Wireshark is a open source Network Protocol Analyzer under GNU License.

learn more… | top users | synonyms

18
votes
2answers
1k views

What's the Wireshark packet receiving and processing procedure on a Windows machine?

I am about to use Wireshark for some traffic monitoring on my Windows computer. While working on it, I was wondering how Wireshark manages to catch low level network packets before Windows does. ...
1
vote
1answer
31 views

Using wireshark to determine which RSA PRIVATE KEY SSL conversation?

Situation I have a client VM and server VM communicating using SSL. The client VM runs wireshark capture using CLI Wireshark GUI is running locally on a different machine. Steps As USER on the ...
0
votes
0answers
59 views

FileZilla FTP Error - 426 Connection Closed; aborted transfer of “filename”

I'm trying to transfer a file to an FTP server but I get the error on the title: "426 Connection Closed; aborted transfer of "XYZ". Here are some info: I can establish the connection, change ...
3
votes
1answer
2k views

IP Conflicts from mikrotik router for multiple ip addresses (that it isnt assigned)

I have a point to point wireless connection using two mikrotiks. When I plug the mikrotik into a switch with just my laptop I get an IP address conflict on my machine no matter what IP I am assigned. ...
0
votes
1answer
43 views

Need help in understanding the packet analysis(wireshark) [closed]

The snapshot capture below contains a single HTTP request to a web server, in which the client web browser requests some files from server, and the server returns an HTTP/1.1 200 (OK) response which ...
0
votes
2answers
38 views

Wireshark Packet Capture Data Data ACK Confusion

I understand how acks work and windowing works. What I am not getting is why am I seeing the following behavior in packet captures Client Server data1-----> data2-----> <--------ack ...
1
vote
1answer
53 views

how can i setup tshark to capture full URL uri request ip and time stamp

How can I setup tshark to capture full URL uri request ip and time stamp. I have tried this: tshark -V -R "tcp.port ==80 && (http.request || http.response)" | awk "/Hypertext Transfer ...
0
votes
1answer
43 views

Capture traffic to/from a network node

I would like to capture all traffic to/from a network node. I don't know much about the network setup there, here's what I know: The target node is a Linux server, which has no access to internet, ...
0
votes
0answers
29 views

Why sar ETCP shows TCP retransmission but wireshark tcp.analysis.retransmission doesn't

I am trying to investigate the cause of TCP retransmission. When I use sadc and sar, it shows there are tcp retransmission; but when I use wireshark on all of the server's interfaces, it doesn't show ...
0
votes
1answer
33 views

TCP connection RST after FIN, ACK

I have a situation that would like to clarify with the experts here. I am no network expert so maybe it's normal, but i rather ask. We are trying to diagnose a problem between two servers, both are ...
0
votes
3answers
6k views

Can Wireshark capture an entire Ethernet frame including preamble, CRC and Interframe spacing?

I am examining an Ethernet frame in Wireshark. According to the "Ethernet frame" Wikipedia article and accompanying diagrams, "A frame starts with a 7-octet preamble and 1-octet start frame delimiter (...
0
votes
0answers
31 views

Transferring data to Active FTP server fails from DMZ but works fine from LAN

I know there are a ton of similar questions already, but I've read through just about everything I could find and am still having trouble resolving my specific issue. Problem: I am having difficulty ...
0
votes
0answers
20 views

Which wireshark output format aligns closest with actual SMTP data?

I have a packet capture of a SMTP session (containing an email with international characters). I'd like to extract the message data from that and try reproducing an issue. When I follow the TCP ...
1
vote
2answers
44 views

How do I see absolute time stamps in Wireshark?

There is an example of pcap file opened in wireshark The second column is time. Is it possible to see absolute timestamps here instead of relative?
1
vote
1answer
46 views

Debugging why network packets are being dropped

Preface: I have an application that I am currently testing out that runs on RHEL 6. The setup for my test is the application installed on a embedded device, connected by an Ethernet cable to PC that ...
1
vote
1answer
1k views

How to decode traffic as NTLM protocol in Wireshark?

I'm trying to debug NTLM authentication issue. One of my ideas was to capture the network traffic and look thougth it. In my case NTLM authentication is going over non-stardart port (6901). Of course, ...
0
votes
0answers
11 views

What filter in Wireshark, can return the ACKs packets employed to complete TCP three-way handshakes instigated by a particular party?

