Questions tagged [wireshark]
Wireshark is an open source Network Protocol Analyzer under GNU License.
479
questions
0
votes
0
answers
12
views
Bytes-in-flight higher than receiver window in frozen client connections
I am dealing with sort of a "ghost issue". We have an endpoint URL that some people can use at all times with no issues but others have a frozen connection on the client side (checked with ...
- 1
0
votes
0
answers
86
views
How to find the symmetric key algorithm being used for a TLS connection in Wireshark?
I'm doing a TLS Wireshark lab and I can't find any information in Wireshark, the lab, or online how to find this answer:
What symmetric key cryptography algorithm is being used by the client and ...
- 101
1
vote
1
answer
20
views
Wireshark != doesn't work like it did before version 3.6
I use the filter ip.addr != 10.0.0.0/8 && !(ip.addr == 224.0.0.0/3) to identify any traffic between our network and the outside (and also exclude class-D address space). This filter no longer ...
- 221
0
votes
1
answer
114
views
Duplicated UDP packets sent
We have a few applications that we develop in my company that talk to some hardware via UDP. Recently, we started having issues using these applications on some of our machines (hardware basically ...
- 101
0
votes
0
answers
29
views
Monitor local SQL Server traffic
I am running a local instance of MS SQL server 2014 Developer Edition, I enabled the certificate based encryption on it, so I want to verify that all the incoming and outgoing traffic is encrypted. I ...
- 101
-2
votes
1
answer
49
views
Discover IP address of the device knowing only MAC address
While "wiresharking" the network, You may come across packets that looks like
THIS
eth.src to eth.dst (mainly colored white).. sometimes Wireshark recognize protocol LLC, NDP etc..
but ...
2
votes
1
answer
258
views
Wireshark find DNS response "Refused"
I'm looking for a way to filter a packet capture in wireshark for instances where our server responds with "Refused" to a recursive DNS query.
dns.resp.type== doesn't seem to offer anything ...
- 1,037
0
votes
1
answer
74
views
DNS, why is it sometimes doing a PTR lookup before A lookup?
When I perform NSLOOKUP -q=a chinaa.cn I get the following result in WireShark:
Why did it FIRST look up the PTR of my ISP DNS before sending an A-request?
And why did the DNS server respond first ...
- 144
0
votes
1
answer
32
views
How to inspect outgoing traffic from Acess Point
I have Access Point which is connecting to VPN and create internal WiFi network of our company everywhere. Now I need to inspect what protocol for VPN is this AP using. I am not able to configure it, ...
- 3
0
votes
0
answers
49
views
Wireshark not capturing on HTTP websites
I'm using wireshark on my router's HTTP website (login page) but it is not capturing the password. It only captures the username. What should I do to capture both on wireshark? I'm using a Debian-...
1
vote
1
answer
70
views
How to find the linux user that sent the packet [duplicate]
Our server is compromised and we would like to know which accounts sent the malicious queries from our server. I used tcpdump to get this :
our.host.net.48194 > box5596.bluehost.com.http: Flags [P....
- 113
1
vote
0
answers
48
views
Running tshark and find in parallel + strict time-sorted output
I'm trying to obtain debug output of
what "find" does
compared to what happens on the network (tshark)
Therefore I want to run these commands in parallel and have output meticulously ...
- 2,795
0
votes
0
answers
44
views
How to identify source, destination ip using STUN and DTLS protocols?
enter image description here
Given image i'm not able to identify which is source and destination ip address ( client or server). From STUN protocol 1st packet it's user request so i thought 131.202....
0
votes
1
answer
232
views
Piping SSH to wireshark on windows
In my day-to-day operations, I frequently need to execute tcpdump's on remote servers, and it's a pain to save the output to a file and then have to move the file to my laptop to analyze it on ...
- 360
1
vote
0
answers
110
views
'socat' not displaying incoming UDP packets, but Wireshark does
The link is an image of a Wireshark dump of an incoming 60-byte Ethernet frame which contains a UDP packet. The packet payload is the single word 'hello' (sorry, I don't have enough rep to paste the ...
- 35
0
votes
1
answer
160
views
iptables DNAT change not showing up in Wireshark
I want to re-route all incoming traffic on interface ens4f0 to IP address 192.168.50.10, but Wireshark is showing that the destination IP address on incoming packets is unchanged. Is this the expected ...
- 35
0
votes
1
answer
27
views
when router sends ICMP protocol error message how does it set it's own TTL?
when using (traceroute -q 1 serverAddress), we know that it starts with TTL(Time to Live) = 1.
when it goes through router, the router decrements TTL by 1. If TTL becomes 0 at that router, it sends ...
