Wireshark is a open source Network Protocol Analyzer under GNU License.

learn more… | top users | synonyms

31
votes
3answers
2k views

ISP broadcasting all IP-packets, so I can see traffic of other clients from ISP

Recently I wondered why my router shows a constant downstream of 5 MBit/s, while I am downloading almost no data. I discovered the "packet logging" function of my router, with which I was able to log ...
16
votes
3answers
58k views

How to filter http traffic in Wireshark?

I suspect my server has a huge load of http requests from its clients. I want to measure the volume of http traffic. How can I do it with Wireshark? Or probably there is an alternative solution using ...
15
votes
4answers
5k views

Change protocol associated with port in wireshark

I'm trying to monitor some web traffic using wireshark. Our web proxy is on port 9191. How can I get the wireshark view to treat port 9191 just like port 80 - ie as HTTP. Just using Decode_As on the ...
13
votes
4answers
22k views

Is there a way to get wireshark to capture packets sent from/to localhost on Windows?

Is there a way to get wireshark to capture packets sent from/to localhost? When I monitor traffic going from my computer to another, or from another computer to my computer, then it works. But ...
12
votes
2answers
21k views

How to make wireshark filter POST-requests only?

How to make wireshark filter POST-requests only?
11
votes
3answers
18k views

How can I filter https when monitoring traffic with Wireshark?

I want to observe the HTTPs protocol. How can I use a Wireshark filter to do that?
9
votes
4answers
48k views

What causes duplicate ACK records?

We're reviewing Wireshark captures from a few client machines that are showing multiple duplicate ACK records which then triggers retransmit and out-of-sequence packets. These are shown in the ...
8
votes
4answers
12k views

Can Wireshark read data being sent to/from other computers?

Let's say WireShark is installed on computer A. And let's say I am looking at a Youtube video on the computer B. Can WireShark see what computer B is doing?
8
votes
4answers
22k views

How do i convert wireshark capture files to text files?

How can I convert wirshark captures (.cap) files to text files or some format from which I can read the file and parse its contents ? Regards, Mithun
7
votes
2answers
2k views

tcpdump: snaplen set to 0 but still get “Packet size limited during capture”?

Due to this problem, I'm going to sniff some packets on the MySQL server backend to see what happens: # tcpdump -vv -s0 -c 100 -i bond0 tcp port 3306 and host 192.168.3.87 -w ...
6
votes
2answers
5k views

Stopping the WinPcap Packet capture service

I just installed WireShark, which also installed WinPcap. During the installation it said "do you want xxx to start automatically", which I answered yes. Now I would like to stop the service when I ...
6
votes
2answers
8k views

No interface available for Wireshark running on Ubuntu with wireless connection

I'm completely new to wireshark. I have Ubuntu on a Dell with wireless connection. When I go to Wireshark Capture Option, I cannot select any interface since no interface is listed. What is the ...
5
votes
2answers
3k views

Why my laptop sends ARP request to itself?

I have just started to learn about protocols. While studying the packets in wireshark, I came across a ARP request sent by my machine to my own IP. Here is the details of the packet : No. Time ...
5
votes
3answers
9k views

How do I install Wireshark in Red Hat Linux?

How do I install Wireshark in Red Hat Linux? At the Wireshark download page, am I supposed to download "Standard package" for Red Hat under "Third-Party Package"? Does the Red Hat version have a ...
5
votes
2answers
373 views

Is it possible for Wireshark to drop packets purposely?

I would like to test something like VoIP. I would like to test with some "artificial packet loss". Is Wireshark able to do this? Or is there any good solutions?
5
votes
1answer
1k views

tcpdump filter for tcp zero window messages

Is there a pcap filter for TCPDump that will allow be to filter zero window messages? I know how to filter these in a wireshark display filter (tcp.analysis.zero_window) but the amount of data I ...
5
votes
2answers
8k views

How can I search the info column in WireShark?

