Questions tagged [wireshark]
Wireshark is an open source Network Protocol Analyzer under GNU License.
0
votes
0answers
37 views
Why TCP Out-Of-Order packet is seen after SYN?
I am trying to troubleshoot a performance issue between a client and a file server. When I look at the capture from the client, I see a weird behavior. I am trying to understand this weird behavior.
...
0
votes
0answers
8 views
Apache2 Retransmit Issue
I'm trying to set up a local network that serves a website using apache. I am using airbase-ng and dnsmasq to set up the network.
This is my dnsmasq.conf file:
interface=at0
dhcp-range=10.0.0.10,...
0
votes
1answer
40 views
Packets difference between PTP and gPTP
I'm trying to understand few things about gPTP (IEEE 802.1AS). I am using the open source implementation by AVnu (https://github.com/AVnu/gptp).
I looking on the packets using Wireshark, and they ...
0
votes
1answer
22 views
Get mac address based on ip in filter wireshark
i am a test engineer writing some test cases.
I am trying to write a test which has to be performed in wireshark.
However, my collegues aren't that "into wireshark" and i would like to keep it as ...
-1
votes
1answer
83 views
How is the Ethernet payload only max 1500, while I can ping with larger size packet?
Just recently I came to know that the payload of Ethernet is max 1500 bytes (mtu).
The first thing that came to my mind was that we can ping with much more size than that. So I thought maybe the ...
0
votes
0answers
31 views
WIreshark Filter to track Exchange Traffic from PC to Exchange Server 2007 and out
I've got a Windows Exchange Server 2007 that appears to be sending mail when I've confirmed nobody is on the network. I'm trying to determine if the exchange server is compromised or if a client on ...
11
votes
2answers
968 views
Why send authoritative nameserver in DNS?
Out of curiosity, I'm checking the Wireshark DNS packets. I can see that there's a DNS query from the host, and then DNS response from the DNS server. Everything is just as expected.
However, if you ...
0
votes
1answer
59 views
Verify TLS version between client and server with HTTP proxy in the middle
I am trying to verify the TLS version that my application is using with a server that I connect to. Normally, I use Wireshark and I see the protocol listed as TLS1.2 or something else.
In the current ...
1
vote
0answers
37 views
Server does not respond to SYN [duplicate]
When I launch an FTP transfer from a client machine, it fails because it cannot connect to the server.
With tcpdump I can see that the client sends a SYN to the server, and I can also see that the ...
0
votes
1answer
69 views
How to turn an ethernet port into a passive listener?
I want to capture ethernet packets with my raspberry pi's ethernet port. I know I could create an ethernet bridge between two ethernet ports on the raspberry and analyze the packets internally with ...
0
votes
1answer
95 views
rpcapd behind a firewall
I have a remote server with rpcapd installed that follows strict security policy rules. Any client can access to the server only via firewall that follows same security policy (please, don't blame me, ...
0
votes
0answers
140 views
Why Wireshark is not capturing packets sent/received from my application?
I have a VB6 app that is constantly listening through TCP/IP using IPC. Microsoft Process Monitor is able to capture the port that its sending/receiving on without issue, but whenever I try to filter ...
0
votes
0answers
116 views
How to check for firewall drops in WireShark
We have an application setup across two servers. The application is failing because a firewall is blocking communication between the two servers. I need a way to figure out every single port that is ...
3
votes
1answer
224 views
Wireshark trace file RST after FIN packet
I have a client and Application server, that exchange certificates with each other and establishes a secure TLS connection.
At the end of such connection, after application data is transferred. The ...
0
votes
1answer
94 views
Is it possible to sniff packets on KVM guest loopback interface from host?
I am trying to debug network communication which happens inside CentOS 7 KVM guest. This communication goes from localhost to localhost. I suppose, that all this traffic happens on local lo interface. ...
0
votes
0answers
92 views
How do I investigate Windows DNS Monitoring Simple Query test and Recursive Query test failures?
I have a Windows Server 2012 R2 domain controller (also running Windows DNS service) and I ran the Test, both the "Simple Query" and "Recursive Query" tests failed.
There is zero information or ...
0
votes
1answer
69 views
Windows Network Load Balancing Duplicates UDP Packages?
Background
I have two Windows Server 2012R2 VMs (each with one NIC) listening on port 514 for Syslog UDP messages, which process and then persist the messages to a database. I tried setting up ...
