Last call to make your voice heard! Our 2022 Developer Survey closes in less than a week. Take survey.

Questions tagged [wireshark]

Wireshark is an open source Network Protocol Analyzer under GNU License.

Filter by
Sorted by
Tagged with
0 votes
0 answers
12 views

Bytes-in-flight higher than receiver window in frozen client connections

I am dealing with sort of a "ghost issue". We have an endpoint URL that some people can use at all times with no issues but others have a frozen connection on the client side (checked with ...
user avatar
0 votes
0 answers
86 views

How to find the symmetric key algorithm being used for a TLS connection in Wireshark?

I'm doing a TLS Wireshark lab and I can't find any information in Wireshark, the lab, or online how to find this answer: What symmetric key cryptography algorithm is being used by the client and ...
user avatar
1 vote
1 answer
20 views

Wireshark != doesn't work like it did before version 3.6

I use the filter ip.addr != 10.0.0.0/8 && !(ip.addr == 224.0.0.0/3) to identify any traffic between our network and the outside (and also exclude class-D address space). This filter no longer ...
user avatar
  • 221
0 votes
1 answer
114 views

Duplicated UDP packets sent

We have a few applications that we develop in my company that talk to some hardware via UDP. Recently, we started having issues using these applications on some of our machines (hardware basically ...
user avatar
  • 101
0 votes
0 answers
29 views

Monitor local SQL Server traffic

I am running a local instance of MS SQL server 2014 Developer Edition, I enabled the certificate based encryption on it, so I want to verify that all the incoming and outgoing traffic is encrypted. I ...
user avatar
  • 101
-2 votes
1 answer
49 views

Discover IP address of the device knowing only MAC address

While "wiresharking" the network, You may come across packets that looks like THIS eth.src to eth.dst (mainly colored white).. sometimes Wireshark recognize protocol LLC, NDP etc.. but ...
user avatar
2 votes
1 answer
258 views

Wireshark find DNS response "Refused"

I'm looking for a way to filter a packet capture in wireshark for instances where our server responds with "Refused" to a recursive DNS query. dns.resp.type== doesn't seem to offer anything ...
user avatar
  • 1,037
0 votes
1 answer
74 views

DNS, why is it sometimes doing a PTR lookup before A lookup?

When I perform NSLOOKUP -q=a chinaa.cn I get the following result in WireShark: Why did it FIRST look up the PTR of my ISP DNS before sending an A-request? And why did the DNS server respond first ...
user avatar
  • 144
0 votes
1 answer
32 views

How to inspect outgoing traffic from Acess Point

I have Access Point which is connecting to VPN and create internal WiFi network of our company everywhere. Now I need to inspect what protocol for VPN is this AP using. I am not able to configure it, ...
user avatar
0 votes
0 answers
49 views

Wireshark not capturing on HTTP websites

I'm using wireshark on my router's HTTP website (login page) but it is not capturing the password. It only captures the username. What should I do to capture both on wireshark? I'm using a Debian-...
user avatar
1 vote
1 answer
70 views

How to find the linux user that sent the packet [duplicate]

Our server is compromised and we would like to know which accounts sent the malicious queries from our server. I used tcpdump to get this : our.host.net.48194 > box5596.bluehost.com.http: Flags [P....
user avatar
  • 113
1 vote
0 answers
48 views

Running tshark and find in parallel + strict time-sorted output

I'm trying to obtain debug output of what "find" does compared to what happens on the network (tshark) Therefore I want to run these commands in parallel and have output meticulously ...
user avatar
  • 2,795
0 votes
0 answers
44 views

How to identify source, destination ip using STUN and DTLS protocols?

enter image description here Given image i'm not able to identify which is source and destination ip address ( client or server). From STUN protocol 1st packet it's user request so i thought 131.202....
user avatar
0 votes
1 answer
232 views

Piping SSH to wireshark on windows

In my day-to-day operations, I frequently need to execute tcpdump's on remote servers, and it's a pain to save the output to a file and then have to move the file to my laptop to analyze it on ...
user avatar
  • 360
1 vote
0 answers
110 views

'socat' not displaying incoming UDP packets, but Wireshark does

The link is an image of a Wireshark dump of an incoming 60-byte Ethernet frame which contains a UDP packet. The packet payload is the single word 'hello' (sorry, I don't have enough rep to paste the ...
user avatar
  • 35
0 votes
1 answer
160 views

iptables DNAT change not showing up in Wireshark

I want to re-route all incoming traffic on interface ens4f0 to IP address 192.168.50.10, but Wireshark is showing that the destination IP address on incoming packets is unchanged. Is this the expected ...
user avatar
  • 35
0 votes
1 answer
27 views

when router sends ICMP protocol error message how does it set it's own TTL?

when using (traceroute -q 1 serverAddress), we know that it starts with TTL(Time to Live) = 1. when it goes through router, the router decrements TTL by 1. If TTL becomes 0 at that router, it sends ...
user avatar
0 votes
2 answers
271 views

How to capture a remote server in different network from home?

