Wireshark is a open source Network Protocol Analyzer under GNU License.

learn more… | top users | synonyms

0
votes
2answers
2k views

When analyzing packets with Wireshark, is there a way to know which program is sending which packet?

is there an easy way to know from where the packets come from? Which program? My pc which is on 192.168.0.100 is continuously sending packets (TCP and SMB) to an unknown host (192.168.1.99) and I ...
4
votes
5answers
5k views

Parse HTTP requests through Wireshark?

Is there any way to parse HTTP request data in wireshark? For example, can I expose the request parameters upon an HTTP GET request (being sent by my machine), so that I don't need to read the ...
0
votes
1answer
1k views

RST ACK over SSL in FireFox POST request

The original question is here. In short, for few users several POST requests hangs and are aborted after couple of minutes, when working over SSL (http is OK). What I'm asking here is an explanation ...
0
votes
1answer
685 views

Is it possible to export Wireshark syslogs to another device?

My company is trying to export the live captured packet syslogs to a device within the network. We were just wondering if it is actually possible to do it with the Wireshark acting as a syslog relay ...
4
votes
4answers
12k views

How to use sniffer to troubleshoot SMTP traffic?

We're having an issue where we are no longer receiving external emails. (We have an Exchange mail system, with a Barracuda spam filter and Watchguard hardware firewall.) The problem is that mail ...
0
votes
1answer
192 views

Need help getting StateServer to work, trying to decipher WireShark to figure out why

I'm using WireShark to try to figure out why I can't get my ASP.NET application (which is deployed to IIS6) to use a remote ASP.NET StateServer. For the record, StateServer works if my application is ...
1
vote
1answer
320 views

NTP and phones (need a useful ntp test)

I have a sip phone which gets its time from either an ntp server or the asterisk server. however the packets never seem to get replied to I put wireshark in the way and looked at anything with ...
0
votes
2answers
265 views

Identifying VoIP Users

I'm looking for a way to identify as many consumer VoIP users on my ISP network as possible using packet analysis. My setup is like this: On my core switch, all traffic going in and out of gigabit1 ...
4
votes
6answers
5k views

Does Wireshark pose a threat when installed on a server in the DMZ?

If you install wireshark on a web server sitting in the DMZ, is there a hack that can be used to get backdoor entrace to that server even when RDP is disblaed? I'm trying to monitor the wire on the ...
9
votes
4answers
38k views

How do i convert wireshark capture files to text files?

How can I convert wirshark captures (.cap) files to text files or some format from which I can read the file and parse its contents ? Regards, Mithun
1
vote
1answer
1k views

TCP RST Reset Every 5 Minutes on Windows 2003 sp2

Recently I had a web developer come to me and ask why he was receiving connection errors in his app that was accessing a sql database. So, I went through my normal trouble shooting steps to isolate ...
1
vote
1answer
1k views

TCP Zero Window with no corresponding Window Update

I am trying to debug a network issue and am using Wireshark and tcpdump to grab packets from my server. I have one client application that is grabbing all my available connections and then holding ...
1
vote
3answers
5k views

debugging spiking netstat “failed connection attempts” with iptables

http://farm4.static.flickr.com/3305/4588110530_a60c934289_o.png This graph is munin collecting netstat -s output. I want to determine where the connections are coming from. There is nothing obvious ...
7
votes
1answer
9k views

How to filter for HTTP 500 responses and their requests in Wireshark?

How do I filter for HTTP 500 responses and their requests in Wireshark? I'm able to use http.response.code == 500 to find all the responses which got the return code 500 but I want to be able to see ...
0
votes
2answers
3k views

Track IP Messenger's chatting by wireshark

We have Linux server ( RHEL 5 ), and some client machines ( Windows XP ) in local area network. We using server as proxy server. I am using squid proxy. My windows machines using internet by proxy. ...
2
votes
1answer
1k views

WireShark - wireshark trace traffic from my local browser to a local .net application I have with a HttpListener? (e.g. local to local)

Can wireshark trace traffic from my local browser to a local .net application I have with a HttpListener? (e.g. local to local) I can't seem to detect this traffic at the moment with wireshark. Is ...
3
votes
3answers
10k views

wireshark http POST

I would like to have a http POST request method CAPTURE filter. I know it is easy to do it by display filter http.request.method==POST but I need tcpdump compatible. I wrote tcp dst port 80 and ...
4
votes
2answers
1k views