WireShark | Windows I want to search a packet capture of SMTP traffic for specific addresses/messages. Normally, I just sort the info column and browse but it would be nice if I could just run a ...
5
votes
1answer
1k views

Client not getting address from some DHCP server

I'm working on some embedded devices which should be connected to a large network (hundreds of devices) via ethernet and that should be configured using the DHCP protocol. What I'm experiencing is ...
5
votes
4answers
1k views

Capturing multicast data with Wireshark with IGMP Snooping Enabled at the switch

I am trying to capture multicast traffic via Wireshark (actually TShark), however the switch has IGMP snooping enabled and will only send Multicast traffic on the ports that have an active IGMP ...
5
votes
2answers
1k views

How to decrypt IKVe2 in Wireshark using StrongSwan log info?

Wireshark has the ability to decrypt IKEv2, if you do Preferences, select ISAKMP, it offers an IKEv2 decrypt table which wants the initiator's and responder's SPIs, the encryption and authentication ...
5
votes
3answers
236 views

What causes a switch port to receive data not destined for it?

We are having an intermittent fault which is effecting one of our control systems on one of our HP Procurve switches. For some reason, this PLC (10mbit port - 192.168.6.56) which is attached directly ...
4
votes
6answers
2k views

Does Wireshark pose a threat when installed on a server in the DMZ?

If you install wireshark on a web server sitting in the DMZ, is there a hack that can be used to get backdoor entrace to that server even when RDP is disblaed? I'm trying to monitor the wire on the ...
4
votes
4answers
10k views

How can I sniff the traffic of remote machine with wireshark?

I can sniff the traffic of my local pc but I would like to know how to I sniff the traffic of a remote machine by wireshark? When in capture option I select remote interface and enter my remote ip ...
4
votes
3answers
422 views

determining what ports a program uses

I'm trying to use wireshark to determine what ports a certain program uses. The program connects to the server fine if we are on the same network, but I obviously need to forward the ports on the ...
4
votes
4answers
8k views

How to use sniffer to troubleshoot SMTP traffic?

We're having an issue where we are no longer receiving external emails. (We have an Exchange mail system, with a Barracuda spam filter and Watchguard hardware firewall.) The problem is that mail ...
4
votes
3answers
913 views

Wireshark running on a server seeing lots of `ARP who has` with different tells

We're seeing some suspicious network activity, and when I was trying to see if it was one particular server of ours I ran a Wireshark trace. I noted a lot of ARP packets asking who has x.x.x.x, but ...
4
votes
1answer
474 views

how to view hostnames in traffic entering my webserver (Apache)?

Is there any way I can view the hostnames used by incoming traffic that is accepted by my apache webserver? For example, say the webserver is set up to process incoming traffic for an IP address, ...
4
votes
1answer
5k views

Why does WireShark think this frame is a TCP segment of a reassembled PDU

Please find a small pcap file here illustrating my problem. I have a three-way TCP handshake, followed by two FIX logons. (FIX is a protocol used in trading.) The first FIX logon (frame 4) is ...
4
votes
1answer
1k views

Can WireShark detect Ethernet PAUSE packets on network when running on Windows?

We have a Windows server which is connected to a switch processing a large quantity of data. We noticed that when we disabled FlowControl on the network adapter, that it appeared that we were getting ...
4
votes
1answer
8k views

Wireshark Display Filter protocol==TLSV1? (and PacketLength)

What would the filter expression be to just select the protocols where the protocol = TLSV1? Something obvious like protocol == "TLSV1" or TCP.protocol == "TLSV1" is apparently not the right way. ...
4
votes
4answers
2k views

Wireshark and IPSec

I am trying to troubleshoot communication between two servers on a Windows network where IPSEC is encrypting everything. I installed wireshark on the source server and captured traffic at the point ...
4
votes
2answers
6k views

Best way to analyze pcap files from Wireshark?

I've got 50-100MB pcap files captured from Wireshark and need to analyze where most of the traffic is going to/coming from. What's the best way of doing this? Ideally I'd like to end up with an ...
4
votes
5answers
4k views

Parse HTTP requests through Wireshark?