I want to capture packets from a remote server using Wireshark. I have a Linux-based server and I can access to it through Putty. This remote server is not on my network. How could I access to a ...
user avatar
0 votes
1 answer
296 views

Where is the ACK to the packet in frame 76? [closed]

I am working through Kurose's book as part of a class and this particular exercise involves submitting a .txt file to the server and capturing this transfer and the server's response. In one exercise ...
user avatar
1 vote
1 answer
208 views

VoIP one-way audio, only when call initiated from one side

I am setting up some new switches and VLANs and I am getting trouble with our pre-existing Asterisk VoIP set-up. Most calls work ok. Some get just one-way audio. I tried to narrow it down to this ...
user avatar
  • 449
-1 votes
1 answer
369 views

Python sockets: TCP errors in linux, while same program works fine on Windows10

I'm trying to communicate with a commercial power supply device via TCP/IP using python sockets. I tried using both a virtual linux(centos8stream) and virtual windows10, both running at the same ...
user avatar
1 vote
1 answer
94 views

Why is my PC doing more than one DNS query for www.ietf.org? [closed]

I'm doing an exercise for a class where I have to flush the DNS cache and then visit www.ietf.org and capture the packets. I got this: The selected query and response are the "main" ones. ...
user avatar
1 vote
0 answers
132 views

TLS 1.2 Failure

I am using Webinspect to scan sites. When going through Webinspect, I get "the client and server cannot communicate because they do not possess a common algorithm". From the same system, ...
user avatar
0 votes
0 answers
178 views

Slow connection to production MongoDB due to TLS handshake retransmits

I have question about something that had me tearing my hair out for the past two days. Long story short: specifically over my home network, my connection to our work MongoDB is stupidly slow. Over my ...
user avatar
0 votes
1 answer
251 views

How can wireshark.exe on windows read from a pcap file stream?

This is probably less a wireshark question and more a "how do I pipe a file into an application" on windows. On linux, I can capture a pcap file on another host with tcpdump and pipe it back ...
user avatar
2 votes
1 answer
117 views

Measuring network bandwidth usage

One VM is sending data to another VM using rsync, both VMs are hosted on the same machine. I've got the task to measure the network bandwidth usage between both VMs and plot it. Plotting is easy once ...
user avatar
0 votes
1 answer
325 views

tshark : in a HTTP POST request how get form datas in a pretty output?

I'm a teacher and I want to simulate with my students a MITM attack. The goal is to show why the https protocol must be always used. On debian, I installed tshark. All works fine, when I run the ...
user avatar
0 votes
1 answer
281 views

How can I isolate a single TCP connection on Wireshark?

I just started using Wireshark for network troubleshooting purposes and I am a little confused about one thing. I requested a webpage and for the next 10s I monitored the data. I then used the filter ...
user avatar
0 votes
1 answer
44 views

Can I determine a EWOULDBLOCK/EAGAIN situation from a pcap/tcpdump

Is there a way I can determine if a certain message resulted in an EWOULDBLOCK/EAGAIN return code to the server which sent the packet? The server was sending messages to the client At time 10,the ...
user avatar
  • 133
0 votes
0 answers
35 views

Can't track applications network communication under same machine

I have a network application environment of 7 applications communicating with eachother through UDP and TCP. All of them using either the machine's local network IP or 127.0.0.1 (localhost) to listen ...
user avatar
0 votes
0 answers
332 views

Postfix behind NAT

my network looks like this: Internet <-> Gateway router(nat) <-> enp0s3 Linux enp0s8(NAT) <-> SMTP server Without Linux NAT it works ok, but I need it. When I try to send mail to ...
user avatar
  • 1
-1 votes
1 answer
49 views

Dumpcap - Ram still reserved after stop

System: Win 10 Pro and latest updates (Sept. 2020) 64Bit. Problem: Using dumpcap (Dumpcap (Wireshark) 3.2.5 (v3.2.5-0-ged20ddea8138)) with a ringbuffer reserves RAM even after closing the dumpcap.exe. ...
user avatar
  • 109
1 vote
2 answers
6k views

How to decrypt TLS traffic with Wireshark using RSA asynchronous encryption?

