Wireshark is a open source Network Protocol Analyzer under GNU License.

learn more… | top users | synonyms

2
votes
1answer
292 views

How to block own rpcap traffic where tshark is running?

Platform :- Fedora 13 32-bit machine RemoteMachine$ ./rpcapd -n ClientMachine$ tshark -w "filename" -i "any interface name" As soon as capture starts without any capture filter, thousands of ...
2
votes
1answer
2k views

IP Conflicts from mikrotik router for multiple ip addresses (that it isnt assigned)

I have a point to point wireless connection using two mikrotiks. When I plug the mikrotik into a switch with just my laptop I get an IP address conflict on my machine no matter what IP I am assigned. ...
1
vote
1answer
68 views

Multiple syn's packets before handshake?

I have a scenario, I'm analyzing ssl (decrpyt) traffic to my webserver. I'm investigating server and end-to-end delay issues. In between this I'm stuck at following traffic pattern for which I need ...
1
vote
1answer
784 views

How to decode traffic as NTLM protocol in Wireshark?

I'm trying to debug NTLM authentication issue. One of my ideas was to capture the network traffic and look thougth it. In my case NTLM authentication is going over non-stardart port (6901). Of course, ...
4
votes
0answers
1k views

Troubleshooting Packet Loss on pfSense + Ubiquiti UniFi (Wireshark maybe?)

I'm dealing with an annoying situation in a small network in my church, which I'm the primary volunteer IT caretaker, of about 20 PCs, give-or-take. We're in Chattanooga, home of Gigabit internet, so ...
4
votes
0answers
219 views

RTP analysis - Discerning ptime (packetization time) for a given VoIP packet capture

I would like some help on the subject of an automated way of discerning the average packetization time (ptime) of a VoIP call's packet capture. The reason I am not depending on the value in the SDP ...
2
votes
0answers
24 views

is the disconnection caused by too many TCP Dup Ack?

I am investigating a service disconnection issue and I am a bit confused by some of the Wireshark logs. Need some help to find out how the disconnection was caused. Ideally when A sends an ACK to B ...
2
votes
0answers
102 views

Difference between ping time and time for first ACK answer

While creating a packet performance monitor I come across the follow problem: if I ping a server, I get about 4ms. If I calculate the time between a POST and its first ACK, I get about 25us ...
2
votes
0answers
174 views

replay decrypted ssl traffic with tcpreplay

I have an pcap format from some https traffic from one of my web-servers. So I can use the key from my webserver to decrypt the traffic in wireshark. The problem I'm now facing is that I can't get an ...
2
votes
0answers
2k views

Issue with Netgear GS108T Managed Switch and Jumbo Frames

I recently purchased a Netgear GS108T managed switch and I am trying to configure jumbo packets between my NAS (Thecus N4100Pro), PC and managed switch. I should mention the fact that I was able to ...
2
votes
0answers
643 views

Wireshark (WinPCap) does not see Intel X520-DA2 10 GbE NIC teaming intermittently

I am running a team of two 10 GigE ports on Intel X520-DA2 network card. They work well in tandem and achieve the desired throughput. However, I see an intermittent issue whereby WireShark and my ...
1
vote
0answers
15 views

how can i setup tshark to capture full URL uri request ip and time stamp

How can I setup tshark to capture full URL uri request ip and time stamp. I have tried this: tshark -V -R "tcp.port ==80 && (http.request || http.response)" | awk "/Hypertext Transfer ...
1
vote
0answers
38 views

Packet capture on ESXi host

I have an issue I am trying to track down and I believe the problem is with physical networking hardware. I have read the VMWare documentation on the pktcap-uw command and I know I can use it to dump ...
1
vote
0answers
71 views

Wireshark RST against TCP Zero Window

During application sharing with Microsoft Lync Client (Mac OS X), TCP ACK with RST flag is sent from my application end to Lync end against TCP Zero Window packets and call gets dropped. Image Link. ...
1
vote
0answers
144 views

How to efficiently re-order packets in PCAP files based on timestamp?

I have a PCAP file which contains many packets. They are however out of order based on the timestamp (it is actually randomized). What is the best way to efficiently sort the PCAP packets based on ...
1
vote
0answers
71 views

Should I disable the Nagle Algorithm for Outlook / Exchange RPC/HTTP communication?

