38 votes

How can I sniff the traffic of remote machine with wireshark?

I use this oneliner as root. Is very useful! ssh root@sniff_server_ip -p port tcpdump -U -s0 'not port 22' -i eth0 -w - | wireshark -k -i - The last - before de | is the redirection of that output ...
  • 481
38 votes
Accepted

What's the Wireshark packet receiving and processing procedure on a Windows machine?

The I/O model in Windows is based on a stack of components. Data must flow through the various components of that stack that exists between the physical network card, and the application that will ...
  • 55.2k
21 votes

How can I measure the cumulative network usage of a process, from execution beginning to end

If you launch nethogs and then press the m key, it will switch from instantaneous mode (kB/s) to cumulative mode (kB).
  • 533
20 votes

How to filter http traffic in Wireshark?

Simply use a DisplayFilter http like this:
17 votes

How to send captured packets to a different destination?

I wanted to capture some SNMP traps and keep them to test my application later. So I don't want to generate traps each time I wanted to test my application. I would like to post how I have done this. ...
15 votes
Accepted

Why send authoritative nameserver in DNS?

Traditionally name servers don't send a short response to a query but an RFC 1034-1035 compliant full response which includes the authority section that contains Resource Records that point toward ...
  • 73.5k
13 votes
Accepted

Disable TLS 1.2 stops RST packets

Are you 100% sure he is not testing with a higher or lower version of TLS, packet resets normally are attributed to the application not knowing what to do with it.
12 votes

Wireshark is not showing my network interface?

I just had the same problem. I removed everything (Wireshark and Winpcap) rebooted,then installed Win10Pcap and reinstalled Wireshark without installing Winpcap and it seems to be working.
7 votes

How can I filter https when monitoring traffic with Wireshark?

You can use the "tls" filter: TLS stands for Transport Layer Security, which is the successor to the SSL protocol. If you're trying to inspect an HTTPS request, this filter may be what you're ...
7 votes
Accepted

What's the correct syntax for tcp.dstport in display filters

I think you need to use == rather than =. Take a look at the documentation and some examples.
  • 115k
6 votes

How can I filter https when monitoring traffic with Wireshark?

Filter tcp.port==443 and then use the (Pre)-Master-Secret obtained from a web browser to decrypt the traffic. Some helpful links: https://security.stackexchange.com/questions/35639/decrypting-tls-...
  • 354
6 votes
Accepted

How would a PCAP filter look like to capture all DHCP related traffic?

I settled with the following PCAP filter: ( udp and ( port 67 or port 68 ) ) or arp or ( icmp and (icmp[icmptype] == 8 or icmp[icmptype] == 0 ) ) or ( udp and ( port 546 or port 547 ) ) or ( icmp6 ...
6 votes

Wireshark is not showing my network interface?

I have similar issues on certain systems and the solution for me is to launch Wireshark as Administrator by right-clicking its shortcut and selecting Run as Administrator. For me, that fixes it and it ...
  • 201
6 votes
Accepted

Why is my PC doing more than one DNS query for www.ietf.org?

There are multiple queries because of using CNAME records, which is very often the case when using CDNs. You can see it easily: $ dig www.ietf.org +noall +ans www.ietf.org. 16m2s IN CNAME www....
5 votes

How can I sniff the traffic of remote machine with wireshark?

Under RHEL, konrad's answer didn't work for me because tcpdump requires root, and I only have sudo access. What did work was to create an extra remote fifo that I can read from: remote:~$ mkfifo pcap ...
  • 186
5 votes

Why is wireshark capturing packets not destined to my host?

Wireshark, being a network sniffer, put both the interface firmware (if present) and driver into promiscuous mode, meaning that it instruct the network stack to capure any packets arriving at your ...
  • 45.1k
5 votes

How do I capture all packets on local wifi network using Wireshark settings -

Ok. After your comments and update, I will try to answer, even though I'm still not sure I'm getting the question right. I guess you have 2 WiFi devices, lets call "host" the legitimate network ...
  • 1,853
5 votes

Why send authoritative nameserver in DNS?

The server doesn't know whether the request is coming from an end client, or is a recursive request from another nameserver. If it's another nameserver, it can cache the Authority Section and query ...
  • 354
4 votes
Accepted

What is "Cisco STG" and why would it dynamically replace a wildcard certificate on port 5061?

It appears that someone can't spell phoneproxy correctly when they typed it in setting it up. Regardless it's for CUCM's phone proxy feature on an ASDM firewall. See here: http://www.cisco.com/c/en/...
  • 32.5k
4 votes

Understand wireshark capture for ssh key exchange

The client and the server begin by sending to each other the protocol and software versions they are using. SSHv2 Client: Key Exchange Init Here, the client tells the server the algorithms it ...
  • 153
4 votes

Why Wireshark does not recognize this HTTP response?

To explain the why of Zorel's answer .... When the WireShark preference is to reassemble multi-packet messages, it doesn't know that the messages is HTTP until it has seen it all and the reassembly ...
4 votes

How can the SSDP protocol be filtered out of Wireshark view?

I just used the functionality in the tool, by right clicking one of the packets that was problematic, then selected the sub-menu "Apply as Filter" > then selected ".. and not Selected" (under the "Not ...
  • 1,924
4 votes
Accepted

Why do different packet analyzers sometimes produce different results?

The protocol field is the application's best guess at the nature of the protocol. It is not part of the actual capture.
  • 109k
4 votes
Accepted

How do I see absolute time stamps in Wireshark?

(from comment) A pcap file (from tcpdump or wireshark or AFAIK anything else using libpcap) already has absolute time; it's only the Wireshark display you need to adjust. In the View menu click Time ...
4 votes
Accepted

How to display only the source port with tshark

Like this tshark -e tcp.srcport -T fields
4 votes
Accepted

Heavy TCP traffic on loopback

The SYN/RST indicates that the port is closed so then the application closes the connection which means that it would be visible in netstat during only a fraction of a second. You can try to drop the ...
  • 133
4 votes

What application is connecting to a remote site?

Let us see... The IP address 165.254.162.243 is on AS14627, which is a company named Vitalwerks. WHOIS tells me that they have the entire /24. A brief look at Google tells me Vitalwerks is the ...
4 votes

Googlecast SSDP and MDNS queries on network despite not having any chromecast applications installed in main computer

You're observing two different things that are independent from each other. The SSDP traffic is just a general "poll" for devices that matches the search. 239.255.255.250 is a multicast ...
  • 86
4 votes

How to capture a remote server in different network from home?

You can run wireshark on remote server (e.g. via ssh) and transfer results back to your machine for convenience. E.g. this article has an example: ssh root@server.com 'tshark -f "port !22" -...
  • 4,075

Only top scored, non community-wiki answers of a minimum length are eligible