Wireshark is a open source Network Protocol Analyzer under GNU License.

learn more… | top users | synonyms

2
votes
1answer
191 views

How to block own rpcap traffic where tshark is running?

Platform :- Fedora 13 32-bit machine RemoteMachine$ ./rpcapd -n ClientMachine$ tshark -w "filename" -i "any interface name" As soon as capture starts without any capture filter, thousands of ...
1
vote
1answer
255 views

“tshark: There are no interfaces on which a capture can be done” in Amazon Linux AMI

My goal is to capture packets with tshark in Amazon Linux AMI. While typing tshark in the command line there's an error: "tshark: There are no interfaces on which a capture can be done" How to ...
1
vote
1answer
171 views

How can I measure the cumulative network usage of a process, from execution beginning to end

I want to measure how much bandwidth git pull uses, preferably by prefixing git command with desired program, i.e. nettally git pull Alternatively, is there some sneaky way to accumulate nethogs / ...
1
vote
1answer
133 views

centos6 - wireshark

1) Is there any easy way to install wireshark-1.8.3 on centos 6 ? I try the wget utility and i get the dependency on gtk..which inturn has dependency on glib, atk , pango and cairo.. 2) Looks like ...
1
vote
1answer
248 views

mysql logging activity from specific user or ip

I have mysql server. The server is accessed by my application, and by external auditor (person using mysql workbench). The auditor has specific user and password and dedicated IP and it is granted ...
1
vote
1answer
638 views

how to generate the graph in wireshark?

$ sudo tshark -i eth0 -R 'http.request.method == "GET"' "port 80" Running as user "root" and group "root". This could be dangerous. Capturing on eth0 5.641015 10.53.0.66 -> 209.85.143.104 HTTP ...
0
votes
1answer
47 views

server is not responding on SYN packets

On the attached tcp dump, the first two SYN packets (#21800 and 21801) came to the server, however SYN ACK was sent for the second SYN. Is that correct behaviour? My understanding is that the client ...
0
votes
1answer
103 views

Dumpcap on remote linux interface

I want to capture packets on a remote linux interface using dumpcap. I have observed that there is a command - dumpcap -i rpcap://<host>/<interface> and dumpcap -i ...
0
votes
1answer
183 views

user agent in http or https request

Is there any way that I can differentiate, the HTTP or HTTPS packets are coming from browser or not ? specially for https request.There is User-Agent field in packet in Http,but I could not found ...
0
votes
1answer
37 views

Is it possible to mimic the client of a https web service

There is such a windows application that communications with the server through https protocol, it is an auction tool and works only several hours per month. I have captured network packets (by ...
0
votes
1answer
23 views

Why am I seeing prefixed/duplicated packets coming from a comcast device?

I'm looking at traffic my CPE from Comcast in Wireshark, and for every packet, there is an additional packet that is the exact same, except for 4 additional bytes at the beginning of the frame ...
0
votes
1answer
315 views

SIP INVITE packet has WAN address rather than call manager LAN IP

I am using SIP between two subnets (192.168.3.0/24 and 192.168.30.0/24) each connected via VPN. I have a call server on 192.168.3.100, and two phones 192.168.30.118 (Ext. 3128) and 192.168.30.119 ...
0
votes
1answer
185 views

Wireshark seems to ignore my filters

I'm trying to make use of Wireshark 1.10.6 for Windows and I want to only capture the traffic to port 443 (to diagnose some weird HTTPS problems I'm having). So I open Capture -> Capture Filters... ...
0
votes
1answer
127 views

Network card capable of capturing a tonne of packets and not dropping them?

Edit: Our server is trying to capture packets at between 500-600Mb/s, but is dropping packets 'due to kernel'. Data is being written to SSDs, and isn't bottleneck there. What things should I look ...
3
votes
0answers
141 views

RTP analysis - Discerning ptime (packetization time) for a given VoIP packet capture

I would like some help on the subject of an automated way of discerning the average packetization time (ptime) of a VoIP call's packet capture. The reason I am not depending on the value in the SDP ...
2
votes
0answers
37 views

Difference between ping time and time for first ACK answer

While creating a packet performance monitor I come across the follow problem: if I ping a server, I get about 4ms. If I calculate the time between a POST and its first ACK, I get about 25us ...
2
votes
0answers
578 views

Troubleshooting Packet Loss on pfSense + Ubiquiti UniFi (Wireshark maybe?)

