Wireshark is a open source Network Protocol Analyzer under GNU License.
12
votes
4answers
20k views
Is there a way to get wireshark to capture packets sent from/to localhost on Windows?
Is there a way to get wireshark to capture packets sent from/to localhost?
When I monitor traffic going from my computer to another, or from another computer to my computer, then it works. But ...
12
votes
3answers
4k views
Change protocol associated with port in wireshark
I'm trying to monitor some web traffic using wireshark. Our web proxy is on port 9191. How can I get the wireshark view to treat port 9191 just like port 80 - ie as HTTP.
Just using Decode_As on the ...
10
votes
4answers
34k views
How to filter http traffic in Wireshark?
I suspect my server has a huge load of http requests from its clients.
I want to measure the volume of http traffic.
How can I do it with Wireshark?
Or probably there is an alternative solution using ...
8
votes
4answers
10k views
Can Wireshark read data being sent to/from other computers?
Let's say WireShark is installed on computer A. And let's say I am looking at a Youtube video on the computer B.
Can WireShark see what computer B is doing?
7
votes
2answers
867 views
tcpdump: snaplen set to 0 but still get “Packet size limited during capture”?
Due to this problem, I'm going to sniff some packets on the MySQL server backend to see what happens:
# tcpdump -vv -s0 -c 100 -i bond0 tcp port 3306 and host 192.168.3.87 -w ...
6
votes
2answers
7k views
How can I filter https when monitoring traffic with Wireshark?
I want to observe the HTTPs protocol. How can I use a Wireshark filter to do that?
6
votes
3answers
14k views
How do i convert wireshark capture files to text files?
How can I convert wirshark captures (.cap) files to text files or some format from which I can read the file and parse its contents ?
Regards,
Mithun
6
votes
1answer
8k views
No interface available for Wireshark running on Ubuntu with wireless connection
I'm completely new to wireshark.
I have Ubuntu on a Dell with wireless connection.
When I go to Wireshark Capture Option, I cannot select any interface since no interface is listed.
What is the ...
5
votes
4answers
25k views
What causes duplicate ACK records?
We're reviewing Wireshark captures from a few client machines that are showing multiple duplicate ACK records which then triggers retransmit and out-of-sequence packets.
These are shown in the ...
5
votes
2answers
223 views
Is it possible for Wireshark to drop packets purposely?
I would like to test something like VoIP. I would like to test with some "artificial packet loss". Is Wireshark able to do this? Or is there any good solutions?
5
votes
2answers
5k views
How can I search the info column in WireShark?
WireShark | Windows
I want to search a packet capture of SMTP traffic for specific addresses/messages. Normally, I just sort the info column and browse but it would be nice if I could just run a ...
5
votes
1answer
554 views
Client not getting address from some DHCP server
I'm working on some embedded devices which should be connected to a large network (hundreds of devices) via ethernet and that should be configured using the DHCP protocol. What I'm experiencing is ...
5
votes
2answers
211 views
How to decrypt IKVe2 in Wireshark using StrongSwan log info?
Wireshark has the ability to decrypt IKEv2, if you do Preferences, select ISAKMP, it offers an IKEv2 decrypt table which wants the initiator's and responder's SPIs, the encryption and authentication ...
5
votes
3answers
164 views
What causes a switch port to receive data not destined for it?
We are having an intermittent fault which is effecting one of our control systems on one of our HP Procurve switches.
For some reason, this PLC (10mbit port - 192.168.6.56) which is attached directly ...
4
votes
6answers
1k views
Does Wireshark pose a threat when installed on a server in the DMZ?
If you install wireshark on a web server sitting in the DMZ, is there a hack that can be used to get backdoor entrace to that server even when RDP is disblaed? I'm trying to monitor the wire on the ...
4
votes
2answers
2k views
Why my laptop sends ARP request to itself?
I have just started to learn about protocols. While studying the packets in wireshark, I came across a ARP request sent by my machine to my own IP. Here is the details of the packet :
No. Time ...
