Questions tagged [wireshark]
Wireshark is an open source Network Protocol Analyzer under GNU License.
144
questions with no upvoted or accepted answers
4
votes
0
answers
5k
views
Troubleshooting Packet Loss on pfSense + Ubiquiti UniFi (Wireshark maybe?)
I'm dealing with an annoying situation in a small network in my church, which I'm the primary volunteer IT caretaker, of about 20 PCs, give-or-take.
We're in Chattanooga, home of Gigabit internet, so ...
4
votes
0
answers
712
views
RTP analysis - Discerning ptime (packetization time) for a given VoIP packet capture
I would like some help on the subject of an automated way of discerning the average packetization time (ptime) of a VoIP call's packet capture.
The reason I am not depending on the value in the SDP ...
4
votes
1
answer
694
views
How to block own rpcap traffic where tshark is running?
Platform :- Fedora 13 32-bit machine
RemoteMachine$ ./rpcapd -n
ClientMachine$ tshark -w "filename" -i "any interface name"
As soon as capture starts without any capture filter, thousands of ...
3
votes
0
answers
2k
views
FileZilla FTP Error - 426 Connection Closed; aborted transfer of "filename"
I'm trying to transfer a file to an FTP server but I get the error on the title: "426 Connection Closed; aborted transfer of "XYZ".
Here are some info:
I can establish the connection, change ...
3
votes
0
answers
2k
views
Can I use tshark to write SSL-decrypted packets to a file?
I have a PCAP file containing SSL-encrypted HTTP traffic and the private key from the relevant web server. I'd like a PCAP file that contains the decrypted HTTP traffic to feed into a different tool. ...
3
votes
3
answers
10k
views
IP Conflicts from mikrotik router for multiple ip addresses (that it isnt assigned)
I have a point to point wireless connection using two mikrotiks. When I plug the mikrotik into a switch with just my laptop I get an IP address conflict on my machine no matter what IP I am assigned. ...
2
votes
0
answers
197
views
TShark - Include decrypted tls data in output
I'm trying to read https requests from an application and while I can somewhat make sense of the data using wireshark, I cannot make tshark output the data as I want it. One of the problems I've ...
2
votes
0
answers
70
views
Microsoft CA Problem for Windows 10 Clients with Wireshark Installed
This is a most bizarre scenario, but hoping someone else has ran into this at some point to shed some light.
We are in the process of migrating to a new host Microsoft CA service. There are CA ...
2
votes
0
answers
3k
views
Fatal error TLS client credential
I have disabled SSLv3, TLS1.0 and 1.1 on a Windows 10 domain joined laptop, I also disabled triple DES 168 and MD5 to comply with our PCI scans and since then the system logs are full of the same ...
2
votes
0
answers
9k
views
Why TCP Out-Of-Order packet is seen after SYN?
I am trying to troubleshoot a performance issue between a client and a file server. When I look at the capture from the client, I see a weird behavior. I am trying to understand this weird behavior.
...
2
votes
0
answers
5k
views
Does wireshark can capture https request?
I have been working in wireshark. And I can able to capture the http request and capturing http packets using wireshark. And now I am capturing the https request. It seems does not capture the packets ...
2
votes
0
answers
3k
views
How to measure latency using wireshark
I'm trying to measure the wire-to-wire latency of a blackbox application. The application engages in tcp offloading (kernel bypass), it consumes incoming UDP packets via a NIC and in response, ...
2
votes
0
answers
521
views
is the disconnection caused by too many TCP Dup Ack?
I am investigating a service disconnection issue and I am a bit confused by some of the Wireshark logs. Need some help to find out how the disconnection was caused.
Ideally when A sends an ACK to B ...
2
votes
0
answers
793
views
Difference between ping time and time for first ACK answer
While creating a packet performance monitor I come across the follow problem: if I ping a server, I get about 4ms. If I calculate the time between a POST and its first ACK, I get about 25us (...
2
votes
0
answers
629
views
replay decrypted ssl traffic with tcpreplay
I have an pcap format from some https traffic from one of my web-servers.
So I can use the key from my webserver to decrypt the traffic in wireshark. The problem I'm now facing is that I can't get an ...
2
votes
0
answers
3k
views
Issue with Netgear GS108T Managed Switch and Jumbo Frames
I recently purchased a Netgear GS108T managed switch and I am trying to configure jumbo packets between my NAS (Thecus N4100Pro), PC and managed switch. I should mention the fact that I was able to ...
