38
votes
How can I sniff the traffic of remote machine with wireshark?
I use this oneliner as root. Is very useful!
ssh root@sniff_server_ip -p port tcpdump -U -s0 'not port 22' -i eth0 -w - | wireshark -k -i -
The last - before de | is the redirection of that output ...
- 481
38
votes
Accepted
What's the Wireshark packet receiving and processing procedure on a Windows machine?
The I/O model in Windows is based on a stack of components. Data must flow through the various components of that stack that exists between the physical network card, and the application that will ...
- 55.2k
21
votes
How can I measure the cumulative network usage of a process, from execution beginning to end
If you launch nethogs and then press the m key, it will switch from instantaneous mode (kB/s) to cumulative mode (kB).
- 533
20
votes
17
votes
How to send captured packets to a different destination?
I wanted to capture some SNMP traps and keep them to test my application later. So I don't want to generate traps each time I wanted to test my application.
I would like to post how I have done this. ...
- 466
15
votes
Accepted
Why send authoritative nameserver in DNS?
Traditionally name servers don't send a short response to a query but an RFC 1034-1035 compliant full response which includes the authority section that contains Resource Records that point toward ...
- 73.5k
13
votes
Accepted
Disable TLS 1.2 stops RST packets
Are you 100% sure he is not testing with a higher or lower version of TLS, packet resets normally are attributed to the application not knowing what to do with it.
- 414
12
votes
Wireshark is not showing my network interface?
I just had the same problem. I removed everything (Wireshark and Winpcap) rebooted,then installed Win10Pcap and reinstalled Wireshark without installing Winpcap and it seems to be working.
- 121
7
votes
How can I filter https when monitoring traffic with Wireshark?
You can use the "tls" filter:
TLS stands for Transport Layer Security, which is the successor to the SSL protocol. If you're trying to inspect an HTTPS request, this filter may be what you're ...
- 171
7
votes
Accepted
What's the correct syntax for tcp.dstport in display filters
I think you need to use == rather than =. Take a look at the documentation and some examples.
- 115k
6
votes
How can I filter https when monitoring traffic with Wireshark?
Filter tcp.port==443 and then use the (Pre)-Master-Secret obtained from a web browser to decrypt the traffic.
Some helpful links:
https://security.stackexchange.com/questions/35639/decrypting-tls-...
- 354
6
votes
Accepted
How would a PCAP filter look like to capture all DHCP related traffic?
I settled with the following PCAP filter:
( udp and ( port 67 or port 68 ) )
or arp
or ( icmp and (icmp[icmptype] == 8 or icmp[icmptype] == 0 ) )
or ( udp and ( port 546 or port 547 ) )
or ( icmp6 ...
- 417
6
votes
Wireshark is not showing my network interface?
I have similar issues on certain systems and the solution for me is to launch Wireshark as Administrator by right-clicking its shortcut and selecting Run as Administrator. For me, that fixes it and it ...
- 201
6
votes
Accepted
Why is my PC doing more than one DNS query for www.ietf.org?
There are multiple queries because of using CNAME records, which is very often the case when using CDNs.
You can see it easily:
$ dig www.ietf.org +noall +ans
www.ietf.org. 16m2s IN CNAME www....
- 9,586
5
votes
How can I sniff the traffic of remote machine with wireshark?
Under RHEL, konrad's answer didn't work for me because tcpdump requires root, and I only have sudo access. What did work was to create an extra remote fifo that I can read from:
remote:~$ mkfifo pcap
...
- 186
5
votes
Why is wireshark capturing packets not destined to my host?
Wireshark, being a network sniffer, put both the interface firmware (if present) and driver into promiscuous mode, meaning that it instruct the network stack to capure any packets arriving at your ...
- 45.1k
5
votes
How do I capture all packets on local wifi network using Wireshark settings -
Ok. After your comments and update, I will try to answer, even though I'm still not sure I'm getting the question right.
I guess you have 2 WiFi devices, lets call "host" the legitimate network ...
- 1,853
5
votes
Why send authoritative nameserver in DNS?
The server doesn't know whether the request is coming from an end client, or is a recursive request from another nameserver. If it's another nameserver, it can cache the Authority Section and query ...
- 354
4
votes
Accepted
What is "Cisco STG" and why would it dynamically replace a wildcard certificate on port 5061?
It appears that someone can't spell phoneproxy correctly when they typed it in setting it up.
Regardless it's for CUCM's phone proxy feature on an ASDM firewall.
See here: http://www.cisco.com/c/en/...
- 32.5k
4
votes
Understand wireshark capture for ssh key exchange
The client and the server begin by sending to each other the protocol and software versions they are using.
SSHv2 Client: Key Exchange Init
Here, the client tells the server the algorithms it ...
- 153
4
votes
Why Wireshark does not recognize this HTTP response?
To explain the why of Zorel's answer ....
When the WireShark preference is to reassemble multi-packet messages, it doesn't know that the messages is HTTP until it has seen it all and the reassembly ...
- 141
4
votes
How can the SSDP protocol be filtered out of Wireshark view?
I just used the functionality in the tool, by right clicking one of the packets that was problematic, then selected the sub-menu "Apply as Filter" > then selected ".. and not Selected" (under the "Not ...
- 1,924
4
votes
Accepted
Why do different packet analyzers sometimes produce different results?
The protocol field is the application's best guess at the nature of the protocol. It is not part of the actual capture.
- 109k
4
votes
Accepted
How do I see absolute time stamps in Wireshark?
(from comment)
A pcap file (from tcpdump or wireshark or AFAIK anything else using libpcap) already has absolute time; it's only the Wireshark display you need to adjust.
In the View menu click Time ...
- 3,160
4
votes
Accepted
4
votes
Accepted
Heavy TCP traffic on loopback
The SYN/RST indicates that the port is closed so then the application closes the connection which means that it would be visible in netstat during only a fraction of a second.
You can try to drop the ...
- 133
4
votes
What application is connecting to a remote site?
Let us see...
The IP address 165.254.162.243 is on AS14627, which is a company named Vitalwerks. WHOIS tells me that they have the entire /24.
A brief look at Google tells me Vitalwerks is the ...
- 240k
4
votes
Googlecast SSDP and MDNS queries on network despite not having any chromecast applications installed in main computer
You're observing two different things that are independent from each other.
The SSDP traffic is just a general "poll" for devices that matches the search. 239.255.255.250 is a multicast ...
- 86
4
votes
How to capture a remote server in different network from home?
You can run wireshark on remote server (e.g. via ssh) and transfer results back to your machine for convenience.
E.g. this article has an example: ssh root@server.com 'tshark -f "port !22" -...
- 4,075
Only top scored, non community-wiki answers of a minimum length are eligible