0
votes
0answers
23 views
Reroute IP packets based on PostgreSQL IP table
I apologise for the perhaps very open question, but are somewhat lost in best approach to a solution.
I would like to be able to reroute (perhaps with DNAT IP:PORT) based on source IP.
It would be ...
0
votes
0answers
20 views
how and when ip6bles drops forwarding packets?
i have an ipv6 network composed of: Host---WAN---Server---NetworkA, where networkA and server have global ipv6 addresses.
i'm trying to create a program on the Server to capture the traffic ...
0
votes
0answers
26 views
How to convert tethereal output texts to .cap file
My tethereal captured packet output is as below,
Frame 1 (38 bytes on wire, 38 bytes captured)
Arrival Time: Jun 4, 2018 15:02:00.078762000
[Time delta from previous captured frame: 0....
0
votes
1answer
2k views
How do I capture all packets on local wifi network using Wireshark settings -
I'm attempting to replicate a 'wifi cafe' setup in a home lab environment. I'd like to demonstrate that unencrypted (non-HTTPS) network traffic on a wifi network can be viewed by other wireless ...
0
votes
1answer
193 views
How can I debug SSL traffic between nginx and an Apache backend with a pre-master key?
I am trying to troubleshoot 502 Bad Gateway errors logged by nginx (used as a load balancer) when communicating with our back-end Apache application servers. The nginx proxy_pass module is being used ...
0
votes
0answers
84 views
Is this LDAP network traffic normal (Windows Server 2012 R2)?
When this server is attached to our network, the 'upload' speed that every computer on the network drops from ~10mbps to 1 - 2mbps. Is this a DDOS attack, or probing for a vulnerability, or...?
0
votes
1answer
22 views
Linux: get all connect calls for a local port
I have a ssh tunnel through which a client is connecting to a server. Using, wireshark, I could see a periodic connection of SSH besides the keepalive, but I am unable to obtain the process (pid) that'...
1
vote
2answers
537 views
TLS 1.3 Client-/Server-Hello Version 1.2
I started a TLS1.3-server via openSSL (version 1.1.1-pre4 (beta) 3 Apr 2018
)
$ openssl s_server -key key.pem -cert cert.pem -accept 44330 -www -tls1_3
and a TLS1.3 client
$ openssl s_client -...
0
votes
0answers
644 views
Bad password on Domain Admin from Unknown Workstation
I'm trying to trackdown the Computer/Device that has a bad password for one of our Domain Admin accounts that gets used as a shared/service account.
The only details I have is a recurring event in ...
3
votes
2answers
109 views
Monitor where an application is connecting to on MacOSX
I just downloaded wireshark for mac as I am trying to find out exactly where an app is connecting. I need to see the URL and the protocol whether it is https or http.
I am very new to Wireshark and ...
0
votes
0answers
83 views
Wireshark TCP Retransmission Sockets
I wonder if there is any TCP experts that could help me.
I am seeing data retransmitted on wireshark - see 11.8 (seq25)
wireshark log
I am seeing what I believe is an ACK straight after the message....
0
votes
0answers
2k views
node.js server 502 bad gateway with no errors in application logs (nginx reverse proxy setup)
I have a node.js (+Express) application hosted on ubuntu 16.04 machine serving a http web application and an nginx reverse proxy serving a https server (proxying requests to my node application to ...
0
votes
0answers
31 views
VPN Server not reply to SYN packets
I tried to create a homemade VPN server (i.e. internal IP 192.168.0.113) in a notebook of Windows 10 by following some simple steps here. I added that inbound VPN connection in the Windows' Control ...
0
votes
0answers
242 views
Capture 802.11k / 802.11v BSS management frames
I need to figure out how to capture, identify, and analyze 802.11k / 802.11v BSS transition management frames in-flight.
I currently detect roaming events by using iwconfig to identify a change in ...
0
votes
0answers
258 views
HTTP over TLS Hello Request Answer (BouncyCastle library)
Server misconfigured?
I'm working with a Webserver that offers HTTP over TLS with TLS version 1.2.
Due to the fact that we have many Windows XP machines in production that can not be updated easily, ...
0
votes
0answers
107 views
SYSLOG traffic is not visible on wireshark
At my workplace I am facing this issue. we have dual homed network. taken MPLS links from two providers. We are trying to send syslogs to the syslog server which is in US. I am trying to send these ...