I'm investigating reasons why several Outlook clients in non-cached mode are having delays communicating... resulting in Outlook hanging. My suspicion is that a Netscaler, or intermediate device (? ...
1
vote
0answers
86 views

How to find ACK for multiple segments using Wireshark?

I'm trying to use Wireshark to find a ACK (for TCP connections) send my the server which ACKs multiple segments as opposed to just ACKing 1 segment. Is there a wireshark filter than can help me with ...
1
vote
0answers
556 views

tcp connection reset [RST, ACK]

getting this errors looks like server is restating the connection because of some packet loss any possible suggestion's to figure out this 37713 591.925575000 ...
1
vote
0answers
2k views

Only capture HTTP post requests through tcpdump

For security purposes we want to list all POST requests URI's that are used in our applications (so we would disable POST through mod_security except for those URI's). The idea is to use tcpdump to ...
1
vote
0answers
710 views

FTP Connection Suddenly hanging on 'waiting for welcome message'

We've had our FTP server (Proftpd) running on Ubuntu Server 12.04 for over 12 months now with no connection issues. In the last few days there have been issues with slow connections to the server, ...
1
vote
0answers
304 views

Can I use tshark to write SSL-decrypted packets to a file?

I have a PCAP file containing SSL-encrypted HTTP traffic and the private key from the relevant web server. I'd like a PCAP file that contains the decrypted HTTP traffic to feed into a different tool. ...
1
vote
0answers
152 views

NFSv3 Asynchronous Write Depends on Block Size?

I am trying to figure out if my NFSv3 deployment is performing SAFE asynchronous writes. I suspect that it is doing strictly synchronous writes, as I am getting poor performance in general. I used ...
1
vote
0answers
102 views

UDP sends 6 additional packets in Wireshark

I am sending UDP packets using ttcp to another machine which is connected via a Cisco router. However, when I analyze the packets sent in Wireshark, there is a UDP packet sent before the payload ...
1
vote
0answers
125 views

Website latency and bad tcp packets

I have multiple websites hosted on a Linode VPS and I'm having an issue with one of them: every page that I try to load has about 10 seconds latency. Apache logs are clean and the other websites on ...
1
vote
0answers
89 views

Divert TCP connection

I am trying to divert a TCP connection. Given a client (C) which is connected to a router R and two servers (S1 and S2) are connected to the router, C initially connects to S1. I am trying to write an ...
1
vote
0answers
396 views

Creating keytab for computer account to decrypt packet capture

We are having an issue with our blackberry server (EWSTest fails at autodiscover lookup) and I am running a packet capture with Wireshark in an attempt to diagnose the issue. There is a conversation ...
1
vote
0answers
121 views

Why adding capture filters breaks the traffic dump in wireshark / windump?

I have a strange issue while trying to capture RTP (UDP) traffic. I have a phone using IP 192.168.9.4 and a Windows 2003 PC connected to the same switch (actually to the monitor port of the switch - ...
1
vote
0answers
308 views

Wireshark like app for embeded Windows CE

Greetings Im looking for a standalone wireshark like app that I can run on a embedded Windows CE device in order to debug some network issues. Is anyone aware of such a thing. I know version 5 has ...
0
votes
0answers
16 views

Analyzing SSL Encryption Alerts

I have captured the traffic between my machine and my server using Wireshark, trying to find why some SSL requests fail. I've read this and this post about debugging SSL entries, and I'm able to find ...
0
votes
0answers
31 views

Wireshark doesn't filter correctly http.host

When trying to filter for a specific host with http.host=="abc.com" it shows me everything instead of only the related packets. What am I doing wrong? Wireshark 1.12.6
0
votes
0answers
38 views

Error decrypting SSL traffic in Wireshark

I am trying to decrypt an SSL connection using Wireshark. It doesn't use DH, so I understand it should be possible to decrypt using the private key (which I have.) The following log shows the error. ...
0
votes
0answers
105 views

http cookie contains datr not working (none packets is returned) wireshark

When I filter in wireshark: http.cookie contains datr none packets is returned, the list in null. What's I going wrong?
0
votes
0answers
26 views

Is the output complete after omitting [TCP segment of reassembled PDU]?