I'm dealing with an annoying situation in a small network in my church, which I'm the primary volunteer IT caretaker, of about 20 PCs, give-or-take. We're in Chattanooga, home of Gigabit internet, so ...
2
votes
0answers
111 views

replay decrypted ssl traffic with tcpreplay

I have an pcap format from some https traffic from one of my web-servers. So I can use the key from my webserver to decrypt the traffic in wireshark. The problem I'm now facing is that I can't get an ...
2
votes
0answers
2k views

Issue with Netgear GS108T Managed Switch and Jumbo Frames

I recently purchased a Netgear GS108T managed switch and I am trying to configure jumbo packets between my NAS (Thecus N4100Pro), PC and managed switch. I should mention the fact that I was able to ...
2
votes
0answers
541 views

Wireshark (WinPCap) does not see Intel X520-DA2 10 GbE NIC teaming intermittently

I am running a team of two 10 GigE ports on Intel X520-DA2 network card. They work well in tandem and achieve the desired throughput. However, I see an intermittent issue whereby WireShark and my ...
1
vote
0answers
544 views

Only capture HTTP post requests through tcpdump

For security purposes we want to list all POST requests URI's that are used in our applications (so we would disable POST through mod_security except for those URI's). The idea is to use tcpdump to ...
1
vote
0answers
376 views

FTP Connection Suddenly hanging on 'waiting for welcome message'

We've had our FTP server (Proftpd) running on Ubuntu Server 12.04 for over 12 months now with no connection issues. In the last few days there have been issues with slow connections to the server, ...
1
vote
0answers
152 views

Can I use tshark to write SSL-decrypted packets to a file?

I have a PCAP file containing SSL-encrypted HTTP traffic and the private key from the relevant web server. I'd like a PCAP file that contains the decrypted HTTP traffic to feed into a different tool. ...
1
vote
0answers
125 views

NFSv3 Asynchronous Write Depends on Block Size?

I am trying to figure out if my NFSv3 deployment is performing SAFE asynchronous writes. I suspect that it is doing strictly synchronous writes, as I am getting poor performance in general. I used ...
1
vote
0answers
89 views

UDP sends 6 additional packets in Wireshark

I am sending UDP packets using ttcp to another machine which is connected via a Cisco router. However, when I analyze the packets sent in Wireshark, there is a UDP packet sent before the payload ...
1
vote
0answers
227 views

tshark not recognizing wpa psk option

I'm trying to decrypt captured wpa-psk traffic with tshark, but it's not recognizing the option I'm trying to override. This option allows me to specify a PSK to use for decrypting. I'm using tshark ...
1
vote
0answers
117 views

Website latency and bad tcp packets

I have multiple websites hosted on a Linode VPS and I'm having an issue with one of them: every page that I try to load has about 10 seconds latency. Apache logs are clean and the other websites on ...
1
vote
0answers
80 views

Divert TCP connection

I am trying to divert a TCP connection. Given a client (C) which is connected to a router R and two servers (S1 and S2) are connected to the router, C initially connects to S1. I am trying to write an ...
1
vote
0answers
322 views

Creating keytab for computer account to decrypt packet capture

We are having an issue with our blackberry server (EWSTest fails at autodiscover lookup) and I am running a packet capture with Wireshark in an attempt to diagnose the issue. There is a conversation ...
1
vote
0answers
113 views

Why adding capture filters breaks the traffic dump in wireshark / windump?

I have a strange issue while trying to capture RTP (UDP) traffic. I have a phone using IP 192.168.9.4 and a Windows 2003 PC connected to the same switch (actually to the monitor port of the switch - ...
1
vote
0answers
267 views

Wireshark like app for embeded Windows CE

Greetings Im looking for a standalone wireshark like app that I can run on a embedded Windows CE device in order to debug some network issues. Is anyone aware of such a thing. I know version 5 has ...
0
votes
0answers
20 views

Remote packet capturing using fifo and dumpcap

I'm currently working on two linux servers where one server is running in 2.6.18-274.el5(Server A) and the second one in CentOS 7 (Server B). My requirement is to capture the packets of the network ...
0
votes
0answers
18 views