4
votes
2answers
7k views
4
votes
3answers
336 views
determining what ports a program uses
I'm trying to use wireshark to determine what ports a certain program uses. The program connects to the server fine if we are on the same network, but I obviously need to forward the ports on the ...
4
votes
4answers
5k views
How to use sniffer to troubleshoot SMTP traffic?
We're having an issue where we are no longer receiving external emails. (We have an Exchange mail system, with a Barracuda spam filter and Watchguard hardware firewall.) The problem is that mail ...
4
votes
1answer
342 views
how to view hostnames in traffic entering my webserver (Apache)?
Is there any way I can view the hostnames used by incoming traffic that is accepted by my apache webserver?
For example, say the webserver is set up to process incoming traffic for an IP address, ...
4
votes
4answers
2k views
Wireshark and IPSec
I am trying to troubleshoot communication between two servers on a Windows network where IPSEC is encrypting everything. I installed wireshark on the source server and captured traffic at the point ...
4
votes
2answers
904 views
Saving Wireshark capture settings for future use
Is there any way to save Wireshark capture options? So it can be reuse after restart Wireshark. Also, if the saved file is in plain text, it's possible to use scripts generating bunch of capture ...
4
votes
2answers
889 views
Capturing multicast data with Wireshark with IGMP Snooping Enabled at the switch
I am trying to capture multicast traffic via Wireshark (actually TShark), however the switch has IGMP snooping enabled and will only send Multicast traffic on the ports that have an active IGMP ...
3
votes
5answers
3k views
How to capture Wireshark packets when using a switched network in Windows
I’ve been asked by our SIP trunk provider to run a Wireshark trace on the network when we receive calls.
The issue I’m having is that if I run Wireshark from a laptop plugged into the main switch I ...
3
votes
3answers
3k views
Wireshark filter to only capture Incoming Packets?
I am trying to setup a Filter (so my log files aren't massive) that will capture only incoming traffic. I have looked on http://wiki.wireshark.org/CaptureFilters but so far have been unable to find a ...
3
votes
1answer
1k views
Wireshark arp packets
In wireshark, after capturing some arp packets, what is the significance of all 1's in the destination field. of an Ethernet II frame?
3
votes
2answers
2k views
Stopping the WinPcap Packet capture service
I just installed WireShark, which also installed WinPcap.
During the installation it said "do you want xxx to start automatically", which I answered yes.
Now I would like to stop the service when I ...
3
votes
2answers
107 views
What are cables/boxes called for listening in on a RJ45 cable?
I would like to capture the traffic from a router, so I assume there must exist a cable or hardware box with 3 RJ45 socks, where two of them are IN and OUT, and the third is for capturing device (a ...
3
votes
2answers
817 views
Silently start Wireshark
I have a computer in our office that always gets infected by viruses. Because of this, I would like to use Wireshark (or at least something) to monitor internet traffic for a while on this machine. ...
3
votes
1answer
171 views
How Wireshark could read data from other ips
When I open wireshark I could see the packets send by machines other than mine. How could its possible?
Example
8252 99.150192 somoeneip 239.255.255.250 SSDP NOTIFY * HTTP/1.1
8253 ...
3
votes
1answer
360 views
SSL Packet inspection on Linux
I'm trying to build a web client for an HTTPS website. I think I've done everything right, yet obviously I get a different result in the browser than with my crawler.
As far as I understand, there is ...
3
votes
3answers
9k views
wireshark http POST
I would like to have a http POST request method CAPTURE filter.
I know it is easy to do it by display filter http.request.method==POST but I need tcpdump compatible.
I wrote tcp dst port 80 and ...
3
votes
2answers
9k views
With wireshark how can I filter by packet size?
I can filter for packet lengths using a display filter containing data.len >= XXX, but I'd really like to use a capture filter for this for efficiency... is there a way to do it?
3
votes
3answers
731 views
Sniff packets which have source address other than my machine
I tried sniffing network traffic between 2 ip addresses. One is a HTTP server and other is the client accessing that site.
My aim is to sniff POST method form data. How do i do that?
When i tried ...