If the tshark -r dumpfile output contains the type [TCP segment of a reassembled PDU], as in 81 3.164109000 4.5.6.7 -> 12.13.14.15 TLSv1.2 609 Application Data 83 3.164523000 4.5.6.7 -> ...
0
votes
0answers
13 views

(Windows Media Encoder) TCP connection randomly fails/succeeds

We have a windows media server running and are pushing a stream using Windows Media Encoder 9 software on the client. Sometimes, it can't connect to the server and sometimes it can. I ran wireshark ...
0
votes
0answers
84 views

TCP Out-of-order packets over GRE causing disconnect

I'm experiencing an issue with a small percentage of TCP connections over a GRE tunnel between two servers. The topology is basically Internet <-> GRE Tunnel <-> Backend The GRE tunnel and the ...
0
votes
0answers
31 views

after 487 Requst terminated there is no ACK

We have a weird problem. After a non successfull call (like a very long number and such), the phone (Yealink-any) gets "call time out" and then loses it registration. I ran wireshark and noticed that ...
0
votes
0answers
70 views

Using I/O graph how to interept bytes/tick against packet details information?

I'm working on a trace-file which has reported ISP throttling occurrences in it. My task is to use IO graph to understand at what point in time the throttling process effected client upload ...
0
votes
0answers
35 views

Too Many HTTP Requests from one source

We are having an issue at one of our customer sites where Tripwire is flagging events when more than 1000 HTTP connections are being created from one IP address within a span of one minute. We have ...
0
votes
0answers
91 views

Remote packet capturing using fifo and dumpcap

I'm currently working on two linux servers where one server is running in 2.6.18-274.el5(Server A) and the second one in CentOS 7 (Server B). My requirement is to capture the packets of the network ...
0
votes
0answers
52 views

Wiresharking access to AWS to debug permission problems

I have a plugin which pushes files to S3. It's not my plugin and auditing what exactly it does has proved difficult. I'm trying to enable access logging on the bucket to figure out what exactly is ...
0
votes
0answers
167 views

Unknown device showing up in network scan

I need some help finding a device that has been showing up whenever I scan my network using Spiceworks' "Inventory" scan. I can ping the device, but nslookup returns a non-existent domain, and ...
0
votes
0answers
391 views

Expanding HAProxy health check to monitor MongoDB primary and secondary state

Follow up question regarding the MongoDB health check with HAProxy How to construct a MongoDB Health Check in HAProxy? The current solution works well when the focus is on determining if mongo ...
0
votes
0answers
117 views

What conditions can account for incorrect inbound TCP checksums?

According to The Wireshark FAQ TCP checksum offloading causes checksums for outbound traffic to be calculated incorrectly. On some Linux hosts I see some inbound TCP traffic that is flagged with ...
0
votes
0answers
153 views

Installing Wireshark 1.6 on CentOS 5.7

I want to install wireshark version which is higher than 1.2 since I need to analyse the iec104 packets (only version higher than 1.2 supports this). I am using CentOS 5.7 version and it only supports ...
0
votes
0answers
85 views

Early tear down of communication

I have an application which performs an LDAP search which works in one domain but not in the other, when analyzing the packets sent between the application server and the domain controller being ...
0
votes
0answers
139 views

ZyXel ES-2024 - Mirrored port showing duplicated traffic

I have a ZyXel ES-2024 PWD switch. I would like a computer plugged into port 26 to see all traffic that passes through port 2, both inbound and outbound. I have configured port mirroring for the ...
0
votes
0answers
1k views

Window Size goes to zero

We are seeing an issue with our web servers where a client is doing a HTTP POST and sending xml files. We are seeing weird behavior where we are sometimes only receiving part of the data. (Sometimes ...
0
votes
0answers
282 views

Apache logs or tcpdump slow loris

i know about the question : How can I detect Slowloris? but that does not apply. Now i have a big server that receives more then 10.000 events on the IDS per each 10 minutes, and i have suffered in ...
0
votes
0answers
2k views

NetGroup Packet Filter Driver isn't installed with WinPcap on Windows Server 2008 R2 64bit

I'm running Windows Server 2008 R2, 64 bit on a Virtual Server. There I want to install Wireshark to capture some of my network traffic for debugging purpose. During installation of Wireshark and ...
0
votes
0answers
1k views

How to interpret findings on TCP Send/Recv Buffers

I have an application running on a CentOS machine that connects to a remote DB server on another CentOS machine. Every once in a while, without any discernable warning signs, the application seems to ...