The network protocol analyzer developed and maintained by the Wireshark Foundation

learn more… | top users | synonyms

0
votes
0answers
18 views

Monitor TCP port traffic and get a sound alert when a specific text string is found on Windows

I need to watch a port for several hours and make an audible alert whenever a specific string comes through. Windows only. Is this possible with Wireshark or another sniffer tool or maybe a sniffer ...
0
votes
0answers
16 views

router automatically disables wifi and enables after 2-3min

Router: Netgear DGN2200v2 Problem: THe router disables the wifi network automatically(with no human interference what so ever), thus all pc's disconnect and have no network access(as if the router ...
-1
votes
0answers
43 views

Wireshark-like software for capturing Bluetooth communication data? [closed]

Is there any Wireshark-like software for capturing Bluetooth communication data? I have a smart bracelet paired up with iPhone 5s. I would like to know how does the data communicating. Is it ...
0
votes
1answer
39 views

Possible network loop with WiFi and Ethernet when docked

I have been seeing a weird problem that I can't reproduce on demand and have a suspicion on the root cause. The Issue: Intermittently the entire network goes down until I walk around and unplug ...
1
vote
1answer
86 views

tcpdump not displaying RSSI

I am monitoring Wi-Fi probe requests via tcpdump on Debian and am trying to capture the RSSI (signal strength) of each probe request element. Currently, the output from tcpdump for each probe request ...
0
votes
0answers
18 views

How to get Alfa awus036nha to work with Ubuntu 14.04?

I installed Ubuntu 14.04 in a dual boot configuration with OS X Yosemite. I then installed Wireshark on Ubuntu and I'm going to use an Alfa AWUS036NHA (Atheros chipset) adapter. The problem is that ...
0
votes
1answer
28 views

wireshark save capture directly to file with filter

I am looking to have a long-term packet capture running to monitor DNS requests on my machine. I generally use wireshark for network monitoring, but since I am only interested in DNS packets, and over ...
0
votes
2answers
29 views

How to run sniffing demonstration using virtualbox and wireshark

I am going to have a demonstration of packet sniffing using wireshark. Therefore, I decided to create two vitual machines in virtualbox (with "host-only adapter" network config) and monitor the ...
1
vote
0answers
38 views

TCP packet issue with 802.11ac but not with 802.11n on an Android Nexus 6

I have an Android Nexus 6 that connects to my computer via an ad-hoc network. When my phone connects to the 802.11n card (TP-LINK 300Mbps Wireless N), the bytes are sent with no issue; verified with ...
0
votes
1answer
63 views

Why filtering on udp port in TCPDUMP gives only fragmented IP frames

I've a device capturing traffic with Tcpdump filtering on "upd dst port" then it creates a pcap file to be read in wireshark. what I obtain from running: tcpdump udp dst port 5201 -qUns 0 -i wlan0 ...
0
votes
1answer
39 views

Wireshark loopback on mac os x [closed]

I have selected loopback (in capture options) to capture http traffic on my localhost server, but everytime I do and HTTP I only can see TCP.
0
votes
0answers
18 views

How to capture VirtualBox VM packets

I am currently running a series of three Ubuntu 14.04 VMs on my Windows 7 x64 host. The guests are all configured thusly: Host-Only Adapter Intel Pro/1000 MT Desktop Promiscuous Mode: Allow VMs Cable ...
3
votes
0answers
57 views

why am I not seeing traffic using TCPDUMP while sniffing on wireless interface with the station in WDS mode

I've 2 wireless interfaces one has the type of AP and the other has the type monitor. the AP is attached to a bridge br-lan. When I run for example: tcpdump port 5201 -s 0 -ni wlan0 TCPdump is ...
0
votes
0answers
27 views

Https request call capture in Wireshark

I have installed Wireshark and Windows based application(to be analyzed) which uses https request authentication to validate user.When I use interfaces -- > capture all the request of my system is ...
0
votes
1answer
54 views

Graphical representation of iperf3 results

I'm using Iperf3 on 2 machines and actually I'm running 2 instances of Iperf3, one to generate traffic with high priority and the other generates traffic with low priority. I would like to generate a ...
1
vote
0answers
39 views

Viewing Xbox One Network Traffic

I am trying to view the HTTP/HTTPS traffic going from my XBOX one so I can see what is being requested. I started off trying to use Charles proxy like this https://www.youtube.com/watch?v=MP4ZcwSHxbw. ...
1
vote
0answers
21 views