0
votes
2
answers
271
views
How to capture a remote server in different network from home?
I want to capture packets from a remote server using Wireshark. I have a Linux-based server and I can access to it through Putty. This remote server is not on my network. How could I access to a ...
0
votes
1
answer
296
views
Where is the ACK to the packet in frame 76? [closed]
I am working through Kurose's book as part of a class and this particular exercise involves submitting a .txt file to the server and capturing this transfer and the server's response.
In one exercise ...
1
vote
1
answer
208
views
VoIP one-way audio, only when call initiated from one side
I am setting up some new switches and VLANs and I am getting trouble with our pre-existing Asterisk VoIP set-up.
Most calls work ok. Some get just one-way audio. I tried to narrow it down to this ...
- 449
-1
votes
1
answer
369
views
Python sockets: TCP errors in linux, while same program works fine on Windows10
I'm trying to communicate with a commercial power supply device via TCP/IP using python sockets.
I tried using both a virtual linux(centos8stream) and virtual windows10, both running at the same ...
- 21
1
vote
1
answer
94
views
Why is my PC doing more than one DNS query for www.ietf.org? [closed]
I'm doing an exercise for a class where I have to flush the DNS cache and then visit www.ietf.org and capture the packets. I got this:
The selected query and response are the "main" ones. ...
1
vote
0
answers
132
views
TLS 1.2 Failure
I am using Webinspect to scan sites. When going through Webinspect, I get "the client and server cannot communicate because they do not possess a common algorithm".
From the same system, ...
- 11
0
votes
0
answers
178
views
Slow connection to production MongoDB due to TLS handshake retransmits
I have question about something that had me tearing my hair out for the past two days.
Long story short: specifically over my home network, my connection to our work MongoDB is stupidly slow. Over my ...
0
votes
1
answer
251
views
How can wireshark.exe on windows read from a pcap file stream?
This is probably less a wireshark question and more a "how do I pipe a file into an application" on windows.
On linux, I can capture a pcap file on another host with tcpdump and pipe it back ...
- 11
2
votes
1
answer
117
views
Measuring network bandwidth usage
One VM is sending data to another VM using rsync, both VMs are hosted on the same machine. I've got the task to measure the network bandwidth usage between both VMs and plot it.
Plotting is easy once ...
- 21
0
votes
1
answer
325
views
tshark : in a HTTP POST request how get form datas in a pretty output?
I'm a teacher and I want to simulate with my students a MITM attack. The goal is to show why the https protocol must be always used.
On debian, I installed tshark. All works fine, when I run the ...
- 107
0
votes
1
answer
281
views
How can I isolate a single TCP connection on Wireshark?
I just started using Wireshark for network troubleshooting purposes and I am a little confused about one thing. I requested a webpage and for the next 10s I monitored the data. I then used the filter ...
user603679
0
votes
1
answer
44
views
Can I determine a EWOULDBLOCK/EAGAIN situation from a pcap/tcpdump
Is there a way I can determine if a certain message resulted in an EWOULDBLOCK/EAGAIN return code to the server which sent the packet?
The server was sending messages to the client
At time 10,the ...
- 133
0
votes
0
answers
35
views
Can't track applications network communication under same machine
I have a network application environment of 7 applications communicating with eachother through UDP and TCP. All of them using either the machine's local network IP or 127.0.0.1 (localhost) to listen ...
- 101
0
votes
0
answers
332
views
Postfix behind NAT
my network looks like this:
Internet <-> Gateway router(nat) <-> enp0s3 Linux enp0s8(NAT) <-> SMTP server
Without Linux NAT it works ok, but I need it.
When I try to send mail to ...
- 1
-1
votes
1
answer
49
views
Dumpcap - Ram still reserved after stop
System: Win 10 Pro and latest updates (Sept. 2020) 64Bit.
Problem: Using dumpcap (Dumpcap (Wireshark) 3.2.5 (v3.2.5-0-ged20ddea8138)) with a ringbuffer reserves RAM even after closing the dumpcap.exe. ...
- 109
1
vote
2
answers
6k
views
How to decrypt TLS traffic with Wireshark using RSA asynchronous encryption?
I want to be able to capture and decrypt TLS traffic that one off my internal application (that I don't have access) makes to the internet. (For testing I am using Postman to create a request to a ...