2
votes
0
answers
1k
views
Wireshark (WinPCap) does not see Intel X520-DA2 10 GbE NIC teaming intermittently
I am running a team of two 10 GigE ports on Intel X520-DA2 network card. They work well in tandem and achieve the desired throughput. However, I see an intermittent issue whereby WireShark and my ...
1
vote
0
answers
49
views
TCP & Wireshark - Server not re-transmitting segments?
I am new to TCP-in-depth-analysis which I need for a current problem.
Connections:
Client = Host PC, Ubuntu 22.04.4 LTS (IP: ...60)
Switch (TL-SG1016D by tp-link, Gbit)
Server = Proprietary embedded ...
1
vote
0
answers
130
views
Why are network packets getting sent to incorrect switch port
All,
I have multiple security monitoring devices that lose communication/connectivity on a regular basis throughout the week.
I have set up WireShark to monitor the network traffic going to/from one ...
1
vote
0
answers
178
views
Running tshark and find in parallel + strict time-sorted output
I'm trying to obtain debug output of
what "find" does
compared to what happens on the network (tshark)
Therefore I want to run these commands in parallel and have output meticulously ...
1
vote
0
answers
654
views
'socat' not displaying incoming UDP packets, but Wireshark does
The link is an image of a Wireshark dump of an incoming 60-byte Ethernet frame which contains a UDP packet. The packet payload is the single word 'hello' (sorry, I don't have enough rep to paste the ...
1
vote
0
answers
264
views
TLS 1.2 Failure
I am using Webinspect to scan sites. When going through Webinspect, I get "the client and server cannot communicate because they do not possess a common algorithm".
From the same system, ...
1
vote
0
answers
295
views
Sniffing packets over a wifi network, with or without monitor mode using wireshark
So, I am actually confused, there are some guides that say you can't just capture traffic on wireless LAN with promiscuous mode and you need to setup monitor mode, also enter the wifi password to be ...
1
vote
0
answers
986
views
TCP Window Size
Hoping someone can clarify a query I have in relation to TCP window size and whether it could be contributing to my slow throughput achieved via iPerf.
I took a Wireshark capture from a client while ...
1
vote
0
answers
434
views
Debugging port forwarding in Docker
Manager
I have a docker swarm setup on a mesh VPN. My manager is on 10.0.0.1. I have run:
docker swarm init --advertise-addr=wg0
which then uses the VPN IP to listen on 10.0.0.1 opposed to the ...
1
vote
0
answers
4k
views
How do i convert text capture files back to pcap files?
I have opened Wireshark, selected the a.pcap file, and then went to File->Export and chose (K12 text file) to convert to text. Result is a.txt file.
How can I convert back a.txt file to original pcap ...
1
vote
0
answers
37
views
the strange value of SRE in a D-SACK packet
I'm troubleshooting a strange network issue in our production environment.
The dumped pcap file comes from the full NAT mode LVS , and the toploy of the ip address in the dump file is:
172.19.132.90(...
1
vote
0
answers
2k
views
Wireshark running on Host OS not capturing packets from VM
I have Wireshark running on my laptop (Ubuntu 18.04), and I also have Wireshark running inside a VMware Workstation Player with a Backtrack 5 Kali Linux virtual machine image. The VM Network ...
1
vote
1
answer
593
views
rpcapd behind a firewall
I have a remote server with rpcapd installed that follows strict security policy rules. Any client can access to the server only via firewall that follows same security policy (please, don't blame me, ...
1
vote
1
answer
1k
views
How can I debug SSL traffic between nginx and an Apache backend with a pre-master key?
I am trying to troubleshoot 502 Bad Gateway errors logged by nginx (used as a load balancer) when communicating with our back-end Apache application servers. The nginx proxy_pass module is being used ...
1
vote
0
answers
714
views
RouterOS sending malformed packets
I have a Routerboard 951G-2HnD which runs latest stable:
RouterOS v6.50.5
Firmware v3.41
The board acts as the WiFi AP in WPA2-PSK mode. Recently I have noticed unhealthy amount of traffic sent from ...
1
vote
0
answers
90
views
Server won't return some requests to single ISP
I have a Linode server that won't return random GET requests to my usual ISP (but never gets stuck with the same one each time). If I switch ISP or use Opera VPN, all works well.
Linode says all ...
1
vote
0
answers
1k
views
TCP window scale mismatch between CentOS 7 and Windows 2012 R2
Having TCP client on CentOS 7 and TCP listener on Windows 2012 R2, I observed through wireshark, sysinternals procmon and ss -bitmonz command, that the tcp client wscale is 7 (scale factor 128) while ...
