Skip to main content
43 votes

How can I sniff the traffic of remote machine with wireshark?

I use this oneliner as root. Is very useful! ssh root@sniff_server_ip -p port tcpdump -U -s0 'not port 22' -i eth0 -w - | wireshark -k -i - The last - before de | is the redirection of that output ...
ctaglia's user avatar
  • 531
39 votes
Accepted

What's the Wireshark packet receiving and processing procedure on a Windows machine?

The I/O model in Windows is based on a stack of components. Data must flow through the various components of that stack that exists between the physical network card, and the application that will ...
Ryan Ries's user avatar
  • 56k
23 votes

How can I measure the cumulative network usage of a process, from execution beginning to end

If you launch nethogs and then press the m key, it will switch from instantaneous mode (kB/s) to cumulative mode (kB).
Phrogz's user avatar
  • 563
15 votes
Accepted

Why send authoritative nameserver in DNS?

Traditionally name servers don't send a short response to a query but an RFC 1034-1035 compliant full response which includes the authority section that contains Resource Records that point toward ...
HBruijn's user avatar
  • 81k
13 votes
Accepted

Disable TLS 1.2 stops RST packets

Are you 100% sure he is not testing with a higher or lower version of TLS, packet resets normally are attributed to the application not knowing what to do with it.
Donna Delour's user avatar
12 votes

Wireshark is not showing my network interface?

I just had the same problem. I removed everything (Wireshark and Winpcap) rebooted,then installed Win10Pcap and reinstalled Wireshark without installing Winpcap and it seems to be working.
user395287's user avatar
9 votes

How can I filter https when monitoring traffic with Wireshark?

You can use the "tls" filter: TLS stands for Transport Layer Security, which is the successor to the SSL protocol. If you're trying to inspect an HTTPS request, this filter may be what you're ...
Richie Thomas's user avatar
7 votes
Accepted

What's the correct syntax for tcp.dstport in display filters

I think you need to use == rather than =. Take a look at the documentation and some examples.
user9517's user avatar
  • 116k
7 votes

tcpdump -vvv is not verbose enough

The details from tcpdump -vvv -i interface are less than the details that are being put into the pcap file using tcpdump -i interface -w output. That is correct. With -w the full raw packet gets ...
HBruijn's user avatar
  • 81k
6 votes

Wireshark is not showing my network interface?

I have similar issues on certain systems and the solution for me is to launch Wireshark as Administrator by right-clicking its shortcut and selecting Run as Administrator. For me, that fixes it and it ...
Jesse P.'s user avatar
  • 201
6 votes
Accepted

Why is my PC doing more than one DNS query for www.ietf.org?

There are multiple queries because of using CNAME records, which is very often the case when using CDNs. You can see it easily: $ dig www.ietf.org +noall +ans www.ietf.org. 16m2s IN CNAME www....
Patrick Mevzek's user avatar
5 votes

How can I sniff the traffic of remote machine with wireshark?

Under RHEL, konrad's answer didn't work for me because tcpdump requires root, and I only have sudo access. What did work was to create an extra remote fifo that I can read from: remote:~$ mkfifo pcap ...
Dan's user avatar
  • 196
5 votes

How do I capture all packets on local wifi network using Wireshark settings -

Ok. After your comments and update, I will try to answer, even though I'm still not sure I'm getting the question right. I guess you have 2 WiFi devices, lets call "host" the legitimate network ...
Leo Gallego's user avatar
  • 1,943
5 votes

Why send authoritative nameserver in DNS?

The server doesn't know whether the request is coming from an end client, or is a recursive request from another nameserver. If it's another nameserver, it can cache the Authority Section and query ...
Barmar's user avatar
  • 394
5 votes
Accepted

Why is my computer making unreachable ICMP requests to the gateway?

These are no ICMP requests. Instead they are the reaction to something done by your router: based on the information you show your router (192.168.0.4) was sending a UDP packet with source port 53 to ...
Steffen Ullrich's user avatar
4 votes

Why Wireshark does not recognize this HTTP response?

