Questions tagged [wireshark]
Wireshark is an open source Network Protocol Analyzer under GNU License.
446
questions
0
votes
1answer
13 views
Decoding TCP packets as RTP in Wireshark
I'm troubleshooting a WebRTC video calling problem in my app and i'm using Wireshark.
One end of my video call is a web app running in my browser window and the other end is a Unity based app on an ...
-1
votes
1answer
49 views
SSH connection not established, but standard TCP/IP connection works
I'm working on a custom yocto Linux for a Raspberry PI 3 and try to get the WIFI connection working with SSH. However when trying to connect from my PC (Ubuntu 19.10, SSH OpenSSH_8.0p1 Ubuntu-6build1, ...
0
votes
1answer
78 views
Steamapi Dns calls without steam being open
So , after some time I re-opened wireshark to update it and I saw something pretty strange, now I'm really not sure what this is and that might just be a basic thing but I can't seem to understand why ...
0
votes
1answer
20 views
Is it possible to capture packets of router which i connected through wifi of my laptop
I want to capture all traffic of router I can only connect with wifi no physical access and I do have access to configuration page of router
0
votes
0answers
18 views
Remote WMI Traffic
I have a problem understanding remote WMI traffic.
Let's say I have 2 PC's in a LAN (PC-A and PC-B).
From PC-A i type in CMD:
wmic /node:"PC-B" /user:"B" /password:"whatever" computersystem get "...
0
votes
0answers
12 views
Can't start capture files in GNS3 (Wireshark error)
What's wrong with wireshark in GNS3?
I've reinstalled wireshark and GNS3, but it doesn't solve my problem.
Wireshark Error:
My packet capture preferences:
0
votes
0answers
36 views
Multiple TCP dup ACK with spurious retransmission
I have a cellular IoT-device connected to a MQTT broker with a keep alive of 15 sec. It happens once a day that the device gets disconnected from the server (server log shows: client stopped due to ...
1
vote
2answers
118 views
Record SSH commands sent to a Mac from Windows
I've got a bit of a puzzler - I am an administrator on both a Windows 10 and a Mac Catalina machine.
The Windows machine is currently running software that has a known bug - SSH commands are sent to ...
0
votes
1answer
201 views
Googlecast SSDP and MDNS queries on network despite not having any chromecast applications installed in main computer
As title states,
Ive detected some MDNS queries from a googlecast address, which is strange since i don't have any googlecast apps or similar installed.
Additionally My PC is sending SSDP packets to ...
0
votes
1answer
20 views
need help in finding original url - wireshark
I'm using wireshark to capture data.
Now when I'm hitting sites, I can only see Source - IPv4,Dest - IPv4.
Is there anyway I get to know the exact url it hit.
Like :
https://www.reddit.com/r/meme
...
0
votes
0answers
19 views
AJAX POST fails - client sends RST response…why?
Problem
We have a web application that is used by many thousands of users. However, since the latter part of Jan 2020, a tiny fraction of clients (but still a significant number) have reported a ...
0
votes
2answers
122 views
PXE Boot laptop doesn't send out DHCP discover
ultimately im trying to get a PXE boot laptop to talk to the WDS server. While monitoring the switch using wireshark from laptop #2, it doesn't see ANY DHCP packet during a PXE boot. whereas, I would ...
0
votes
1answer
39 views
Treat TCP as MQTT protocol
I have packets captured during not encrypted MQTT communication:
Protocol is detected as TCP. How to ask Wireshark to analyze packets as MQTT?
UPD
In case I set MQTT server work on default 1883 ...
0
votes
2answers
43 views
Is it possible to sniff packets of other users on connected over LAN in a workspace or college lab? [closed]
I am asking this (for educational purposes) to be alert if this kind of thing happens to me.
0
votes
1answer
398 views
Troubleshooting Network Switching Connectivity
I am managing a network that sporadically has network outages that present as follows
no TCP or ICMP traffic is working between any devices on the network. Two computers with valid ip addresses are ...
2
votes
0answers
13 views
Microsoft CA Problem for Windows 10 Clients with Wireshark Installed
This is a most bizarre scenario, but hoping someone else has ran into this at some point to shed some light.
We are in the process of migrating to a new host Microsoft CA service. There are CA ...
0
votes
0answers
20 views
How to use Wireshark to decode HTTP stream?