Is there any way to parse HTTP request data in wireshark? For example, can I expose the request parameters upon an HTTP GET request (being sent by my machine), so that I don't need to read the ...
4
votes
2answers
1k views

Saving Wireshark capture settings for future use

Is there any way to save Wireshark capture options? So it can be reuse after restart Wireshark. Also, if the saved file is in plain text, it's possible to use scripts generating bunch of capture ...
4
votes
2answers
1k views

syn/ack sequence number confusion

I was looking at some random traffic in wireshark and came across this (using relative seq/ack numbers): 1. myIP -> 74.125.227.96 [SYN] seq=0 2. 74.125.227.96 -> myIP ...
3
votes
4answers
5k views

Wireshark filter to only capture Incoming Packets?

I am trying to setup a Filter (so my log files aren't massive) that will capture only incoming traffic. I have looked on http://wiki.wireshark.org/CaptureFilters but so far have been unable to find a ...
3
votes
5answers
7k views

How to capture Wireshark packets when using a switched network in Windows

I’ve been asked by our SIP trunk provider to run a Wireshark trace on the network when we receive calls. The issue I’m having is that if I run Wireshark from a laptop plugged into the main switch I ...
3
votes
5answers
2k views

Is it safe to run Wireshark on a production IIS7 server? Is there a good alternative?

We host a bunch of ASP.NET sites on an IIS7 server. Occasionally, we'd like to be able to log HTTP POST data to troubleshoot problems. IIS lets us log the query string, but not the POST data - at ...
3
votes
1answer
1k views

Wireshark arp packets

In wireshark, after capturing some arp packets, what is the significance of all 1's in the destination field. of an Ethernet II frame?
3
votes
2answers
203 views

What are cables/boxes called for listening in on a RJ45 cable?

I would like to capture the traffic from a router, so I assume there must exist a cable or hardware box with 3 RJ45 socks, where two of them are IN and OUT, and the third is for capturing device (a ...
3
votes
2answers
1k views

Silently start Wireshark

I have a computer in our office that always gets infected by viruses. Because of this, I would like to use Wireshark (or at least something) to monitor internet traffic for a while on this machine. ...
3
votes
3answers
7k views

Sniffing the Vmware vmnet1 network with Wireshark

I have a virtual machine deployed in vmware fusion which is communicating with the host over the interface vmnet1. Unfortunately, wireshark does not offer me to to listen on that interface. Is there ...
3
votes
2answers
815 views

How to use Linux to capture packets on eth0 and send everything to eth1?

Today I got an enterprise Internet connection together with a Sagemcom router. The first time it is connected to the Internet, it will spend 20 minutes upgrading the firmware. I would really like to ...
3
votes
1answer
211 views

How Wireshark could read data from other ips

When I open wireshark I could see the packets send by machines other than mine. How could its possible? Example 8252 99.150192 somoeneip 239.255.255.250 SSDP NOTIFY * HTTP/1.1 8253 ...
3
votes
1answer
466 views

SSL Packet inspection on Linux

I'm trying to build a web client for an HTTPS website. I think I've done everything right, yet obviously I get a different result in the browser than with my crawler. As far as I understand, there is ...
3
votes
3answers
10k views

wireshark http POST

I would like to have a http POST request method CAPTURE filter. I know it is easy to do it by display filter http.request.method==POST but I need tcpdump compatible. I wrote tcp dst port 80 and ...
3
votes
2answers
10k views

With wireshark how can I filter by packet size?

I can filter for packet lengths using a display filter containing data.len >= XXX, but I'd really like to use a capture filter for this for efficiency... is there a way to do it?
3
votes
3answers
9k views

How can I configure Wireshark to list my dial up connection as a possible capture interface?

I am trying to monitor traffic coming into to my machine via an incoming dialup connection. I am using Wireshark with WinPCap 3.1 ( I rolled back to 3.1 from 4.0 because I read that this was the ...
3
votes
3answers
822 views

Sniff packets which have source address other than my machine

I tried sniffing network traffic between 2 ip addresses. One is a HTTP server and other is the client accessing that site. My aim is to sniff POST method form data. How do i do that? When i tried ...
3
votes
3answers
1k views

TCP segments of an HTTP Request in wrong order

My web-services server sometimes does not receive correct HTTP requests and returns "500 - Internal Server Error". Using tcpdump and Wireshark on the server, I found out that HTTP requests are ...