Long SMB session setup delay

I have a Windows machine connecting to an SMB share on a local Debian server. Everything works flawlessly, when it's connected, but the first connection (either after a boot / reboot, or after ...
0
votes
0answers
39 views

WireShark - Vmware Network Interfaces

I've recently installed wireshark v1.12.4 on my Windows 8 Machine, and I am totally new to the program. I have a virtual machine running on vmware (Red Hat Linux 7.2) and got all the network ...
0
votes
0answers
117 views

Wireshark fails to install on OS X 10.10.3 using brew

I've encountered the following issue while installing wireshark via brew. ➜ ~ brew reinstall wireshark --with-qt5 ==> Reinstalling wireshark with --with-qt5 ==> Downloading ...
0
votes
0answers
32 views

Decrypt SSL Data in wireshark

In all the tutorials which I saw in web, they pointed me to add key file in Edit->Prefereces->Protocols->SSL->SSL key file but there is no such SSL key file in version I use. Can somebody guide how ...
0
votes
0answers
30 views

Reading packets with Wireshark

How do I read packets captured with Wireshark. I was finally able to capture incoming and outgoing data in hopes of developing something along the lines of an IDS. Thanks in advance for the help. A ...
0
votes
2answers
77 views

Duplicate IP address Telnet and ARP

I have 3 hosts (PC1, PC2, and PC3). I set the IP addresses for PC2 and PC3 to be 10.0.0.2 and PC3 to be 10.0.0.1. I telnet from PC1 to 10.0.0.2. I then am logged in to PC3. I can see in Wireshark that ...
0
votes
0answers
21 views

tcptrace from wireshark capture

How can I use tcptrace to generate tcptrace graph from captures on wireshark ? I already know how to generate the tcptrace on wireshark itself, but I want to generate the graph outside wireshark ...
0
votes
1answer
19 views

How to find 802.11 protocol variant, and decipher packet_payload_info in PcapNG files?

I'm building a (Python) parser of PcapNG files created by Wireshark. After reading https://www.winpcap.org/ntar/draft/PCAP-DumpFileFormat.html, I'm having the following problems: I'd like to ...
0
votes
1answer
20 views

Does connecting to one's computer via local router automatically uses the loopback?

I have a TCP application that doesn't show up on Wireshark. I read it was because Wireshark is not able to sniff Loopback communication on Windows. So, instead of connecting to 127.0.0.1, I connected ...
0
votes
0answers
17 views

Wireshark capture file: getting “missing packet” now, was not there 1 year ago

I captured data on a LAN. I then opened the pcap file with wireshark and could extract an email which was sent unencrypted on purpose. Means, I selected a package from the email and used "follow TCP ...
1
vote
0answers
39 views

Why does a radio stream not appear on a packet monitoring tool?

I am currently trying to find the URL to the audio stream for a webradio that only provides a flash player, that I would like to use with MusicBee's radio player. After using Wireshark to monitor my ...
0
votes
1answer
42 views

How is the FID generated for a SMB “Create AndX Request?”

I see in the traces while accessing a network share, there are multiple CreateAndX requests (which opens the folders) with an FID associated with them. However, some of them don’t and they get a ...
0
votes
0answers
22 views

VirtualBox Network confusion?

I'm trying to adjust my VirtualBox guest network in order for my guest O/S traffic look like its coming from my Host. Can I do this with NAT? Here's a simpler outlook on what I am trying to achieve ...
1
vote
2answers
127 views

Wireshark only captures packets to or from this device

I use wireshark on ubuntu 14.04 and I am trying to sniff wifi traffic of other devices in my network. I run wireshark or tshark on wlan0, start capturing packets and send some pings or open some pages ...
-1
votes
1answer
39 views

Wireshark - Browser software

I just touched wireshark yesterday from my class. I was told to run wireshark while browsing www.kompas.com, and there is this question that is quite ambiguous. "What browser software shown in ...
0
votes
2answers
169 views

TCP Dup ACK/Retransmission, bad configuration?