I'm using an application that outputs each HTTP stream as two files: connection.out and connection.in. The .out file contains everything the client sends to the server (i.e. requests), and the .in ...
0
votes
0answers
87 views
tcpdump filter for QoS PCP/DEI values in L2 VLAN header
I need tcpdump filter for specific packets which have VLAN ID 10 and some specific PCP/DEI values.
For example I have packet with next VLAN header:
110. .... .... .... = Priority: Voice, < 10ms ...
1
vote
0answers
88 views
How do i convert text capture files back to pcap files?
I have opened Wireshark, selected the a.pcap file, and then went to File->Export and chose (K12 text file) to convert to text. Result is a.txt file.
How can I convert back a.txt file to original pcap ...
0
votes
1answer
27 views
Retrieve data from wireshark (PCAPNG)
I have a PCAPNG file and I need to retrieve two files from it, one is a TXT and the other one is a PNG. The provided file does not have FTP-DATA, it only have ARP, DHCP, DNS, FTP, HTTP, IGMPv3, OCSP, ...
0
votes
1answer
121 views
NBNS Query = ICMP Destination Unreachable
I am having some difficulties when I am trying to get the NetBIOS Name of a machine by it's IP Address with the command (On Windows) nbtstat -A 192.168.1.1, In this example I am trying to get the name ...
1
vote
2answers
253 views
What are the numbers preceeding a DNS packets flags for?
What does the Flags: 0x0500 section of this DNS query packet mean?
Domain Name System (query)
Transaction ID: 0x4242
Flags: 0x0500 Standard query
0... .... .... .... = Response: ...
0
votes
1answer
51 views
Wireless Packet captures - VMware
Software: Wireshark
Is it possible to analyse Wireless Packet captures on VMWare using Linux Ubuntu OS? I ask this as Iām using Windows for my computer but Iām struggling to get all the information I ...
0
votes
0answers
51 views
Communication between two web application through 443 shows TCP connection reset in Wireshark
We have a web application hosted in Azure and it needs to communicate with another server that is in the DMZ through the 443 port.
Using tcpping in the Azure portal's Console screen, I'm able to ping ...
0
votes
0answers
15 views
tshark traffic dump lost data in wireshark
When I capture SNMP traffic with tcpdump and later open dump in wireshark, I can see all SNMP requests/responses.
.
But when I use wireshark-based utilities like tshark or dumpcap, wireshark failed ...
0
votes
1answer
112 views
Are TCP RTO value and RTT value influenced by the packet size?
I am doing troubleshooting in my network.
I found some re-transmission by using wireshark.
The segment 1400 bytes are well transmitted but
The segment 800 bytes are lost and re-transmitted.
I know ...
1
vote
2answers
170 views
I have a loopback traffic in linux involving port 631 and I have no idea what is causing it
So I did some packet capturing in my networking and everything else is actually fine except for this weird communication where source and destination is literally 127.0.0.1, source port is 631, and ...
1
vote
1answer
43 views
How to characterize a physical device on my network?
I have inherited a data centre with very little documentation. The network is split up into multiple vlans (and subnets which don't tally with the vlans). I have a lot of physical devices, some which ...
2
votes
2answers
181 views
Get network data transfer rate / throughput for use in Wireshark
I'm trying to get the ethernet NIC throughput rate / data transfer rate on a VPS in order to start a capture on Wireshark during DOS/DDOS attacks so I can analyze the nature of the packets.
I'm ...
2
votes
0answers
2k views
Fatal error TLS client credential
I have disabled SSLv3, TLS1.0 and 1.1 on a Windows 10 domain joined laptop, I also disabled triple DES 168 and MD5 to comply with our PCI scans and since then the system logs are full of the same ...
0
votes
0answers
34 views
HTML code trying to load PDF file from Site using ssl with self signed certificate
My employer has a web application that loads a pdf file onto the client browser by having a code that does the ff:
embed src="https://somepage.somesite.com/folderpath/somefile.pdf" width="100%" ...
0
votes
1answer
110 views
Capture packets on loopback
I'm running web service on my windows 10 machine. I decided to look at the packets between my service and client running on the same machine by using Wireshark. I know that it is not possible to get ...
1
vote
0answers
29 views
the strange value of SRE in a D-SACK packet
I'm troubleshooting a strange network issue in our production environment.
The dumped pcap file comes from the full NAT mode LVS , and the toploy of the ip address in the dump file is:
172.19.132.90ļ¼...