I want to be able to capture and decrypt TLS traffic that one off my internal application (that I don't have access) makes to the internet. (For testing I am using Postman to create a request to a ...
user avatar
  • 121
1 vote
0 answers
192 views

Sniffing packets over a wifi network, with or without monitor mode using wireshark

So, I am actually confused, there are some guides that say you can't just capture traffic on wireless LAN with promiscuous mode and you need to setup monitor mode, also enter the wifi password to be ...
user avatar
  • 111
1 vote
0 answers
518 views

TCP Window Size

Hoping someone can clarify a query I have in relation to TCP window size and whether it could be contributing to my slow throughput achieved via iPerf. I took a Wireshark capture from a client while ...
user avatar
0 votes
0 answers
212 views

HTTP webservice no response

We have some issues on a connection between 2 devices through ASP webservices. On Wireshark, we saw that the request arrives to the destination computer and the IIS sends the response, but the origin ...
user avatar
  • 11
0 votes
0 answers
433 views

Wireshark TLS conversation for ldaps

I am trying to troubleshoot an issue with delays in LDAPS bind operations with tcpdump/wireshark. Here is what I get from client side on a conversation with delays: I see the following problems: I ...
user avatar
  • 478
0 votes
1 answer
191 views

How does a web browser parse the raw bytes of each part of a DNS name to a human readable form? [closed]

My focus is to parse the structure of a DNS packet programmatically using python. Consider the snap where my browser send a large domain name through the pipe without even complaining. Let's take a ...
user avatar
  • 103
1 vote
0 answers
291 views

Debugging port forwarding in Docker

Manager I have a docker swarm setup on a mesh VPN. My manager is on 10.0.0.1. I have run: docker swarm init --advertise-addr=wg0 which then uses the VPN IP to listen on 10.0.0.1 opposed to the ...
user avatar
  • 159
0 votes
2 answers
561 views

What is blocking my mysql connection?

We run several docker images on a VM. sudo iptables -S shows a lot of docker networking. We try to connect to an external MySQL database in another net. mysql --host=mysql.example.org --user=thisuser ...
user avatar
  • 11
0 votes
1 answer
637 views

Decoding TCP packets as RTP in Wireshark

I'm troubleshooting a WebRTC video calling problem in my app and i'm using Wireshark. One end of my video call is a web app running in my browser window and the other end is a Unity based app on an ...
user avatar
  • 41
-1 votes
1 answer
309 views

SSH connection not established, but standard TCP/IP connection works

I'm working on a custom yocto Linux for a Raspberry PI 3 and try to get the WIFI connection working with SSH. However when trying to connect from my PC (Ubuntu 19.10, SSH OpenSSH_8.0p1 Ubuntu-6build1, ...
user avatar
  • 1
0 votes
1 answer
90 views

Steamapi Dns calls without steam being open

So , after some time I re-opened wireshark to update it and I saw something pretty strange, now I'm really not sure what this is and that might just be a basic thing but I can't seem to understand why ...
user avatar
  • 103
0 votes
1 answer
26 views

Is it possible to capture packets of router which i connected through wifi of my laptop

I want to capture all traffic of router I can only connect with wifi no physical access and I do have access to configuration page of router
user avatar
1 vote
2 answers
338 views

Record SSH commands sent to a Mac from Windows

I've got a bit of a puzzler - I am an administrator on both a Windows 10 and a Mac Catalina machine. The Windows machine is currently running software that has a known bug - SSH commands are sent to ...
user avatar
2 votes
2 answers
6k views

Googlecast SSDP and MDNS queries on network despite not having any chromecast applications installed in main computer

As title states, Ive detected some MDNS queries from a googlecast address, which is strange since i don't have any googlecast apps or similar installed. Additionally My PC is sending SSDP packets to ...
user avatar
  • 23
0 votes
1 answer
27 views

need help in finding original url - wireshark

I'm using wireshark to capture data. Now when I'm hitting sites, I can only see Source - IPv4,Dest - IPv4. Is there anyway I get to know the exact url it hit. Like : https://www.reddit.com/r/meme ...
user avatar
  • 103
0 votes
0 answers
102 views

AJAX POST fails - client sends RST response...why?

Problem We have a web application that is used by many thousands of users. However, since the latter part of Jan 2020, a tiny fraction of clients (but still a significant number) have reported a ...
user avatar
  • 99
0 votes
2 answers
265 views

PXE Boot laptop doesn't send out DHCP discover

ultimately im trying to get a PXE boot laptop to talk to the WDS server. While monitoring the switch using wireshark from laptop #2, it doesn't see ANY DHCP packet during a PXE boot. whereas, I would ...
user avatar
0 votes
1 answer
163 views

Treat TCP as MQTT protocol

I have packets captured during not encrypted MQTT communication: Protocol is detected as TCP. How to ask Wireshark to analyze packets as MQTT? UPD In case I set MQTT server work on default 1883 ...
user avatar
  • 99

1
2 3 4 5
10