Questions tagged [wireshark]
Wireshark is an open source Network Protocol Analyzer under GNU License.
466
questions
-1
votes
0answers
66 views
Python sockets: slow or no communication from centos8 linux, while same program from Windows10 works without issue
I'm trying to communicate with a commercial power supply device via TCP/IP using python sockets.
I tried using both a virtual linux(centos8stream) and virtual windows10, both running at the same ...
2
votes
1answer
55 views
Why is my PC doing more than one DNS query for www.ietf.org? [closed]
I'm doing an exercise for a class where I have to flush the DNS cache and then visit www.ietf.org and capture the packets. I got this:
The selected query and response are the "main" ones. ...
1
vote
0answers
17 views
TLS 1.2 Failure
I am using Webinspect to scan sites. When going through Webinspect, I get "the client and server cannot communicate because they do not possess a common algorithm".
From the same system, ...
0
votes
0answers
9 views
dumpcap filter size, and maybe taken from file?
When running `dumpcap -i any -f "host 1.2.3.4 or host 2.3.4.5..." -w file.pcap
how big can the filter be, and is it possible to use a file for filter as input, if I want to capture from let'...
0
votes
0answers
64 views
Slow connection to production MongoDB due to TLS handshake retransmits
I have question about something that had me tearing my hair out for the past two days.
Long story short: specifically over my home network, my connection to our work MongoDB is stupidly slow. Over my ...
0
votes
0answers
52 views
How can wireshark.exe on windows read from a pcap file stream?
This is probably less a wireshark question and more a "how do I pipe a file into an application" on windows.
On linux, I can capture a pcap file on another host with tcpdump and pipe it back ...
2
votes
1answer
98 views
Measuring network bandwidth usage
One VM is sending data to another VM using rsync, both VMs are hosted on the same machine. I've got the task to measure the network bandwidth usage between both VMs and plot it.
Plotting is easy once ...
0
votes
1answer
57 views
tshark : in a HTTP POST request how get form datas in a pretty output?
I'm a teacher and I want to simulate with my students a MITM attack. The goal is to show why the https protocol must be always used.
On debian, I installed tshark. All works fine, when I run the ...
0
votes
0answers
31 views
How to filter out the network timeout cause out of the output of tcpdump, wireshark and such tools?
third party Linux server sending around 15 GB of the data each day via FTP port 21 to my Linux (CentOS) server (headless). Problem is that recent days some of the transferred files timeout:
...
0
votes
1answer
47 views
How can I isolate a single TCP connection on Wireshark?
I just started using Wireshark for network troubleshooting purposes and I am a little confused about one thing. I requested a webpage and for the next 10s I monitored the data. I then used the filter ...
0
votes
0answers
48 views
Long running tshark, not dumpcap, because of JSON output
I need the tshark feature for outputting in JSON, but also need to do long/forever runs.
tshark seems to eat up memory slowly, whereas dumpcap doesn't.
I would like to avoid having to split up files ...
0
votes
0answers
66 views
Decrypting SNMP traffic on wireshark when using Net-SNMP as the SNMP manager
I am trying to figure out SNMPv3. How do you decrypt SNMP traps when using Net-SNMP as an SNMP manager? I'm running both Net-SNMP and Wireshark on Windows 10.
I first tried to decrypt by entering ...
0
votes
1answer
23 views
Can I determine a EWOULDBLOCK/EAGAIN situation from a pcap/tcpdump
Is there a way I can determine if a certain message resulted in an EWOULDBLOCK/EAGAIN return code to the server which sent the packet?
The server was sending messages to the client
At time 10,the ...
0
votes
0answers
31 views
Can't track applications network communication under same machine
I have a network application environment of 7 applications communicating with eachother through UDP and TCP. All of them using either the machine's local network IP or 127.0.0.1 (localhost) to listen ...
0
votes
0answers
167 views
Postfix behind NAT
my network looks like this:
Internet <-> Gateway router(nat) <-> enp0s3 Linux enp0s8(NAT) <-> SMTP server
Without Linux NAT it works ok, but I need it.
When I try to send mail to ...
-1
votes
1answer
39 views
Dumpcap - Ram still reserved after stop
System: Win 10 Pro and latest updates (Sept. 2020) 64Bit.
Problem: Using dumpcap (Dumpcap (Wireshark) 3.2.5 (v3.2.5-0-ged20ddea8138)) with a ringbuffer reserves RAM even after closing the dumpcap.exe. ...