1
vote
1answer
55 views
Wireshark capture filter from list file
Is it possible to pass Wireshark or tcpdump a file containing a list of host IP addresses and/or networks to be captured?
0
votes
0answers
457 views
Unable to use VNC when connected to OpenVPN
When I try to VNC to a particular machine #1 (192.168.1.221) from within the network I am able to connect to it without issue. When I try to connect from outside the network from my OpenVPN VPN I am ...
1
vote
0answers
661 views
Wireshark running on Host OS not capturing packets from VM
I have Wireshark running on my laptop (Ubuntu 18.04), and I also have Wireshark running inside a VMware Workstation Player with a Backtrack 5 Kali Linux virtual machine image. The VM Network ...
0
votes
1answer
20 views
discover additional scripts loaded from other sites when visiting a website with DNS
I noticed a (relatively) huge amount of dns packets in my wireshark recording while only visiting plain websites. Sites like amazon, facebook, comodoca and many others are requested by dns packets. So ...
-1
votes
2answers
582 views
promiscuous mode when i run wireshark [closed]
I am running Ubuntu Linux and had installed Wireshark on it. I can see the incoming and outgoing traffic just fine. but as you know when you run Wireshark your nic should be on promiscuous mode.
...
3
votes
1answer
245 views
Where in the Windows networking stack do WinPcap/Npcap hook/filter to “listen” for packets?
I'm investigating an issue with a process that performs IPC via a socket. The socket is served on the local machine's NIC's IP, and the connection is made to the local machine's NIC's IP from another ...
0
votes
1answer
326 views
Why is my computer making unreachable ICMP requests to the gateway?
After playing around with the ICMP filter on wireshark, I noticed that my machine is making ICMP requests to the router regularly, which consistently fails:
I noticed that the subsequent ICMP ...
0
votes
0answers
3k views
Why TCP Out-Of-Order packet is seen after SYN?
I am trying to troubleshoot a performance issue between a client and a file server. When I look at the capture from the client, I see a weird behavior. I am trying to understand this weird behavior.
...
1
vote
1answer
2k views
Packets difference between PTP and gPTP
I'm trying to understand few things about gPTP (IEEE 802.1AS). I am using the open source implementation by AVnu (https://github.com/AVnu/gptp).
I looking on the packets using Wireshark, and they ...
0
votes
1answer
551 views
Get mac address based on ip in filter wireshark
i am a test engineer writing some test cases.
I am trying to write a test which has to be performed in wireshark.
However, my collegues aren't that "into wireshark" and i would like to keep it as ...
0
votes
1answer
822 views
How is the Ethernet payload only max 1500, while I can ping with larger size packet?
Just recently I came to know that the payload of Ethernet is max 1500 bytes (mtu).
The first thing that came to my mind was that we can ping with much more size than that. So I thought maybe the ...
0
votes
0answers
571 views
WIreshark Filter to track Exchange Traffic from PC to Exchange Server 2007 and out
I've got a Windows Exchange Server 2007 that appears to be sending mail when I've confirmed nobody is on the network. I'm trying to determine if the exchange server is compromised or if a client on ...
11
votes
2answers
1k views
Why send authoritative nameserver in DNS?
Out of curiosity, I'm checking the Wireshark DNS packets. I can see that there's a DNS query from the host, and then DNS response from the DNS server. Everything is just as expected.
However, if you ...
0
votes
1answer
149 views
Verify TLS version between client and server with HTTP proxy in the middle
I am trying to verify the TLS version that my application is using with a server that I connect to. Normally, I use Wireshark and I see the protocol listed as TLS1.2 or something else.
In the current ...
1
vote
0answers
62 views
Server does not respond to SYN [duplicate]
When I launch an FTP transfer from a client machine, it fails because it cannot connect to the server.
With tcpdump I can see that the client sends a SYN to the server, and I can also see that the ...
0
votes
1answer
394 views
How to turn an ethernet port into a passive listener?
I want to capture ethernet packets with my raspberry pi's ethernet port. I know I could create an ethernet bridge between two ethernet ports on the raspberry and analyze the packets internally with ...
0
votes
1answer
255 views
rpcapd behind a firewall
I have a remote server with rpcapd installed that follows strict security policy rules. Any client can access to the server only via firewall that follows same security policy (please, don't blame me, ...