What filter in Wireshark, can return the ACKs packets employed to complete TCP three-way handshakes instigated by a particular party? For instance if machine A requests for a TCP connection to be ...
1
vote
1answer
23 views

Is there a quick way to determine what applications are present within a Wireshark capture? If so how

Is there a quick way to determine what applications are present within a Wireshark capture? If so how As most captures contain over 10 thousand lines, I can't expect people would by hand check which ...
-2
votes
2answers
50 views

Why do different packet analyzers sometimes produce different results?

I ran wireshark and windump at the same time. Both packet analyzers use the same winpcap library. However after doing a row by row comparison of the results I noticed both every column between the 2 ...
1
vote
4answers
4k views

How can the SSDP protocol be filtered out of Wireshark view?

In Wireshark version 1.12.4, I am trying to filter out packet messages with an SSDP protocol. When I clicked the Expression button next to the Filter field, and selected "HTTP" (as Field Name) and "...
2
votes
1answer
32 views

Meaning of [MASKED] in pcap file

What does [MASKED] mean? Is it related to websocket proto? Can i state that 168.109.7.151 initiated connection closing?
1
vote
3answers
27k views

Troubleshoot large number of TCP retransmits / dup ack / segment lost

I have a problem with RDC slowing to a crawl or disconnecting entirely. Client is XP SP3 w/ RDC 6, server is Win 2k8 R2. Both have been scanned thoroughly and found to be virus free. I downloaded ...
1
vote
2answers
26 views

tcpdump http containing non expected payload bytes

I am monitoring an openvpn link with tcpdump a la tcpdump -i tun5 -w capture.dump -W 100 -C 100M -s 0 -n There is http/xml traffic going over that link which is basically caputered just fine. However, ...
2
votes
2answers
83 views

How do you continuously run Wireshark without eating up all of my RAM?

I need to run Wireshark all night to capture packets from a certain IP address. I notice the longer Wireshark runs, the more RAM it takes up because it stores all of the packets found during the run. ...
-1
votes
1answer
26 views

Is it possible for SYN/ACK to not be immediately proceeded by a SYN in a network trace

I'm writing a simple program to calculate initial RTTs from a network capture I took using Wireshark. To do this I wan't to calculate the difference in time between the SYN and the SYN/ACK. I don't ...
0
votes
0answers
53 views

TCP sockets dying on LTE

I have about 25 audio streaming clients built on an i.mx6 arm platform, running linux version 4.3.0-rc2-00019-gbcee19f-dirty #36 SMP Tue Feb 9 15:27:51 EST 2016 armv7l I find on two specific units ...
0
votes
1answer
47 views

Is the output complete after omitting [TCP segment of reassembled PDU]?

If the tshark -r dumpfile output contains the type [TCP segment of a reassembled PDU], as in 81 3.164109000 4.5.6.7 -> 12.13.14.15 TLSv1.2 609 Application Data 83 3.164523000 4.5.6.7 -> 12....
0
votes
1answer
58 views

How can I see what is the number of embedded objects used by a site in html from a wireshark trace?

I have recorded a wireshark trace and visited some websites. I exported the trace as a CSV file. How can I see the number of embedded objects in each of the sites I visited? Thanks.
-1
votes
1answer
42 views

the MAC header of captured wireshark packets

I have been reading about the IEEE 802.11 and especially on the MAC layer, and i noticed that it contains a lot of informations, but when i start to capture with wireshark with my wireless card, the ...
1
vote
1answer
41 views

udp broadcast on port 25860

I used wireshark on my local network (to test it), and i noticed that there is a lot of udp packets send one broadcast, and the majority is coming from only one host. Theses udp packets are send on ...
0
votes
0answers
47 views

Analyzing SSL Encryption Alerts

I have captured the traffic between my machine and my server using Wireshark, trying to find why some SSL requests fail. I've read this and this post about debugging SSL entries, and I'm able to find ...
0
votes
2answers
857 views

user agent in http or https request

Is there any way that I can differentiate, the HTTP or HTTPS packets are coming from browser or not ? specially for https request.There is User-Agent field in packet in Http,but I could not found ...
0
votes
1answer
31 views