Saving Wireshark capture settings for future use

Is there any way to save Wireshark capture options? So it can be reuse after restart Wireshark. Also, if the saved file is in plain text, it's possible to use scripts generating bunch of capture ...
1
vote
1answer
1k views

Checking rtp stream audio quality

We are working in a test environment and need to monitor the audio quality of an rtp stream that is being captured using tshark. Right now we are able to capture the audio and access the file through ...
6
votes
2answers
8k views

No interface available for Wireshark running on Ubuntu with wireless connection

I'm completely new to wireshark. I have Ubuntu on a Dell with wireless connection. When I go to Wireshark Capture Option, I cannot select any interface since no interface is listed. What is the ...
3
votes
2answers
13k views

With wireshark how can I filter by packet size?

I can filter for packet lengths using a display filter containing data.len >= XXX, but I'd really like to use a capture filter for this for efficiency... is there a way to do it?
3
votes
1answer
2k views

Wireshark arp packets

In wireshark, after capturing some arp packets, what is the significance of all 1's in the destination field. of an Ethernet II frame?
4
votes
4answers
4k views

Wireshark and IPSec

I am trying to troubleshoot communication between two servers on a Windows network where IPSEC is encrypting everything. I installed wireshark on the source server and captured traffic at the point ...
2
votes
2answers
1k views

wireshark captures different on two computers from the same port

I Have a Windows XP Machine Running wireshark, connected to a Mirror port on a network. I'm capturing with no filtering, and it can only see half of some two way TCP conversations. I had thought it ...
32
votes
4answers
123k views

How to filter http traffic in Wireshark?

I suspect my server has a huge load of http requests from its clients. I want to measure the volume of http traffic. How can I do it with Wireshark? Or probably there is an alternative solution using ...
4
votes
3answers
10k views

Sniffing the Vmware vmnet1 network with Wireshark

I have a virtual machine deployed in vmware fusion which is communicating with the host over the interface vmnet1. Unfortunately, wireshark does not offer me to to listen on that interface. Is there ...
2
votes
2answers
518 views

Wireshark: What is wag-service?

I'm seeing alot of wag-service traffic in wireshark. What is it?
3
votes
5answers
3k views

Is it safe to run Wireshark on a production IIS7 server? Is there a good alternative?

We host a bunch of ASP.NET sites on an IIS7 server. Occasionally, we'd like to be able to log HTTP POST data to troubleshoot problems. IIS lets us log the query string, but not the POST data - at ...
3
votes
3answers
4k views

Determine What Process is Generating Network Traffic (Windows Server 2003)

I've got a print server in our Windows 2003 domain with a lot of print queues on it. We are seeing a significant amount of SNMP scans coming from this server which we think are unnecessary. ...
3
votes
3answers
13k views

How can I configure Wireshark to list my dial up connection as a possible capture interface?

I am trying to monitor traffic coming into to my machine via an incoming dialup connection. I am using Wireshark with WinPCap 3.1 ( I rolled back to 3.1 from 4.0 because I read that this was the ...
3
votes
3answers
879 views

Sniff packets which have source address other than my machine

I tried sniffing network traffic between 2 ip addresses. One is a HTTP server and other is the client accessing that site. My aim is to sniff POST method form data. How do i do that? When i tried ...
2
votes
2answers
3k views

Not seeing all Traffic with Wireshark and Windows

I just installed wireshark on a windows machine, when I run the capture, I do see traffic, but not all. I am VNC'd into the box and see no VNC traffic, If I ping something from the box, I can see it. ...
3
votes
1answer
750 views

Virtualize Wireshark with Thinstall from Vmware

Has anyone been able to virtualize Wireshark and PCAP utilizing thinstall from VMWare without requiring installation of the PCAP on the main OS?
2
votes
1answer
530 views

Debugging network traffic on local Windows machine

A customer running Windows is having issues with two server components that communicate with each other using TCP. Normally the two components live on two separate server, so Wireshark lets me easily ...
17
votes
4answers
7k views

Change protocol associated with port in wireshark

I'm trying to monitor some web traffic using wireshark. Our web proxy is on port 9191. How can I get the wireshark view to treat port 9191 just like port 80 - ie as HTTP. Just using Decode_As on the ...
13
votes
5answers
26k views

Is there a way to get wireshark to capture packets sent from/to localhost on Windows?

Is there a way to get wireshark to capture packets sent from/to localhost? When I monitor traffic going from my computer to another, or from another computer to my computer, then it works. But ...