1
vote
0
answers
1k
views
How to capture http requests headers and body
need to capture all incoming/outcoming http traffic of a unix machine, and then run a script on each http header/body.
I have found that tcpdump captures all the requests, but big ones end up being ...
1
vote
0
answers
739
views
Traffic to and from mongodb using SSL is still visible in wireshark in plaintext
EDIT: There was nothing wrong. I was an idiot. The below settings are
correct.
I've set up an instance of mongodb (3.4) on windows, configured like this:
net:
port: 27017
ssl:
mode: ...
1
vote
0
answers
858
views
Wireshark not decrypting TLS packet
I am unable to understand why decryption does not work here.
Consider the scenario in this pcap file - https://drive.google.com/open?id=0Bz5corUPBatBWWpXTFYwWjdfS0k
I have a network setup such that
...
1
vote
0
answers
503
views
server stops sending SYN ACK after several normal connections
I have a few thousand devices behind a NAT talking to two servers. Each device is behind a local router (think modem/router), at which they get NATed to a private network that has thousands of these ...
1
vote
0
answers
845
views
NFS stuck in ack loop
I have a situation where one of three different NFS clients will break after a period of time (some number of days). I find that the broken host and server are continually sending 'ack' packets (to ...
1
vote
0
answers
3k
views
Wireshark decoding URL from M – SEARCH * HTTP/1.1
I am new to Wireshark and when I am running Wireshark it shows me the source address as the IP address but the destination address is 239.255.255.250 and at the info tab it shows M – SEARCH * HTTP/1.1....
1
vote
0
answers
2k
views
What is causing RST ACK in my connections?
75% of calls to a 3rd party API are getting dropped. When this happens is propagates up to my calling code as a The request was aborted: Could not create SSL/TLS secure channel error.
Here is a ...
1
vote
1
answer
2k
views
how can i setup tshark to capture full URL uri request ip and time stamp
How can I setup tshark to capture full URL uri request ip and time stamp.
I have tried this:
tshark -V -R "tcp.port ==80 && (http.request || http.response)" | awk "/Hypertext Transfer ...
1
vote
0
answers
496
views
Wireshark RST against TCP Zero Window
During application sharing with Microsoft Lync Client (Mac OS X), TCP ACK with RST flag is sent from my application end to Lync end against TCP Zero Window packets and call gets dropped.
Image Link.
...
1
vote
0
answers
305
views
Should I disable the Nagle Algorithm for Outlook / Exchange RPC/HTTP communication?
I'm investigating reasons why several Outlook clients in non-cached mode are having delays communicating... resulting in Outlook hanging.
My suspicion is that a Netscaler, or intermediate device (? ...
1
vote
0
answers
1k
views
How to find ACK for multiple segments using Wireshark?
I'm trying to use Wireshark to find a ACK (for TCP connections) send my the server which ACKs multiple segments as opposed to just ACKing 1 segment.
Is there a wireshark filter than can help me with ...
1
vote
1
answer
2k
views
server is not responding on SYN packets
On the attached tcp dump, the first two SYN packets (#21800 and 21801) came to the server, however SYN ACK was sent for the second SYN. Is that correct behaviour? My understanding is that the client ...
1
vote
1
answer
1k
views
Dumpcap on remote linux interface
I want to capture packets on a remote linux interface using dumpcap. I have observed that there is a command - dumpcap -i rpcap://<host>/<interface> and dumpcap -i TCP@<host>:<...
1
vote
0
answers
2k
views
FTP Connection Suddenly hanging on 'waiting for welcome message'
We've had our FTP server (Proftpd) running on Ubuntu Server 12.04 for over 12 months now with no connection issues. In the last few days there have been issues with slow connections to the server, ...
1
vote
0
answers
292
views
NFSv3 Asynchronous Write Depends on Block Size?
I am trying to figure out if my NFSv3 deployment is performing SAFE asynchronous writes. I suspect that it is doing strictly synchronous writes, as I am getting poor performance in general. I used ...
1
vote
1
answer
826
views
"tshark: There are no interfaces on which a capture can be done" in Amazon Linux AMI
My goal is to capture packets with tshark in Amazon Linux AMI. While typing tshark in the command line there's an error:
"tshark: There are no interfaces on which a capture can be done"
How to ...
1
vote
0
answers
166
views
UDP sends 6 additional packets in Wireshark
I am sending UDP packets using ttcp to another machine which is connected via a Cisco router. However, when I analyze the packets sent in Wireshark, there is a UDP packet sent before the payload ...