0
votes
2answers
2k views
How to decrypt TLS traffic with Wireshark using RSA asynchronous encryption?
I want to be able to capture and decrypt TLS traffic that one off my internal application (that I don't have access) makes to the internet. (For testing I am using Postman to create a request to a ...
0
votes
0answers
83 views
Sniffing packets over a wifi network, with or without monitor mode using wireshark
So, I am actually confused, there are some guides that say you can't just capture traffic on wireless LAN with promiscuous mode and you need to setup monitor mode, also enter the wifi password to be ...
0
votes
0answers
22 views
Is it possible to get a TCP RWIN histogram with wireshark?
I know that I can get a diagram with the receive window over time for a TCP connection in wireshark when I go to Statistics > TCP Stream Graphs > Window Scaling.
I can also filter for certain ...
1
vote
0answers
265 views
TCP Window Size
Hoping someone can clarify a query I have in relation to TCP window size and whether it could be contributing to my slow throughput achieved via iPerf.
I took a Wireshark capture from a client while ...
0
votes
0answers
73 views
HTTP webservice no response
We have some issues on a connection between 2 devices through ASP webservices. On Wireshark, we saw that the request arrives to the destination computer and the IIS sends the response, but the origin ...
0
votes
0answers
91 views
Wireshark TLS conversation for ldaps
I am trying to troubleshoot an issue with delays in LDAPS bind operations with tcpdump/wireshark.
Here is what I get from client side on a conversation with delays:
I see the following problems:
I ...
0
votes
0answers
15 views
How to find out which http/s request is blocked due to hosts file?
I saw many packets on loopback (lo0) interface on wireshark and tcpdump like this
171 1118.753013 127.0.0.1 127.0.0.1 443 TCP 68 54857 → 443 [SYN] Seq=0 Win=65535 Len=0 MSS=16344 WS=32 TSval=...
0
votes
1answer
95 views
How does a web browser parse the raw bytes of each part of a DNS name to a human readable form? [closed]
My focus is to parse the structure of a DNS packet programmatically using python.
Consider the snap where my browser send a large domain name through the pipe without even complaining.
Let's take a ...
0
votes
0answers
18 views
IIS servers/apps loosing connection
We have a setup where DataPower servers send a request to our F5, that request is handled by one of 9 IIS servers, Windows 2008. Each one is a short lived session of up to two min. There are several ...
1
vote
0answers
130 views
Debugging port forwarding in Docker
Manager
I have a docker swarm setup on a mesh VPN. My manager is on 10.0.0.1. I have run:
docker swarm init --advertise-addr=wg0
which then uses the VPN IP to listen on 10.0.0.1 opposed to the ...
0
votes
2answers
259 views
What is blocking my mysql connection?
We run several docker images on a VM.
sudo iptables -S shows a lot of docker networking.
We try to connect to an external MySQL database in another net.
mysql --host=mysql.example.org --user=thisuser ...
0
votes
1answer
254 views
Decoding TCP packets as RTP in Wireshark
I'm troubleshooting a WebRTC video calling problem in my app and i'm using Wireshark.
One end of my video call is a web app running in my browser window and the other end is a Unity based app on an ...
-1
votes
1answer
82 views
SSH connection not established, but standard TCP/IP connection works
I'm working on a custom yocto Linux for a Raspberry PI 3 and try to get the WIFI connection working with SSH. However when trying to connect from my PC (Ubuntu 19.10, SSH OpenSSH_8.0p1 Ubuntu-6build1, ...
0
votes
1answer
81 views
Steamapi Dns calls without steam being open
So , after some time I re-opened wireshark to update it and I saw something pretty strange, now I'm really not sure what this is and that might just be a basic thing but I can't seem to understand why ...
0
votes
1answer
21 views
Is it possible to capture packets of router which i connected through wifi of my laptop
I want to capture all traffic of router I can only connect with wifi no physical access and I do have access to configuration page of router
1
vote
2answers
211 views
Record SSH commands sent to a Mac from Windows
I've got a bit of a puzzler - I am an administrator on both a Windows 10 and a Mac Catalina machine.
The Windows machine is currently running software that has a known bug - SSH commands are sent to ...
1
vote
2answers
2k views
Googlecast SSDP and MDNS queries on network despite not having any chromecast applications installed in main computer
As title states,
Ive detected some MDNS queries from a googlecast address, which is strange since i don't have any googlecast apps or similar installed.
Additionally My PC is sending SSDP packets to ...
