Wireshark is a open source Network Protocol Analyzer under GNU License.

learn more… | top users | synonyms

1
vote
1answer
126 views

Understand wireshark capture for ssh key exchange

I need to understand SSH key exchange, I have tried to read RFC document but it seems very difficult to understand so I have captured packets using wireshark ,I found various packets for ssh ...
0
votes
1answer
43 views

Wireshark seems to ignore my filters

I'm trying to make use of Wireshark 1.10.6 for Windows and I want to only capture the traffic to port 443 (to diagnose some weird HTTPS problems I'm having). So I open Capture -> Capture Filters... ...
5
votes
2answers
1k views

Capturing multicast data with Wireshark with IGMP Snooping Enabled at the switch

I am trying to capture multicast traffic via Wireshark (actually TShark), however the switch has IGMP snooping enabled and will only send Multicast traffic on the ports that have an active IGMP ...
0
votes
0answers
20 views

Intercept HTTPS traffic of a IP energy consumption monitor device [migrated]

I have this device connected to my home network, and I'm curious about what it's sending to the Internet. It seems to generate a lot of traffic. I've connected it to my laptop and I've shared the ...
1
vote
2answers
716 views

TCPDump and IPTables DROP by string

by using tcpdump -nlASX -s 0 -vvv port 80 I get something like: 14:58:55.121160 IP (tos 0x0, ttl 64, id 49764, offset 0, flags [DF], proto TCP (6), length 1480) 206.72.206.58.http > ...
2
votes
2answers
38 views

EC2 hosting, trying to understand network security model

We are hosting few virtual machines at amazon. Security groups and other configurations are set up to allow access only from desired addresses and to desired parties. The machines do talk with each ...
0
votes
0answers
37 views

Exporting SNMP OID values from wireshark capture?

I am trying to figure out how I can export the SNMP OID values that wireshark picked up. My issue is that when I export the raw data it is all together and not seperated. All I want to to is get only ...
32
votes
3answers
2k views

ISP broadcasting all IP-packets, so I can see traffic of other clients from ISP

Recently I wondered why my router shows a constant downstream of 5 MBit/s, while I am downloading almost no data. I discovered the "packet logging" function of my router, with which I was able to log ...
2
votes
2answers
39 views

How can I get a list of the ports that Wireshark knows?

When I need to choose a new port to use (internal to an organisation) I used to look in /etc/services. This is no longer sufficient, as Wireshark knows about many other ports that are not in ...
2
votes
0answers
913 views

IP Conflicts from mikrotik router for multiple ip addresses (that it isnt assigned)

I have a point to point wireless connection using two mikrotiks. When I plug the mikrotik into a switch with just my laptop I get an IP address conflict on my machine no matter what IP I am assigned. ...
1
vote
2answers
67 views

Can I capture ISP SNMP information with Wireshark?

I am trying to do some heavy digging into SNMP, BPI+, ISP networks. Since wireshark can be used to capture network data, would I be able to use it to remotely capture my ISP SNMP agent information and ...
3
votes
4answers
5k views

Wireshark filter to only capture Incoming Packets?

I am trying to setup a Filter (so my log files aren't massive) that will capture only incoming traffic. I have looked on http://wiki.wireshark.org/CaptureFilters but so far have been unable to find a ...
0
votes
1answer
70 views

Linux unfriendly IIS/ASP.NET :-) : Quick download on windows but slow on linux [closed]

This particular web site (gops.tay.be) serves objects quick if I try to request the page using windows, but I get them very slow if trying using linux. There is no difference if I use browser or curl: ...
0
votes
2answers
91 views

Caculating packet offset

In Wireshark, if I want to write a filter which accepts only ICMP destination unreachable ( type 3 ) messages, the filter is icmp[0] == 3 . How do I count the packet offset of 0 in this instance ? ...
2
votes
3answers
3k views

Excessive 'TCP Dup ACK' & 'TCP Fast Retransmission' causing issues on network. What's causing this?

I'm getting excessive TCP Dup ACK and TCP Fast Retransmission on our network when I transfer files over the MetroEthernet link. The two sites are connected by one sonicwall router, so the sites are ...
0
votes
2answers
74 views

How can I create a packet capture file on a headless server for a single process?