PCAP traffic frame length short

I'm trying to make traffic and capture it using pcap file. I get pcap file from CAIDA(caida.org) site. This pcap file too big and doesn't have ethernet header. So i splitted pcap file to small size(40 ...
1
vote
1answer
321 views

tshark not recognizing wpa psk option

I'm trying to decrypt captured wpa-psk traffic with tshark, but it's not recognizing the option I'm trying to override. This option allows me to specify a PSK to use for decrypting. I'm using tshark 1....
0
votes
1answer
29 views

Wireshark returns error on filters from Windows command prompt

It works when i use GUI with the following filter http.request.method == "GET" but when i run tshark is aways returns error tshark -i 1 -Y 'http.request.method == "GET"' tshark: Syntax error near "...
0
votes
1answer
40 views

Can a remote connetion from outside a LAN be invisible to protocol analyzers such as Wireshark, Process Hacker, Nbtstat? [closed]

When studying the behavior of trojans and (RAT) Remote Access Trojans this question came up. Can an attacker create a trojan that could trick the OS or the NIC into hiding a remote connection to a ...
0
votes
0answers
49 views

Wireshark doesn't filter correctly http.host

When trying to filter for a specific host with http.host=="abc.com" it shows me everything instead of only the related packets. What am I doing wrong? Wireshark 1.12.6
0
votes
2answers
89 views

Wireshark unable to capture squid traffic at port other than 3128

I use the following display filters to analysis traffic between client and squid3 server with Wireshark but nothing shows up. http && tcp http && tcp && tcp.port == 3888 If ...
1
vote
2answers
54 views

How to send captured packets to a different destination?

I have some data packets captured using tcpdump in a pcap file. Now I want to send those packets to a another destination. how I can achieve this?
1
vote
1answer
135 views

Can't connect to python server on LAN

So I have this python server which just returns the uppercase sentence which came as a input: from socket import * serverPort = 12000 serverSocket = socket(AF_INET, SOCK_DGRAM) serverSocket.bind(('...
1
vote
1answer
61 views

How do I export both Packet bytes and Summary line using tshark?

I can export ascii using Wireshark with exactly the same settings as in the example from the documenation, i.e. Only Summary line and Packet bytes exported. Since I have many files to do this with I ...
0
votes
3answers
2k views

How can I create a packet capture file on a headless server for a single process?

I'm writing a python script on a headless server, and I'd like to see the packet capture output for the script. I can't run ettercap or Wireshark on the server as there is too much other noise (...
1
vote
2answers
365 views

Strange UDP/TFTP Problem

My TFTP client only seems to be getting responses from the TFTP server to its RRQ (download requests) if I watch the traffic in wireshark. If I shut down wireshark (running on the TFTP server), the ...
1
vote
1answer
232 views

Wireshark shows “TCP Dup Ack” on SACK after each regular ACK

I have a TCP session captured via switch port mirroring and tcpdump. When viewing it (in Wireshark), I see the same pattern whenever I send a message; here's an excerpt of the outbound packets (I don'...
1
vote
0answers
17 views

detect process accessing network ip on Windows server 2012 R2 [closed]

I tried to identify processes that try to access certain IPs(akamai - 23.0.174.35...). I used MS Message Analyzer but it seams that it can not give definitive results since I get different name and ...
2
votes
0answers
43 views

is the disconnection caused by too many TCP Dup Ack?

I am investigating a service disconnection issue and I am a bit confused by some of the Wireshark logs. Need some help to find out how the disconnection was caused. Ideally when A sends an ACK to B ...
0
votes
1answer
25 views

wireshark sort by TCP dup ack and sort by worst offender?

I have lots of hosts on this network, I want to find out who is the "noisiest", I captured 500k packets and many hosts have TCP dup ack (and other things), what regex should I use to sort by and then ...
31
votes
2answers
56k views
0
votes
0answers
170 views

Error decrypting SSL traffic in Wireshark

I am trying to decrypt an SSL connection using Wireshark. It doesn't use DH, so I understand it should be possible to decrypt using the private key (which I have.) The following log shows the error. ...
0
votes
0answers
168 views

http cookie contains datr not working (none packets is returned) wireshark

When I filter in wireshark: http.cookie contains datr none packets is returned, the list in null. What's I going wrong?