Questions tagged [wireshark]
Wireshark is an open source Network Protocol Analyzer under GNU License.
506
questions
0
votes
1
answer
48
views
Proxmox host cannot reach guest: TCP client retransmitting instead of sending ACK after SYN/ACK
Setup: server (HTTP server on 80) on 192.168.1.20, clients on 192.168.1.17, 192.168.1.18
Client 192.168.1.17 can connect to the server fine (Wireshark capture on the client side attached)
1 0.000000 ...
- 101
0
votes
2
answers
261
views
What is Option 60 (Vendor Class Identifier) used for in DHCPv4?
Currently I'm using Wireshark to analyze the DHCP process between wireless devices and my DHCP server (which in this case, is my Wi-Fi router).
On all of the devices that I tested, I noticed that each ...
0
votes
0
answers
73
views
Failing to decrypt kerberos AP_REP with wireshark
I'm trying to decrypt kerberos traffic with wireshark for the learning purposes. My process of following:
First I retrive keytab for the test user with kadmin
kadmin.local: ktadd -k vdzh-fin.keytab ...
- 1
0
votes
0
answers
45
views
How do I convert raw data to text in data field in LPD protocol from wireshark?
I have captured the data sent to a receipt printer (https://starmicronics.com/support/products/tsp100iii-support-page/) using Wireshark. It seems that the printer uses LPD protocol. How do I convert ...
- 101
0
votes
0
answers
66
views
Not able to decrypt traffic with tshark and curl
Run tshark in background tshark -i any -w file_name.pcap -f "(port 443 or port 10002)" on server machine
Run curl command on client machine after setting export SSLKEYLOGFILE=...
- 218
0
votes
0
answers
33
views
Periodic Disconnection with DHCP DISCOVER
LAYOUT
192.168.0.103(THE ONE LOSES THE CONNECTION - WIRESHARK CAPTURE)
192.168.0.84(THE ONE WORKS PROPERLY - WIRESHARK CAPTURE)
We have an app that receives data from one of our devices. We installed ...
0
votes
1
answer
88
views
Continuous [ACK]Packets Without any Response From Receiver
Our application sends some data to one of our devices via TCP/IP, However communication in between not working as it should be.Because TCP/IP is bidirectional, so if one side sends data to other, ...
0
votes
1
answer
241
views
Apache server on Macos Monterey not accepting external public IP connections... why?
I am using MacOS Monterey 12.4 and have configured an Apache 2.4 server with virtual hosts that listen to all interfaces (0.0.0.0:80) on my host. I have tested my private ip (192.168.1.2), external-...
0
votes
2
answers
540
views
PXE with proxyDHCP server: What makes a DHCP client accept / ignore offers from primary DHCP?
I am considering a setup with a primary DHCP server providing "IP data" (IP address, subnet mask, DNS, …), and a proxyDHCP server providing only PXE boot options. As it happens, my proxyDHCP ...
- 23
0
votes
1
answer
176
views
How to track down IPv6 DNS server configuration with Wireshark?
What Wireshark filter should I use to track down IPv6 DNS server advertisements on the network? I don't see any DHCPv6 traffic on my network, so I assume that the config of clients is happening ...
- 9,592
0
votes
0
answers
63
views
Getting duplicated packets when replaying pcap files
The issue at hand is I have pcap files that I want to replay over a network. I used to use playcap to do this with no issue, however recently I noticed that playcap is sending each packet from the ...
- 1
0
votes
0
answers
76
views
Trace Packets in Kubernetes
I am trying to trace packets using sniffer using (https://github.com/eldadru/ksniff) but I am unable to make out how to trace packets and check if cluster IP is in use for Nodeport SVC.
I have the ...
- 1
0
votes
0
answers
94
views
REST requests to an API falls in timeout randomly
0
I developed a web app that communicate with an external API in REST. Most of the time I have no problem, but a few times (1 or 2 times a day) I have my request which is timed out although the ...
- 1
0
votes
0
answers
88
views
Checking for port exhaustion using WireShark
We have been having some rare port exhaustion issues on our computers. We deployed a little netstat monitoring app that tracks the amount of TIME_WAIT statuses per application and notifies us if there ...
1
vote
0
answers
60
views
Why are network packets getting sent to incorrect switch port
All,
I have multiple security monitoring devices that lose communication/connectivity on a regular basis throughout the week.
I have set up WireShark to monitor the network traffic going to/from one ...
- 11
0
votes
0
answers
20
views
Save all unique TCP/IP conversations [duplicate]
I have a tcpdump containing numerous HTTP sessions. I want to save each unique conversation i.e. SYN-to-FIN, in its own file using Wireshark (or any other tool if something else is better suited) ...