3
votes
1answer
504 views
Can WireShark detect Ethernet PAUSE packets on network when running on Windows?
We have a Windows server which is connected to a switch processing a large quantity of data. We noticed that when we disabled FlowControl on the network adapter, that it appeared that we were getting ...
3
votes
3answers
892 views
TCP segments of an HTTP Request in wrong order
My web-services server sometimes does not receive correct HTTP requests and returns "500 - Internal Server Error". Using tcpdump and Wireshark on the server, I found out that HTTP requests are ...
3
votes
1answer
921 views
tcpdump filter for tcp zero window messages
Is there a pcap filter for TCPDump that will allow be to filter zero window messages?
I know how to filter these in a wireshark display filter (tcp.analysis.zero_window) but the amount of data I ...
3
votes
3answers
7k views
How can I configure Wireshark to list my dial up connection as a possible capture interface?
I am trying to monitor traffic coming into to my machine via an incoming dialup connection.
I am using Wireshark with WinPCap 3.1 ( I rolled back to 3.1 from 4.0 because I read that this was the ...
3
votes
1answer
102 views
How to use a switch as a network tap?
I would like to tcpdump all traffic that my router does when it makes a firmware update.
So I have taken a HP ProCurve 1800-8G switch and mirrored port 7 to port 8.
I have connected:
Internet ...
3
votes
2answers
273 views
How to separate PCAP by unique IP address
I have an hour long PCAP file which has about 60 individual network attacks done on our test network here at work. Each attack comes from a unique IP address which was not used elsewhere during the ...
3
votes
2answers
5k views
Best way to analyze pcap files from Wireshark?
I've got 50-100MB pcap files captured from Wireshark and need to analyze where most of the traffic is going to/coming from.
What's the best way of doing this? Ideally I'd like to end up with an ...
3
votes
1answer
5k views
Wireshark Display Filter protocol==TLSV1? (and PacketLength)
What would the filter expression be to just select the protocols where the protocol = TLSV1?
Something obvious like protocol == "TLSV1" or TCP.protocol == "TLSV1" is apparently not the right way.
...
3
votes
3answers
117 views
Layer 3 Protocol only in wireshark
I have a simple question:
is there any way in wireshark to avoid resolution of protocol besides the protocol of layer 3 ?
For example, in the column protocol, instead of showing http, I want it to ...
3
votes
1answer
164 views
What are capture interfaces in Wireshark?
I am really new to Wireshark, and I am little confused about the term capture interface. I see a list of about 9 to 10 so-called interfaces. What are they? I mean, I have only one Ethernet interface ...
3
votes
1answer
3k views
How to filter for HTTP 500 responses and their requests in Wireshark?
How do I filter for HTTP 500 responses and their requests in Wireshark?
I'm able to use http.response.code == 500 to find all the responses which got the return code 500 but I want to be able to see ...
3
votes
1answer
600 views
Virtualize Wireshark with Thinstall from Vmware
Has anyone been able to virtualize Wireshark and PCAP utilizing thinstall from VMWare without requiring installation of the PCAP on the main OS?
3
votes
2answers
920 views
syn/ack sequence number confusion
I was looking at some random traffic in wireshark and came across this (using relative seq/ack numbers):
1. myIP -> 74.125.227.96 [SYN] seq=0
2. 74.125.227.96 -> myIP ...
3
votes
1answer
1k views
WireShark - Capturing Packets on Multiple IP Address (FIlter)
I'm looking for the syntax to do a capture filter on WireShark, by capturing the traffic on several (specific) IP addresses. I understand how to capture a range, and an individual IP address. However, ...
3
votes
5answers
3k views
Parse HTTP requests through Wireshark?
Is there any way to parse HTTP request data in wireshark? For example, can I expose the request parameters upon an HTTP GET request (being sent by my machine), so that I don't need to read the ...
3
votes
3answers
368 views
How do I find out what all this traffic is?
I have seen a consistent spike in traffic over my network since Monday morning and I don't know where it's coming from!
I don't have netflow routers (like I would like), I have IPCop firewalls.
...