I'm writing a python script on a headless server, and I'd like to see the packet capture output for the script. I can't run ettercap or Wireshark on the server as there is too much other noise ...
2
votes
1answer
95 views

Strange Ethernet II packets in wireshark

Looking at a wireshark capture, I'm seeing something really strange. Ethernet II packets with random data are being sent on the network. The larger packets in the capture seem to contain bits and ...
0
votes
2answers
54 views

Occasional Delay on Website Resources: Packet Loss Due to Bandwidth Cap?

My website loads more slowly than I think it should, due to a few of the assets taking an absurdly long time to download from the server. I've been trying to track down the cause of this. I'm about ...
0
votes
2answers
87 views

server sending hpoms-dps-lstn packets to unknown IP

I have a server running pacemaker with corosync and some standard services as mails, web, ssh... When I run wireshard in my network I keep getting those packets that my server is sending to the IP ...
1
vote
0answers
148 views

USB packet sniffing on Mac OS? [closed]

I want to sniff USB packets being sent from my Mac to a device. For various reasons I cannot use Linux or Windows, and I'm stuck with Mac OS. Can anyone recommend a packet sniffing method? I've tried ...
-6
votes
1answer
91 views

How to monitor all network traffic [closed]

I have installled wireshark on my server but can only monitor traffic through the local nic but all network traffic does not go through the server. I would like to monitor all network traffic. Are ...
1
vote
1answer
1k views

tcpdump capturing tcp resets by host

I am trying to figure out where my tcp resets on my webserver happen. I have the following capture: tcpdump -fnni bond0:-nnvvS -w dump.pcap 'tcp[tcpflags] & (tcp-rst) !=0' When I look at the ...
3
votes
3answers
9k views

How can I configure Wireshark to list my dial up connection as a possible capture interface?

I am trying to monitor traffic coming into to my machine via an incoming dialup connection. I am using Wireshark with WinPCap 3.1 ( I rolled back to 3.1 from 4.0 because I read that this was the ...
0
votes
1answer
118 views

Wireshark - Capture syslog traffic form local workstation

I am using wireshark version 1.10.3 on windows 7 x64 enterprise. I am trying to capture all outbound UDP traffic, in particular syslog traffic. I have tried a capture filter UDP, but all I can see ...
0
votes
3answers
884 views

Can Wireshark capture an entire Ethernet frame including preamble, CRC and Interframe spacing?

I am examining an Ethernet frame in Wireshark. According to the "Ethernet frame" Wikipedia article and accompanying diagrams, "A frame starts with a 7-octet preamble and 1-octet start frame delimiter ...
0
votes
1answer
54 views

Network card capable of capturing a tonne of packets and not dropping them?

Edit: Our server is trying to capture packets at between 500-600Mb/s, but is dropping packets 'due to kernel'. Data is being written to SSDs, and isn't bottleneck there. What things should I look ...
2
votes
1answer
76 views

How to block own rpcap traffic where tshark is running?

Platform :- Fedora 13 32-bit machine RemoteMachine$ ./rpcapd -n ClientMachine$ tshark -w "filename" -i "any interface name" As soon as capture starts without any capture filter, thousands of ...
0
votes
0answers
29 views

Capturing same interface with tshark with same or different capture filters

I am in stuck in a situation where an interface will be captured more than one time. Like :- $ tshark -i rpcap://1.1.1.1/lo -f "ip proto 1" -i rpcap://1.1.1.1/lo -f "ip proto 132" or (same filter) ...
1
vote
1answer
60 views

“tshark: There are no interfaces on which a capture can be done” in Amazon Linux AMI

My goal is to capture packets with tshark in Amazon Linux AMI. While typing tshark in the command line there's an error: "tshark: There are no interfaces on which a capture can be done" How to ...
1
vote
0answers
64 views

NFSv3 Asynchronous Write Depends on Block Size?

I am trying to figure out if my NFSv3 deployment is performing SAFE asynchronous writes. I suspect that it is doing strictly synchronous writes, as I am getting poor performance in general. I used ...
0
votes
1answer
77 views

How can I measure the cumulative network usage of a process, from execution beginning to end

I want to measure how much bandwidth git pull uses, preferably by prefixing git command with desired program, i.e. nettally git pull Alternatively, is there some sneaky way to accumulate nethogs / ...
0
votes
0answers
65 views

How to get more NFS packet details from Wireshark?