Wiresharking access to AWS to debug permission problems

I have a plugin which pushes files to S3. It's not my plugin and auditing what exactly it does has proved difficult. I'm trying to enable access logging on the bucket to figure out what exactly is ...
0
votes
0answers
40 views

Unknown device showing up in network scan

I need some help finding a device that has been showing up whenever I scan my network using Spiceworks' "Inventory" scan. I can ping the device, but nslookup returns a non-existent domain, and ...
0
votes
0answers
41 views

Expanding HAProxy health check to monitor MongoDB primary and secondary state

Follow up question regarding the MongoDB health check with HAProxy How to construct a MongoDB Health Check in HAProxy? The current solution works well when the focus is on determining if mongo ...
0
votes
0answers
201 views

tcp connection reset [RST, ACK]

getting this errors looks like server is restating the connection because of some packet loss any possible suggestion's to figure out this 37713 591.925575000 ...
0
votes
0answers
56 views

What conditions can account for incorrect inbound TCP checksums?

According to The Wireshark FAQ TCP checksum offloading causes checksums for outbound traffic to be calculated incorrectly. On some Linux hosts I see some inbound TCP traffic that is flagged with ...
0
votes
0answers
92 views

Installing Wireshark 1.6 on CentOS 5.7

I want to install wireshark version which is higher than 1.2 since I need to analyse the iec104 packets (only version higher than 1.2 supports this). I am using CentOS 5.7 version and it only supports ...
0
votes
0answers
32 views

How to meet the arp table and the network toology with wireshark

I'm wondering if is possible meet(see) the arp table in a network traffic with wireshark or find some way to build manually the arp table, and how to see the router and swiches of topology( for ...
0
votes
0answers
40 views

upnp keep alive packet

I took a wireshark packet dump and Iam able to track the initial MSEARCH, SSDP out message to multicast IP etc., from my-device. but how do I see the incoming keep alive message from the other-device ...
0
votes
0answers
114 views

Wireshark: fully customized output from TShark?

I'm using TShark to analyze some packet capture logs and would like to produce some nice lists from the logs. I want the lists to be in text format, so they could be viewed/printed/etc. easily on ...
0
votes
0answers
46 views

Early tear down of communication

I have an application which performs an LDAP search which works in one domain but not in the other, when analyzing the packets sent between the application server and the domain controller being ...
0
votes
0answers
89 views

Why am I getting ICMP traffic with wireshark DNS filter?

I am surfing the web and looking at dns traffic in wireshark with the "dns" filter active. When I ask for a non existant domain or subdomain I get a Destination Unreachable (Port Unreachable message). ...
0
votes
0answers
72 views

wireshark not showing netflow source addresses nfdump does

Hi guys i'm experiencing following issue, hope someone can explain me what's happening. I got a pcap with a dump of udp packets containing netflow data. I've used tcprewrite and tcpreplay to ...
0
votes
0answers
160 views

Wireshark - view complete packet

I am trying to use Wireshark to capture some HTTP packets, but when the packet is too long, Wireshark truncates it in its window. The bottom window still shows the entire packet, but I am not able to ...
0
votes
0answers
92 views

ZyXel ES-2024 - Mirrored port showing duplicated traffic

I have a ZyXel ES-2024 PWD switch. I would like a computer plugged into port 26 to see all traffic that passes through port 2, both inbound and outbound. I have configured port mirroring for the ...
0
votes
0answers
938 views

Window Size goes to zero

We are seeing an issue with our web servers where a client is doing a HTTP POST and sending xml files. We are seeing weird behavior where we are sometimes only receiving part of the data. (Sometimes ...
0
votes
0answers
215 views

Apache logs or tcpdump slow loris

i know about the question : How can I detect Slowloris? but that does not apply. Now i have a big server that receives more then 10.000 events on the IDS per each 10 minutes, and i have suffered in ...
0
votes
0answers
1k views

NetGroup Packet Filter Driver isn't installed with WinPcap on Windows Server 2008 R2 64bit

I'm running Windows Server 2008 R2, 64 bit on a Virtual Server. There I want to install Wireshark to capture some of my network traffic for debugging purpose. During installation of Wireshark and ...
0
votes
0answers
602 views

How to interpret findings on TCP Send/Recv Buffers

I have an application running on a CentOS machine that connects to a remote DB server on another CentOS machine. Every once in a while, without any discernable warning signs, the application seems to ...