0
votes
1answer
23 views
need help in finding original url - wireshark
I'm using wireshark to capture data.
Now when I'm hitting sites, I can only see Source - IPv4,Dest - IPv4.
Is there anyway I get to know the exact url it hit.
Like :
https://www.reddit.com/r/meme
...
0
votes
0answers
57 views
AJAX POST fails - client sends RST response…why?
Problem
We have a web application that is used by many thousands of users. However, since the latter part of Jan 2020, a tiny fraction of clients (but still a significant number) have reported a ...
0
votes
2answers
183 views
PXE Boot laptop doesn't send out DHCP discover
ultimately im trying to get a PXE boot laptop to talk to the WDS server. While monitoring the switch using wireshark from laptop #2, it doesn't see ANY DHCP packet during a PXE boot. whereas, I would ...
0
votes
1answer
70 views
Treat TCP as MQTT protocol
I have packets captured during not encrypted MQTT communication:
Protocol is detected as TCP. How to ask Wireshark to analyze packets as MQTT?
UPD
In case I set MQTT server work on default 1883 ...
0
votes
2answers
61 views
Is it possible to sniff packets of other users on connected over LAN in a workspace or college lab? [closed]
I am asking this (for educational purposes) to be alert if this kind of thing happens to me.
0
votes
1answer
399 views
Troubleshooting Network Switching Connectivity
I am managing a network that sporadically has network outages that present as follows
no TCP or ICMP traffic is working between any devices on the network. Two computers with valid ip addresses are ...
2
votes
0answers
24 views
Microsoft CA Problem for Windows 10 Clients with Wireshark Installed
This is a most bizarre scenario, but hoping someone else has ran into this at some point to shed some light.
We are in the process of migrating to a new host Microsoft CA service. There are CA ...
1
vote
0answers
388 views
How do i convert text capture files back to pcap files?
I have opened Wireshark, selected the a.pcap file, and then went to File->Export and chose (K12 text file) to convert to text. Result is a.txt file.
How can I convert back a.txt file to original pcap ...
0
votes
1answer
144 views
Retrieve data from wireshark (PCAPNG)
I have a PCAPNG file and I need to retrieve two files from it, one is a TXT and the other one is a PNG. The provided file does not have FTP-DATA, it only have ARP, DHCP, DNS, FTP, HTTP, IGMPv3, OCSP, ...
0
votes
1answer
274 views
NBNS Query = ICMP Destination Unreachable
I am having some difficulties when I am trying to get the NetBIOS Name of a machine by it's IP Address with the command (On Windows) nbtstat -A 192.168.1.1, In this example I am trying to get the name ...
1
vote
2answers
832 views
What are the numbers preceeding a DNS packets flags for?
What does the Flags: 0x0500 section of this DNS query packet mean?
Domain Name System (query)
Transaction ID: 0x4242
Flags: 0x0500 Standard query
0... .... .... .... = Response: ...
0
votes
1answer
77 views
Wireless Packet captures - VMware
Software: Wireshark
Is it possible to analyse Wireless Packet captures on VMWare using Linux Ubuntu OS? I ask this as I’m using Windows for my computer but I’m struggling to get all the information I ...
0
votes
1answer
172 views
Are TCP RTO value and RTT value influenced by the packet size?
I am doing troubleshooting in my network.
I found some re-transmission by using wireshark.
The segment 1400 bytes are well transmitted but
The segment 800 bytes are lost and re-transmitted.
I know ...
1
vote
2answers
316 views
I have a loopback traffic in linux involving port 631 and I have no idea what is causing it
So I did some packet capturing in my networking and everything else is actually fine except for this weird communication where source and destination is literally 127.0.0.1, source port is 631, and ...
1
vote
1answer
43 views
How to characterize a physical device on my network?
I have inherited a data centre with very little documentation. The network is split up into multiple vlans (and subnets which don't tally with the vlans). I have a lot of physical devices, some which ...
2
votes
2answers
620 views
Get network data transfer rate / throughput for use in Wireshark
I'm trying to get the ethernet NIC throughput rate / data transfer rate on a VPS in order to start a capture on Wireshark during DOS/DDOS attacks so I can analyze the nature of the packets.
I'm ...
2
votes
0answers
3k views
Fatal error TLS client credential
I have disabled SSLv3, TLS1.0 and 1.1 on a Windows 10 domain joined laptop, I also disabled triple DES 168 and MD5 to comply with our PCI scans and since then the system logs are full of the same ...