How can I get Wireshark to give me details about NFS packets at this level of granularity? (as exemplified here here) Specifically, I am interesting in looking at the the "Stable" option toward ...
0
votes
1answer
2k views

Why Wireshark does not recognize this HTTP response?

I have a trivial CGI script that outputs simple text content. It's written in Perl and using CGI module and it specifies only the most basic headers: print $q->header( -type ...
11
votes
2answers
18k views

How to make wireshark filter POST-requests only?

How to make wireshark filter POST-requests only?
2
votes
2answers
101 views

Wireshark filtering-trying to filter out my own local ip

i'm trying to filter out my ip address(local address) "192.168.5.22" I used "ip.src != 192.168.5.22|| ip.dst !=192.168.5.22"(without quotes) and I keep seeing my address pop up im in a heavy traffic ...
2
votes
4answers
522 views

Extremely high arp fllooding from the router

My subnet is 10.162.0.0/16. We have a router with a couple of interfaces. Gateway for my subnet is 10.162.0.1. The router is situated in another building and I haven't direct access to it. Line from ...
0
votes
0answers
176 views

Window Size goes to zero

We are seeing an issue with our web servers where a client is doing a HTTP POST and sending xml files. We are seeing weird behavior where we are sometimes only receiving part of the data. (Sometimes ...
15
votes
4answers
5k views

Change protocol associated with port in wireshark

I'm trying to monitor some web traffic using wireshark. Our web proxy is on port 9191. How can I get the wireshark view to treat port 9191 just like port 80 - ie as HTTP. Just using Decode_As on the ...
1
vote
1answer
45 views

Wireshark not found after installing RHEL 5.5 [closed]

After installing Wireshark in RHEL 5.5 (32bit) with following command: yum install wireshark Wireshark not found: [root@localhost ~]# wireshark bash: wireshark: command not found What ...
4
votes
2answers
4k views

Stopping the WinPcap Packet capture service

I just installed WireShark, which also installed WinPcap. During the installation it said "do you want xxx to start automatically", which I answered yes. Now I would like to stop the service when I ...
0
votes
0answers
32 views

ELMI Packet Capture Tool

Is anyone aware of any software that is capable of sniffing and displaying elements for the E-LMI (Ethernet Local Management Interface) protocol? Wireshark doesn't seem to... I could write my own ...
4
votes
4answers
9k views

How can I sniff the traffic of remote machine with wireshark?

I can sniff the traffic of my local pc but I would like to know how to I sniff the traffic of a remote machine by wireshark? When in capture option I select remote interface and enter my remote ip ...
0
votes
1answer
65 views

tshark duration of a conversation for a ip address

i can retrieve the follow info from a .pcap : ================================================================================ IPv4 Conversations Filter:ip.addr==1xx.1xx.0.1xx ...
0
votes
1answer
79 views

Wireshark - Difference between fixed parameters and tagged parameters

I'm new to Wireshark. I'd like to know what are fixed and tagged parameters and the difference between them. Web search didn't help. Kindly explain it to me in simple terms.
0
votes
0answers
35 views

wlan monitoring a ping: inside the network only 2 packets, outside 4

I have the following network setup: PC1 monitor node (not connected to the ssid) PC3 access point PC5 client1 PC6 client2 I monitor the traffic on PC1 using ...
0
votes
0answers
96 views

Apache logs or tcpdump slow loris

i know about the question : How can I detect Slowloris? but that does not apply. Now i have a big server that receives more then 10.000 events on the IDS per each 10 minutes, and i have suffered in ...
1
vote
1answer
108 views

mysql logging activity from specific user or ip

I have mysql server. The server is accessed by my application, and by external auditor (person using mysql workbench). The auditor has specific user and password and dedicated IP and it is granted ...
8
votes
3answers
20k views

How do i convert wireshark capture files to text files?

How can I convert wirshark captures (.cap) files to text files or some format from which I can read the file and parse its contents ? Regards, Mithun
2
votes
2answers
4k views

How to debug “HTTP request sent, awaiting response”?

I have a Linux server on an ADSL connection, and I just noticed that sometimes I get Connecting to example.com|xxx.xxx.xxx.122|:80... connected. HTTP request sent, awaiting response... when I use ...
1
vote
1answer
192 views

trace ftp file data in wireshark

I am trying to analyze ftp traffic in Wireshark. I can see commands like Request: List, PORT. But after FTP Response 150: Opening data channel for directory list. what I see immediately is ...