captured using tshark. Right now we are able to capture the audio and access the file through ...
6
votes
2answers
8k views

No interface available for Wireshark running on Ubuntu with wireless connection

I'm completely new to wireshark. I have Ubuntu on a Dell with wireless connection. When I go to Wireshark Capture Option, I cannot select any interface since no interface is listed. What is the ...
3
votes
2answers
14k views

With wireshark how can I filter by packet size?

I can filter for packet lengths using a display filter containing data.len >= XXX, but I'd really like to use a capture filter for this for efficiency... is there a way to do it?
3
votes
1answer
2k views

Wireshark arp packets

In wireshark, after capturing some arp packets, what is the significance of all 1's in the destination field. of an Ethernet II frame?
4
votes
4answers
4k views

Wireshark and IPSec

I am trying to troubleshoot communication between two servers on a Windows network where IPSEC is encrypting everything. I installed wireshark on the source server and captured traffic at the point ...
2
votes
2answers
1k views

wireshark captures different on two computers from the same port

I Have a Windows XP Machine Running wireshark, connected to a Mirror port on a network. I'm capturing with no filtering, and it can only see half of some two way TCP conversations. I had thought it ...
34
votes
4answers
143k views

How to filter http traffic in Wireshark?

I suspect my server has a huge load of http requests from its clients. I want to measure the volume of http traffic. How can I do it with Wireshark? Or probably there is an alternative solution using ...
4
votes
3answers
10k views

Sniffing the Vmware vmnet1 network with Wireshark

I have a virtual machine deployed in vmware fusion which is communicating with the host over the interface vmnet1. Unfortunately, wireshark does not offer me to to listen on that interface. Is there ...
2
votes
2answers
527 views

Wireshark: What is wag-service?

I'm seeing alot of wag-service traffic in wireshark. What is it?
3
votes
5answers
4k views

Is it safe to run Wireshark on a production IIS7 server? Is there a good alternative?

We host a bunch of ASP.NET sites on an IIS7 server. Occasionally, we'd like to be able to log HTTP POST data to troubleshoot problems. IIS lets us log the query string, but not the POST data - at ...
3
votes
3answers
5k views

Determine What Process is Generating Network Traffic (Windows Server 2003)

I've got a print server in our Windows 2003 domain with a lot of print queues on it. We are seeing a significant amount of SNMP scans coming from this server which we think are unnecessary. ...
3
votes
3answers
13k views

How can I configure Wireshark to list my dial up connection as a possible capture interface?

I am trying to monitor traffic coming into to my machine via an incoming dialup connection. I am using Wireshark with WinPCap 3.1 ( I rolled back to 3.1 from 4.0 because I read that this was the ...
3
votes
3answers
881 views

Sniff packets which have source address other than my machine

I tried sniffing network traffic between 2 ip addresses. One is a HTTP server and other is the client accessing that site. My aim is to sniff POST method form data. How do i do that? When i tried ...
2
votes
2answers
3k views

Not seeing all Traffic with Wireshark and Windows

I just installed wireshark on a windows machine, when I run the capture, I do see traffic, but not all. I am VNC'd into the box and see no VNC traffic, If I ping something from the box, I can see it. ...
3
votes
1answer
766 views

Virtualize Wireshark with Thinstall from Vmware

Has anyone been able to virtualize Wireshark and PCAP utilizing thinstall from VMWare without requiring installation of the PCAP on the main OS?
2
votes
1answer
550 views

Debugging network traffic on local Windows machine

A customer running Windows is having issues with two server components that communicate with each other using TCP. Normally the two components live on two separate server, so Wireshark lets me easily ...
17
votes
4answers
8k views

Change protocol associated with port in wireshark

I'm trying to monitor some web traffic using wireshark. Our web proxy is on port 9191. How can I get the wireshark view to treat port 9191 just like port 80 - ie as HTTP. Just using Decode_As on the ...
14
votes
5answers
27k views

Is there a way to get wireshark to capture packets sent from/to localhost on Windows?

Is there a way to get wireshark to capture packets sent from/to localhost? When I monitor traffic going from my computer to another, or from another computer to my computer, then it works. But ...