Wireshark is a open source Network Protocol Analyzer under GNU License.

learn more… | top users | synonyms

14
votes
5answers
27k views

Is there a way to get wireshark to capture packets sent from/to localhost on Windows?

Is there a way to get wireshark to capture packets sent from/to localhost? When I monitor traffic going from my computer to another, or from another computer to my computer, then it works. But ...
19
votes
4answers
56k views

How can I filter https when monitoring traffic with Wireshark?

I want to observe the HTTPs protocol. How can I use a Wireshark filter to do that?
3
votes
2answers
687 views

Packets returning but traceroute fails

I get this output from traceroute: #traceroute -i eth1 -s 192.168.12.14 192.168.1.72 1 192.168.12.1 (192.168.12.1) 1.410 ms 2.076 ms 2.251 ms 2 * * * 3 * * * etc.. But in another terminal I ...
19
votes
5answers
34k views

How can I sniff the traffic of remote machine with wireshark?

I can sniff the traffic of my local pc but I would like to know how to I sniff the traffic of a remote machine by wireshark? When in capture option I select remote interface and enter my remote ip ...
17
votes
4answers
8k views

Change protocol associated with port in wireshark

I'm trying to monitor some web traffic using wireshark. Our web proxy is on port 9191. How can I get the wireshark view to treat port 9191 just like port 80 - ie as HTTP. Just using Decode_As on the ...
7
votes
1answer
29k views

Why does WireShark think this frame is a TCP segment of a reassembled PDU

Please find a small pcap file here illustrating my problem. I have a three-way TCP handshake, followed by two FIX logons. (FIX is a protocol used in trading.) The first FIX logon (frame 4) is ...
1
vote
1answer
669 views

How can I display-filter the correspondant response to a specific display-filtered request in wireshark?

I am just tracing a very sporadic error in responses to HTTP requests to a specific resource on an embedded device's webserver. So my plan is to run a test over night (or even weekend), capture the ...
3
votes
3answers
13k views

How can I configure Wireshark to list my dial up connection as a possible capture interface?

I am trying to monitor traffic coming into to my machine via an incoming dialup connection. I am using Wireshark with WinPCap 3.1 ( I rolled back to 3.1 from 4.0 because I read that this was the ...
2
votes
2answers
1k views

Network flooded with seemingly empty packets

Let me preface this with the fact that I'm just a web developer at my company with little networking knowledge. Earlier today there was a department that lost all of their network connections so I ...
5
votes
2answers
2k views

syn/ack sequence number confusion

I was looking at some random traffic in wireshark and came across this (using relative seq/ack numbers): 1. myIP -> 74.125.227.96 [SYN] seq=0 2. 74.125.227.96 -> myIP ...
1
vote
1answer
877 views

Can firewall block packets visible in Wireshark?

Wireshark shows that an RTP package is received on a PC. Is it possible that despite detection by Wireshark, something (firewall?) is still prevent the application listening to the required port on ...
1
vote
2answers
2k views

Wireshark does not capture HTTP on 8080

I am running Wireshark on my linux machine and i have simple python web server running on localhost:8080 I am capturing only local port 8080. When i open browser on localhost:8080 wireshark captures ...
0
votes
3answers
6k views

Can Wireshark capture an entire Ethernet frame including preamble, CRC and Interframe spacing?

I am examining an Ethernet frame in Wireshark. According to the "Ethernet frame" Wikipedia article and accompanying diagrams, "A frame starts with a 7-octet preamble and 1-octet start frame delimiter (...