Tag Info

Hot answers tagged

34

No, this is not normal. Contact your provider to resolve this issue. When they can't, switch away ASAP.


28

Ping packets should use an ICMP type of 8 (echo) or 0 (echo reply), so you could use a capture filter of: icmp and a display filter of: icmp.type == 8 || icmp.type == 0 For HTTP, you can use a capture filter of: tcp port 80 or a display filter of: tcp.port == 80 or: http Note that a filter of http is not equivalent to the other two, which will ...


25

http.request.method == "POST"


19

If you go to Edit -> Preferences -> Protocols -> HTTP, you should find a list of ports that are considered to be HTTP. Add port 9191 to that list. I believe you have to re-start Wireshark and re-open your capture file or re-start your capture for this to take effect. This is on the Windows version 1.0.3; it might be slightly different on other platforms. ...


18

There's a WIKI Entry about exactly this issue on the wireshark homepage. They also mention specifics about the loopback interface regarding Windows - you could be running just into that.


14

In general, no, Wireshark can't sense that traffic. ErikA describes why. However... if your network supports it, the network itself can show Computer A the traffic for Computer B, and from there Wireshark can grab it. There are several ways of getting it there. Same Switch, good method If both computers are on the same network switch, and the switch is ...


13

Note: I'm assuming that this capture was taken on the client machine. A brief summary on TCP sequencing: TCP reliably delivers streams of bytes between two applications. "Reliably" in this case means that, among other things, TCP guarantees to never deliver out of order data to a listening application. In-order, reliable delivery is implemented through the ...


12

As 3molo says. If you're intercepting the traffic, then port 443 is the filter you need. If you have the site's private key, you can also decrypt that SSL . (needs an SSL-enabled version/build of Wireshark.) See http://wiki.wireshark.org/SSL


12

You can use the yum command to install wireshark on RHEL yum install wireshark and yum install wireshark-gnome This is probably the best way to install the products as it will install the relevant dependencies at the same time.


11

This behavior is a very good way of finding a potential duplicate IP. If your computer gets no answer, then it is the only one with that IP. If your computer gets an answer, there is another computer with the same IP which is a problem obviously. Concerning RFCs, I find them horrible to read. I only use them for reference concerning specific problems. I ...


11

It has been a while since I consulted to the telecom industry so I am going off of what is still likely. For DSL, this is sub-par. You should never see traffic destined for another IP address. I would check with your provider. This is not a standard configuration and it is likely that there are some settings in the RedBack that are not right. Each ...


10

4. Configure a switch port to be a monitoring port. This way you will get all traffic on that port. This Netgear model has this configuration option. It's called "port mirroring" on Netgear switches.


10

First, neither the number of frames nor the amount of data should as such significantly impact network connections even with just Fast Ethernet in place - 5,000 frames of 500 bytes amount to a bit less than 2,5 MB / second of data. They might trigger broadcast storm detection mechanisms on your swithes though, leading to broadcast frame drops of legitimate ...


9

ARP request packets are sent to the ethernet broadcast address FF:FF:FF:FF:FF:FF (or all 1s if you're looking at in binary). This will flood the packet throughout the network so that the correct device will hear it and respond with its IP address. http://en.wikipedia.org/wiki/Address_Resolution_Protocol


9

A proper DMZ will isolate hosts on the DMZ from each-other in addition to managing access between the hosts and the internet / internal network. The DMZ environment provides for a single choke-point to enforce security and access policies, and provides one single point to monitor traffic into, out of, and within the DMZ. A DMZ isn't just a network that ...


8

Open up Wireshark, select your .cap file, and then go to File->Export and choose the options that you want. So, if you need to do it from the command line, use tshark.exe, as follows. >tshark -i - < "c:\filename.cap" > "c:\output.txt If you want to write the decoded form of packets to a file, run TShark without the -w option, and redirect its ...


8

Step 1 is to start grabbing packets in front of the spam appliance, where it theoretically receives them after passing the firewall. You want to set your capture filter to "port 25". Wireshark's dissector is good enough to do most of the analysis its self. Right-click on a packet, select "View TCP session" to get a complete transcript of a SMTP session. If ...


8

One approach is to use what's called a mirror or span port on your switch. If your switch isn't inteligent enough you can also put a small hub inbetween the switch/host-to-capture connection. You connect a physical link from your listening host to that port/hub and then you can see all the traffic crossing the device. Alternatively, you'll need to install ...


8

First of all you should understand the concept of a Diffie-Hellman exchange. It allow to establish a channel between 2 endpoints with these features: Protects against eavesdropping. Someone sniffing on the channel cannot decrypt it. Diffie-Hellman Does NOT protect against man-in-the middle attacks. This kind of attacks are prevented through verification of ...


7

The WinPCap services is known as "NPF" (NetGroup Packet Filter), you can start/stop it on command line with c:\>net start npf The NetGroup Packet Filter Driver service was started successfully. C:\>net stop npf The NetGroup Packet Filter Driver service was stopped successfully. To find it in a GUI, you'll have to open "Properties" for "My ...


7

You can configure a custom log format for access logging which will include this information. Adjust your existing logging directives as needed, but you'll want something like this: LogFormat "%{Host}i %h %l %u %t \"%r\" %>s %b \"%{Referer}i\" \"%{User-agent}i\"" combined_with_access_host CustomLog /var/log/wherever-you-put-it/access_log ...


7

It sounds like your card might have chimney offloading enabled. On systems with this feature, established TCP connections are handed off to the NIC for processing and the traffic bypasses any NDIS intermediate drivers (including WinPcap). More in-depth discussions can be found on winpcap.org and KB 912222. You can disable it using netsh int ip set chimney ...


7

Microsoft Pro Support will often request that you install Netmon on a production server to help track down problems. If MSFT themselves want you to use a packet capture utility (in this case, Netmon) on a production server then that's a good indication that it's okay. (I suppose there's at least a few logical fallacies in that statement, but it sounded good ...


7

I think it can be done using a filter like: "tcp[14] = 0 && tcp[15] = 0" The tcp[i] notation means the index i of TCP header. The window size is located after 14 bytes from TCP header. For more info, you can look at man pcap-filter.


6

The source port for applications that don't need a specific source port tends to fall in the ephemeral range, > 49152. More info here. As long as the firewall is "stateful", in other words, tracks connections recognizes packets from the same TCP stream as part of the same flow (the vast majority of modern firewalls do this), you will only need to allow the ...


6

Wireshark can decrypt SSL if you have the RSA key for the certificate used by the server. Instructions can be found here.


6

If you want to display both methods GET and POST you filter wireshark like this http.request.method == GET or http.request.method == POST


6

"port 443" in capture filters. See http://wiki.wireshark.org/CaptureFilters It will be encrypted data though.


6

Open Edit→Find Packet. Under Find select String and under Search In select Packet list.


6

Have you tried the "contains" or "matches" operators? For example, tns.request and tns contains "Marshmallows" or simply frame matches "(?i)marshmallows" The first example looks for TNS requests which contain the case-sensitive string "Marshmallows". The second example looks for "marshmallows" anywhere in any frame, ignoring case. ("contains" does ...



Only top voted, non community-wiki answers of a minimum length are eligible