0
votes
0answers
17 views
My hosts on vmware can see eachothers internettraffic
I have 2 hosts set up in vmware: 1 kali (linux) vm and 1 windows 7 vm. I left the virtual network settings in vmware at default. Both my hosts use NAT.
When I use wireshark on my Linux vm, I can see ...
0
votes
1answer
557 views
Wireshark under Windows: Any way to capture packets before dropped by special filter drivers?
I've got some GigabitEthernet Vision cameras, which use Ethernet to communicate. The protocol is simple UDP, but for performance reasons (high packet throughput causing CPU load) the manufacturer uses ...
0
votes
0answers
82 views
How to Identify whether the HTTPS handshake was success or not in Microsoft message analyzer
I am trying to establish a secure TLS connection between my system and a third party API. When ever I try to make a connection I am getting an error
An existing connection was forcibly closed by the ...
0
votes
1answer
47 views
can't get authentication with wireshark (http)
I'm trying to get authentication from an application that connects with tomcat apache by port 18080.
I know user/pass, is only to check the application security to can use https instead http.
I sniff ...
0
votes
1answer
357 views
How to collect HTTP data in Wireshark from a remote Linux host?
I am trying to collect HTTP requests and responses from a remote host using Wireshark using SSH tunnel. So I have Windows host with Wireshark on it, and Linux host with tcpdump on it and a web server ...
1
vote
0answers
113 views
RouterOS sending malformed packets
I have a Routerboard 951G-2HnD which runs latest stable:
RouterOS v6.50.5
Firmware v3.41
The board acts as the WiFi AP in WPA2-PSK mode. Recently I have noticed unhealthy amount of traffic sent from ...
0
votes
1answer
152 views
My computer sometime uses ISL instead 802.1q?
My computer is connected to another computer via Ethernet (via a very simple unmanaged switch). I want to make the traffic between the two computers VLAN tagged with 802.1q protocol. My computer use ...
12
votes
1answer
243 views
Disable TLS 1.2 stops RST packets
Environment,
Web server - Server 2012 R2, IIS 8, ASP.NET application
Firewall Cisco 5515
Un-Managed HP switches, No vlaning
Client has been using Curl from the outside to hit our application.
No ...
2
votes
2answers
263 views
How can I measure the exact time differences (offsets) between two machine?
How can the time differences between two Linux machine be measured accurately? I heard that 'Ping' gives RTT with the association of OS influences therefore not accurate in nanosecond level? If so, ...
-1
votes
1answer
297 views
How to prevent Source Engine Query DDoS Attack?
I recently started a game hosting company and one of my boxes is being hit very hard by what i believe is a botnet(getting thousands of ip addresses sending traffic to a port where a game server is ...
1
vote
1answer
980 views
Decoding ssl packets with cipher TLS_ECDHE_RSA in wireshark
I am trying to decode ssl packets in a packet capture using wireshark.
I am able to successfully decode the packets with server key when the
cipher selected by the server during TLS handshake is ...
1
vote
0answers
63 views
Server won't return some requests to single ISP
I have a Linode server that won't return random GET requests to my usual ISP (but never gets stuck with the same one each time). If I switch ISP or use Opera VPN, all works well.
Linode says all ...
0
votes
1answer
76 views
Get VPN parameters from tcpdump
There are some cases when VPN client has no (working) linux-version. Is it possible to run linux openvpn client with proper flags to replace them?
For example - first dump messages between client ...
7
votes
2answers
1k views
How can I decrypt STARTTLS communication over SMTP in a packet capture (if I have the private key)?
For the purpose of troubleshooting, I need to see what an email looks like when it's sent to my sendmail server via SMTP. The upstream server requires the SMTP connection to use STARTTLS so a packet ...
2
votes
1answer
3k views
RST ACK after SYN and Retransmission
I'm very new with network, so forgive me if I ask dumb questions or if my vocabulary is bad
I'm trying to access an URL from a partner on a specific port. The server has a firewall which only accepts ...
0
votes
1answer
99 views
Find simple text fragment in packets
Trying to filter packets with Wireshark. Why it finds nothing when placing filter tcp contains M-SEARCH. I have such value on the third line.
0
votes
1answer
98 views
DHCP server on a multi ip interface
My system runs Ubuntu 17.04, my network topology is:
I have eth1 configured with multiple IP addresses:
$ ip addr show eth1
4: eth1: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc pfifo_fast ...