To explain the why of Zorel's answer .... When the WireShark preference is to reassemble multi-packet messages, it doesn't know that the messages is HTTP until it has seen it all and the reassembly ...
Jesse Chisholm's user avatar
4 votes
Accepted

How to display only the source port with tshark

Like this tshark -e tcp.srcport -T fields
Dmitry Zayats's user avatar
4 votes
Accepted

Heavy TCP traffic on loopback

The SYN/RST indicates that the port is closed so then the application closes the connection which means that it would be visible in netstat during only a fraction of a second. You can try to drop the ...
spongebob's user avatar
  • 133
4 votes

What application is connecting to a remote site?

Let us see... The IP address 165.254.162.243 is on AS14627, which is a company named Vitalwerks. WHOIS tells me that they have the entire /24. A brief look at Google tells me Vitalwerks is the ...
Michael Hampton's user avatar
4 votes
Accepted

How can I decrypt STARTTLS communication over SMTP in a packet capture (if I have the private key)?

Knowledge of the RSA private key is only sufficient if RSA key exchange is done. Modern systems instead use Diffie Helmann key exchange (DHE*, ECDHE* ciphers) to provide forward secrecy. In this case ...
Steffen Ullrich's user avatar
4 votes

Monitor where an application is connecting to on MacOSX

Using wireshark Wireshark doesn't support isolating traffic for a specific app. You would have to close every other app running on your OSX to reduce the noise. Once you find the tcp stream created ...
Luca Gibelli's user avatar
  • 2,801
4 votes

Googlecast SSDP and MDNS queries on network despite not having any chromecast applications installed in main computer

You're observing two different things that are independent from each other. The SSDP traffic is just a general "poll" for devices that matches the search. 239.255.255.250 is a multicast ...
Nadar's user avatar
  • 86
4 votes

How to capture a remote server in different network from home?

You can run wireshark on remote server (e.g. via ssh) and transfer results back to your machine for convenience. E.g. this article has an example: ssh [email protected] 'tshark -f "port !22" -...
rvs's user avatar
  • 4,175
4 votes
Accepted

DNS, why is it sometimes doing a PTR lookup before A lookup?

NSLOOKUP first displays the IP address of the DNS server it sends the request to, along with its DNS name. If the DNS name is not already in the DNS cache, then it sends a PTR request to get the name.
longneck's user avatar
  • 23.2k
4 votes

How to capture USB traffic using Wireshark in linux CLI?

It looks like it's tshark command in charge of capturing stuff from the command line. First, we need to identify the device we want to capture. Use tshark -D $ tshark -D 1. enp1s0 2. lo (Loopback) 3. ...
tishma's user avatar
  • 203
3 votes
Accepted

Decoding ssl packets with cipher TLS_ECDHE_RSA in wireshark

The answer to your question is No, because of ECDHE_RSA. Now let us see why this is so. Let's look at the entire ciphersuite specification TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256 in detail: TLS - ...
the-wabbit's user avatar
  • 41.1k
3 votes
Accepted

Wireshark trace file RST after FIN packet

According to The TCP Guide on terminations, the usual order of events is: ---> FIN <--- ACK <--- Waits for the application with the socket to ACK the connection-close <--- FIN ---> ACK ...
sysadmin1138's user avatar
  • 135k
3 votes
Accepted

Get network data transfer rate / throughput for use in Wireshark

You can run TShark with these options: tshark -i 1 -a duration:30 -q -z io,stat,0 Meaning: -i 1 : Listen on your first interface. Adjust as needed for your desired interface. (You can use tshark -D ...
Doug Deden's user avatar
  • 1,916
3 votes

How to decrypt TLS traffic with Wireshark using RSA asynchronous encryption?

TLS 1.2 with ECDHE-RSA-AES256-GCM-SHA384 has forward secrecy. Notice its presence on the intermediate level of Mozilla's cipher lists. Inability to decrypt with only the server key is a feature. ...
John Mahowald's user avatar

Only top scored, non community-wiki answers of a minimum length are eligible