41
votes
How can I sniff the traffic of remote machine with wireshark?
I use this oneliner as root. Is very useful!
ssh root@sniff_server_ip -p port tcpdump -U -s0 'not port 22' -i eth0 -w - | wireshark -k -i -
The last - before de | is the redirection of that output ...
- 511
38
votes
Accepted
What's the Wireshark packet receiving and processing procedure on a Windows machine?
The I/O model in Windows is based on a stack of components. Data must flow through the various components of that stack that exists between the physical network card, and the application that will ...
- 55.9k
22
votes
How can I measure the cumulative network usage of a process, from execution beginning to end
If you launch nethogs and then press the m key, it will switch from instantaneous mode (kB/s) to cumulative mode (kB).
- 553
15
votes
Accepted
Why send authoritative nameserver in DNS?
Traditionally name servers don't send a short response to a query but an RFC 1034-1035 compliant full response which includes the authority section that contains Resource Records that point toward ...
- 80.3k
13
votes
Accepted
Disable TLS 1.2 stops RST packets
Are you 100% sure he is not testing with a higher or lower version of TLS, packet resets normally are attributed to the application not knowing what to do with it.
- 424
12
votes
Wireshark is not showing my network interface?
I just had the same problem. I removed everything (Wireshark and Winpcap) rebooted,then installed Win10Pcap and reinstalled Wireshark without installing Winpcap and it seems to be working.
- 121
9
votes
How can I filter https when monitoring traffic with Wireshark?
You can use the "tls" filter:
TLS stands for Transport Layer Security, which is the successor to the SSL protocol. If you're trying to inspect an HTTPS request, this filter may be what you're ...
- 191
7
votes
Accepted
What's the correct syntax for tcp.dstport in display filters
I think you need to use == rather than =. Take a look at the documentation and some examples.
- 116k
7
votes
tcpdump -vvv is not verbose enough
The details from tcpdump -vvv -i interface are less than the details that are being put into the pcap file using tcpdump -i interface -w output.
That is correct.
With -w the full raw packet gets ...
- 80.3k
6
votes
Wireshark is not showing my network interface?
I have similar issues on certain systems and the solution for me is to launch Wireshark as Administrator by right-clicking its shortcut and selecting Run as Administrator. For me, that fixes it and it ...
- 201
6
votes
Accepted
Why is my PC doing more than one DNS query for www.ietf.org?
There are multiple queries because of using CNAME records, which is very often the case when using CDNs.
You can see it easily:
$ dig www.ietf.org +noall +ans
www.ietf.org. 16m2s IN CNAME www....
- 10.2k
5
votes
Accepted
How do I see absolute time stamps in Wireshark?
(from comment)
A pcap file (from tcpdump or wireshark or AFAIK anything else using libpcap) already has absolute time; it's only the Wireshark display you need to adjust.
In the View menu click Time ...
- 3,469
5
votes
How can I sniff the traffic of remote machine with wireshark?
Under RHEL, konrad's answer didn't work for me because tcpdump requires root, and I only have sudo access. What did work was to create an extra remote fifo that I can read from:
remote:~$ mkfifo pcap
...
- 196
5
votes
How do I capture all packets on local wifi network using Wireshark settings -
Ok. After your comments and update, I will try to answer, even though I'm still not sure I'm getting the question right.
I guess you have 2 WiFi devices, lets call "host" the legitimate network ...
- 1,933
5
votes
Why send authoritative nameserver in DNS?
The server doesn't know whether the request is coming from an end client, or is a recursive request from another nameserver. If it's another nameserver, it can cache the Authority Section and query ...
- 374
5
votes
Accepted
Why is my computer making unreachable ICMP requests to the gateway?
These are no ICMP requests. Instead they are the reaction to something done by your router: based on the information you show your router (192.168.0.4) was sending a UDP packet with source port 53 to ...
- 13.7k
4
votes
Why Wireshark does not recognize this HTTP response?
To explain the why of Zorel's answer ....
When the WireShark preference is to reassemble multi-packet messages, it doesn't know that the messages is HTTP until it has seen it all and the reassembly ...
- 141
4
votes
Accepted
Why do different packet analyzers sometimes produce different results?
The protocol field is the application's best guess at the nature of the protocol. It is not part of the actual capture.
- 110k
4
votes
Accepted
4
votes
Accepted
Heavy TCP traffic on loopback
The SYN/RST indicates that the port is closed so then the application closes the connection which means that it would be visible in netstat during only a fraction of a second.
You can try to drop the ...
- 133
4
votes
What application is connecting to a remote site?
Let us see...
The IP address 165.254.162.243 is on AS14627, which is a company named Vitalwerks. WHOIS tells me that they have the entire /24.
A brief look at Google tells me Vitalwerks is the ...
- 248k
4
votes
Accepted
How can I decrypt STARTTLS communication over SMTP in a packet capture (if I have the private key)?
Knowledge of the RSA private key is only sufficient if RSA key exchange is done. Modern systems instead use Diffie Helmann key exchange (DHE*, ECDHE* ciphers) to provide forward secrecy. In this case ...
- 13.7k
4
votes
Monitor where an application is connecting to on MacOSX
Using wireshark
Wireshark doesn't support isolating traffic for a specific app.
You would have to close every other app running on your OSX to reduce the noise.
Once you find the tcp stream created ...
- 2,781
4
votes
Googlecast SSDP and MDNS queries on network despite not having any chromecast applications installed in main computer
You're observing two different things that are independent from each other.
The SSDP traffic is just a general "poll" for devices that matches the search. 239.255.255.250 is a multicast ...
- 86
4
votes
How to capture a remote server in different network from home?
You can run wireshark on remote server (e.g. via ssh) and transfer results back to your machine for convenience.
E.g. this article has an example: ssh [email protected] 'tshark -f "port !22" -...
- 4,165
4
votes
Accepted
DNS, why is it sometimes doing a PTR lookup before A lookup?
NSLOOKUP first displays the IP address of the DNS server it sends the request to, along with its DNS name. If the DNS name is not already in the DNS cache, then it sends a PTR request to get the name.
- 23.2k
4
votes
How to capture USB traffic using Wireshark in linux CLI?
It looks like it's tshark command in charge of capturing stuff from the command line.
First, we need to identify the device we want to capture. Use tshark -D
$ tshark -D
1. enp1s0
2. lo (Loopback)
3. ...
- 203
3
votes
Is there a quick way to determine what applications are present within a Wireshark capture? If so how
WireShark sits too low in the network stack to have any information on which processes sent or received traffic. The trick is to know something about what you're looking for - it shouldn't take that ...
- 15.5k
3
votes
Accepted
How do you continuously run Wireshark without eating up all of my RAM?
For Windows environments (like mine where it is a big deal to install wireshark on a server), ever since Win7/2008R2 there has been built in packet capture available.
This will capture everything ...
- 1,834
Only top scored, non community-wiki answers of a minimum length are eligible