- 121
0
votes
0
answers
21
views
Connection drop
Trying to solve this problem here but not 100% sure what's the issue.
4 Fetal monitors and a PC in a clinic are connected to a switch. Those communicate with the PC. 1 to 4 times a day there is a ...
- 1
0
votes
0
answers
26
views
How do I limit packets size in wireshark when I use SSH remote capture?
I'm using Wireshark under windows.
And I need to capture packets from a Linux-based router.
How do I limit packet size when I use SSH remote capture?
in the capture option window, I can set a limit ...
- 1
0
votes
1
answer
342
views
How to detect packets on mirrored port using Promiscuous mode on a VM running on Proxmox
I have a Proxmox server with four network ports eno1, eno2, eno3, eno4. The eno4 is used for management console and internet access using vmbr0 linux bridge. I have created a vmbr1 bridge for the port ...
0
votes
0
answers
288
views
RTP audio Wrong sequence of packets
There is Freeswitch in VM bridged with the local machine. I have a call(say the current time) from baresip(console sip client) and browser(independently). They are on the same machine.
Baresip calls ...
- 101
0
votes
1
answer
72
views
TCP packets being lost
I have some TCP packets being lost. I have monitored the interface with tcpdump pcap file - https://www.dropbox.com/s/7m3hr1b7065tenx/tcp.pcap?dl=0
I noticed that when I lose packets I only get 5 ...
- 1
0
votes
0
answers
119
views
How can I inspect everything that happens before a TCP handshake
On my local machine when I connect to a remote linux machine with netcat I can only see 3 related packets(the tcp handshake) in Wireshark.
I'm pretty sure there's more that happens before that(router -...
0
votes
0
answers
142
views
What does it mean if I don't receive a SMB Negotiate Protocol Response from server?
What does it mean to not get an SMB Negotiate Protocol Response from server? Unable to mount fileshare drive (a third-party fileshare outside Azure). The architecture is similar to this one: https://...
- 1
0
votes
0
answers
136
views
Traffic capture at boot
I'm trying to figure out what packets a linux host sends at boot in order to debug it.
Is there a way to start packet capture during boot time to not miss any packets?
What is your way of going about ...
- 11
2
votes
0
answers
96
views
TShark - Include decrypted tls data in output
I'm trying to read https requests from an application and while I can somewhat make sense of the data using wireshark, I cannot make tshark output the data as I want it. One of the problems I've ...
- 121
0
votes
0
answers
204
views
Difference between TCP Segment Data and Data on a Wireshark capture
I am trying to replicate some TCP communication that is sent from MongoDB and I have been able to replicate it byte by byte and it is still not being recognized.
The only difference I could find when ...
- 235
0
votes
1
answer
50
views
DNS behavior / Wireshark
I'm a Cloud Engineer and currently diving into networking and stuff. I have a question, I have the understanding that whenever I go to a site the first thing is DNS. So a DNS request gets sent to a ...
- 1
1
vote
1
answer
1k
views
How to capture USB traffic using Wireshark in linux CLI?
I've found (hopefully) all I need in order to setup Wireshark and usbmon kernel module - including allowing a non-root user to capture USB traffic: https://www.wireshark.org/docs/wsug_html_chunked/...
- 193
0
votes
1
answer
284
views
Why do I see unicast packets for a different IP when I sniff my interface?
I hook up a laptop via gigabit Ethernet to my corporate network and run Wireshark on the interface. I expect to see all broadcast and multicast traffic and unicast traffic either originating from or ...
- 103
0
votes
0
answers
132
views
Bytes-in-flight higher than receiver window in frozen client connections
I am dealing with sort of a "ghost issue". We have an endpoint URL that some people can use at all times with no issues but others have a frozen connection on the client side (checked with ...
- 1
0
votes
0
answers
858
views
How to find the symmetric key algorithm being used for a TLS connection in Wireshark?
I'm doing a TLS Wireshark lab and I can't find any information in Wireshark, the lab, or online how to find this answer:
What symmetric key cryptography algorithm is being used by the client and ...
- 101
1
vote
1
answer
42
views
Wireshark != doesn't work like it did before version 3.6
I use the filter ip.addr != 10.0.0.0/8 && !(ip.addr == 224.0.0.0/3) to identify any traffic between our network and the outside (and also exclude class-D address space). This filter no longer ...
- 231
2
votes
1
answer
652
views
Duplicated UDP packets sent
We have a few applications that we develop in my company that talk to some hardware via UDP. Recently, we started having issues using these applications on some of our machines (hardware basically ...