- 121
1
vote
0
answers
192
views
Sniffing packets over a wifi network, with or without monitor mode using wireshark
So, I am actually confused, there are some guides that say you can't just capture traffic on wireless LAN with promiscuous mode and you need to setup monitor mode, also enter the wifi password to be ...
- 111
1
vote
0
answers
518
views
TCP Window Size
Hoping someone can clarify a query I have in relation to TCP window size and whether it could be contributing to my slow throughput achieved via iPerf.
I took a Wireshark capture from a client while ...
- 11
0
votes
0
answers
212
views
HTTP webservice no response
We have some issues on a connection between 2 devices through ASP webservices. On Wireshark, we saw that the request arrives to the destination computer and the IIS sends the response, but the origin ...
- 11
0
votes
0
answers
433
views
Wireshark TLS conversation for ldaps
I am trying to troubleshoot an issue with delays in LDAPS bind operations with tcpdump/wireshark.
Here is what I get from client side on a conversation with delays:
I see the following problems:
I ...
- 478
0
votes
1
answer
191
views
How does a web browser parse the raw bytes of each part of a DNS name to a human readable form? [closed]
My focus is to parse the structure of a DNS packet programmatically using python.
Consider the snap where my browser send a large domain name through the pipe without even complaining.
Let's take a ...
- 103
1
vote
0
answers
291
views
Debugging port forwarding in Docker
Manager
I have a docker swarm setup on a mesh VPN. My manager is on 10.0.0.1. I have run:
docker swarm init --advertise-addr=wg0
which then uses the VPN IP to listen on 10.0.0.1 opposed to the ...
- 159
0
votes
2
answers
561
views
What is blocking my mysql connection?
We run several docker images on a VM.
sudo iptables -S shows a lot of docker networking.
We try to connect to an external MySQL database in another net.
mysql --host=mysql.example.org --user=thisuser ...
- 11
0
votes
1
answer
637
views
Decoding TCP packets as RTP in Wireshark
I'm troubleshooting a WebRTC video calling problem in my app and i'm using Wireshark.
One end of my video call is a web app running in my browser window and the other end is a Unity based app on an ...
- 41
-1
votes
1
answer
309
views
SSH connection not established, but standard TCP/IP connection works
I'm working on a custom yocto Linux for a Raspberry PI 3 and try to get the WIFI connection working with SSH. However when trying to connect from my PC (Ubuntu 19.10, SSH OpenSSH_8.0p1 Ubuntu-6build1, ...
- 1
0
votes
1
answer
90
views
Steamapi Dns calls without steam being open
So , after some time I re-opened wireshark to update it and I saw something pretty strange, now I'm really not sure what this is and that might just be a basic thing but I can't seem to understand why ...
- 103
0
votes
1
answer
26
views
Is it possible to capture packets of router which i connected through wifi of my laptop
I want to capture all traffic of router I can only connect with wifi no physical access and I do have access to configuration page of router
1
vote
2
answers
338
views
Record SSH commands sent to a Mac from Windows
I've got a bit of a puzzler - I am an administrator on both a Windows 10 and a Mac Catalina machine.
The Windows machine is currently running software that has a known bug - SSH commands are sent to ...
- 53
2
votes
2
answers
6k
views
Googlecast SSDP and MDNS queries on network despite not having any chromecast applications installed in main computer
As title states,
Ive detected some MDNS queries from a googlecast address, which is strange since i don't have any googlecast apps or similar installed.
Additionally My PC is sending SSDP packets to ...
- 23
0
votes
1
answer
27
views
need help in finding original url - wireshark
I'm using wireshark to capture data.
Now when I'm hitting sites, I can only see Source - IPv4,Dest - IPv4.
Is there anyway I get to know the exact url it hit.
Like :
https://www.reddit.com/r/meme
...
- 103
0
votes
0
answers
102
views
AJAX POST fails - client sends RST response...why?
Problem
We have a web application that is used by many thousands of users. However, since the latter part of Jan 2020, a tiny fraction of clients (but still a significant number) have reported a ...
- 99
0
votes
2
answers
265
views
PXE Boot laptop doesn't send out DHCP discover
ultimately im trying to get a PXE boot laptop to talk to the WDS server. While monitoring the switch using wireshark from laptop #2, it doesn't see ANY DHCP packet during a PXE boot. whereas, I would ...
- 13
0
votes
1
answer
163
views
Treat TCP as MQTT protocol
I have packets captured during not encrypted MQTT communication:
Protocol is detected as TCP. How to ask Wireshark to analyze packets as MQTT?
UPD
In case I set MQTT server work on default 1883 ...
- 99