I'm currently investigating network issues of a friends LAN (again). The Internet connectivity is very slow and unreliable and sometimes services simply don't work. I've monitored the traffic for ...
0
votes
3answers
269 views

How to find IP address of a DNS server

I'm a CS student and currently taking a (basic) course in information security. I was given an assignment which required me to analyse a given .pcap file using Wireshark and obtain information on the ...
0
votes
0answers
34 views

Wireshark capture SSL only

I would like to capture SSL or HTTPS traffic only in Wireshark, this is not something that can be filtered after due to the length of the time I would be recording the data after and the size of the ...
0
votes
0answers
219 views

Whatsapp traffic analyzed by WireShark

how to know info about the person I chat with in the Whatsapp by analyzing traffic got by WireShark Software where is he located at the moment of chatting. regards, Samad
0
votes
0answers
42 views

Do not fragment bit and windows 7

Recently had an issue where the DF bit was set to 1 going from a W7 workstation to the update server, the issue is it was sending 32K of data when the MTU was set to 1500. When the packet hits the NIC ...
0
votes
1answer
118 views

wireshark monitor mode, decrypting capture

I have a network, which has 2 nodes (a phone, a MacBook) both are connected to same wireless network, I know the SSID and password for the wireless network password: mypassword ssid: myssid security: ...
0
votes
0answers
105 views

init-p01md.apple.com/bag - iMessage?

I have a question about Apple network traffic. In my network program I can see these three domains (GET) http://init-01md.apple.com/bag http://init.ess.apple.com/WebObjects/VCInit.woa/wa/getBag?ix=1 ...
0
votes
1answer
23 views

Multiple TCP Connections to download simple webpage and images?

I created a very simple webpage: <html> <body> foo bar <img src="img1.png"/> <img src="img2.png"/> <img src="img3.png"/> Hello world </body> </html> And ...
1
vote
0answers
257 views

How to use Charles as proxy to decrypt HTTPS messages in Wireshark?

I know I can view decrypted HTTPS data directly in Charles. But I want to view lower level SSL messages in Wireshark. So I setup Charles as the SSL proxy, using my own certificate, and I setup SSL ...
0
votes
0answers
21 views

Frame logging of third party hardware on my router (specifically smart TV)

After reading recently about so-called smart TVs "listening" to sound in a person's home, and transmitting this recorded sound across the internet for speech-to-text translation, I have become curious ...
0
votes
0answers
31 views

Can I use a Windows 7 Computer as a Bridge and Sniff Traffic

Sorry if this has been asked before, but I've been searching for quite a while. My question is simple - can I use a Windows 7 computer as a bridge, and run WireShark to capture all of the packets at ...
0
votes
0answers
18 views

WLAN topology: does it work like a bus?

Does wifi work as a star network with a switch or does it work like a bus ? To be more precise, if I am in promiscuous mode, do I only see my traffic and broadcasted messages or do I get every packet ...
0
votes
0answers
48 views

HTTP Sniffing using wireshark

I am using Wireshark on my Mac, which is running Yosemite. When I am sniffing the HTTP protocol, I can only see the HTTP/get and I cannot see the HTTP/OK.. Is there a way to enable this on my MAC? I ...
0
votes
1answer
47 views

I see frequent PTR requests in my wireshark capture, are they normal?

Lately I've been getting very frequent DNS lookup failuers (I use Google's dns servers) so I set up wireshark to see some of the traffic and I see many PTR requests for IP's that don't seem relevant. ...
2
votes
1answer
342 views

wireshark usb traces explanations

I am trying to reverse engineer an usb (HID) device and cannot really figure out how what I see on wireshark (usbmon + wireshark on linux, or windows) relates to the usb protocol?. I have looked at ...
1
vote
3answers
73 views

Binary file viewer tool support file format information extraction

I'm always curious about what is hidden inside those files, like pdf, mid, mp3, mkv, etc. I can read the spec in the wikipedia, but it is hard to understand. Tools like wireshark can extract data ...
0
votes
0answers
94 views

Why does lldpctl show no neighbors on standalone Ubuntu system?

I have installed sudo apt-get install lldp in two different ubuntu system and in both system I have set (/etc/default/lldp) DAEMON_ARGS="-x -c -s -e -l" I have check in wireshark also transmitted ...
0
votes
1answer
17 views

LAN over RF link leads to intermittent errors

We have an odd error occurring with our network, the setup is: IP Camera -> Radio LAN repeater -> Local switch -> PC The IP camera is streaming video over RTSP / UDP and we can control it ...
1
vote
1answer
32 views

Filter all packages that not use a specific port

I use wireshark to watch a captured pcap file. I see a lot of communication on a specific port, that I am not interessted in, so i want to filter it to see only the rest of the communication. I used ...