- 121
-2
votes
1
answer
164
views
Discover IP address of the device knowing only MAC address
While "wiresharking" the network, You may come across packets that looks like
THIS
eth.src to eth.dst (mainly colored white).. sometimes Wireshark recognize protocol LLC, NDP etc..
but ...
2
votes
1
answer
912
views
Wireshark find DNS response "Refused"
I'm looking for a way to filter a packet capture in wireshark for instances where our server responds with "Refused" to a recursive DNS query.
dns.resp.type== doesn't seem to offer anything ...
- 1,035
0
votes
1
answer
269
views
DNS, why is it sometimes doing a PTR lookup before A lookup?
When I perform NSLOOKUP -q=a chinaa.cn I get the following result in WireShark:
Why did it FIRST look up the PTR of my ISP DNS before sending an A-request?
And why did the DNS server respond first ...
- 144
0
votes
1
answer
58
views
How to inspect outgoing traffic from Acess Point
I have Access Point which is connecting to VPN and create internal WiFi network of our company everywhere. Now I need to inspect what protocol for VPN is this AP using. I am not able to configure it, ...
- 3
1
vote
1
answer
106
views
How to find the linux user that sent the packet [duplicate]
Our server is compromised and we would like to know which accounts sent the malicious queries from our server. I used tcpdump to get this :
our.host.net.48194 > box5596.bluehost.com.http: Flags [P....
- 113
1
vote
0
answers
128
views
Running tshark and find in parallel + strict time-sorted output
I'm trying to obtain debug output of
what "find" does
compared to what happens on the network (tshark)
Therefore I want to run these commands in parallel and have output meticulously ...
- 2,834
0
votes
0
answers
166
views
How to identify source, destination ip using STUN and DTLS protocols?
enter image description here
Given image i'm not able to identify which is source and destination ip address ( client or server). From STUN protocol 1st packet it's user request so i thought 131.202....
1
vote
1
answer
621
views
Piping SSH to wireshark on windows
In my day-to-day operations, I frequently need to execute tcpdump's on remote servers, and it's a pain to save the output to a file and then have to move the file to my laptop to analyze it on ...
- 350
1
vote
0
answers
439
views
'socat' not displaying incoming UDP packets, but Wireshark does
The link is an image of a Wireshark dump of an incoming 60-byte Ethernet frame which contains a UDP packet. The packet payload is the single word 'hello' (sorry, I don't have enough rep to paste the ...
- 81
0
votes
1
answer
423
views
iptables DNAT change not showing up in Wireshark
I want to re-route all incoming traffic on interface ens4f0 to IP address 192.168.50.10, but Wireshark is showing that the destination IP address on incoming packets is unchanged. Is this the expected ...
- 81
0
votes
1
answer
114
views
when router sends ICMP protocol error message how does it set it's own TTL?
when using (traceroute -q 1 serverAddress), we know that it starts with TTL(Time to Live) = 1.
when it goes through router, the router decrements TTL by 1. If TTL becomes 0 at that router, it sends ...
0
votes
2
answers
661
views
How to capture a remote server in different network from home?
I want to capture packets from a remote server using Wireshark. I have a Linux-based server and I can access to it through Putty. This remote server is not on my network. How could I access to a ...
0
votes
1
answer
664
views
Where is the ACK to the packet in frame 76? [closed]
I am working through Kurose's book as part of a class and this particular exercise involves submitting a .txt file to the server and capturing this transfer and the server's response.
In one exercise ...
1
vote
1
answer
563
views
VoIP one-way audio, only when call initiated from one side
I am setting up some new switches and VLANs and I am getting trouble with our pre-existing Asterisk VoIP set-up.
Most calls work ok. Some get just one-way audio. I tried to narrow it down to this ...
- 459
-1
votes
1
answer
762
views
Python sockets: TCP errors in linux, while same program works fine on Windows10
I'm trying to communicate with a commercial power supply device via TCP/IP using python sockets.
I tried using both a virtual linux(centos8stream) and virtual windows10, both running at the same ...
- 21
1
vote
1
answer
129
views
Why is my PC doing more than one DNS query for www.ietf.org? [closed]
I'm doing an exercise for a class where I have to flush the DNS cache and then visit www.ietf.org and capture the packets. I got this:
The selected query and response are the "main" ones. ...
1
vote
0
answers
220
views
TLS 1.2 Failure
I am using Webinspect to scan sites. When going through Webinspect, I get "the client and server cannot communicate because they do not possess a common algorithm".
From the same system, ...
- 11