The network protocol analyzer developed and maintained by the Wireshark Foundation

learn more… | top users | synonyms

0
votes
0answers
8 views

Troubleshooting dropped packets in Telegram Messenger

I'm experiencing problems in using Telegram Messenger on my Mac, but only when connected at home (specifications at the end). More specifically, when uploading and downloading media (or even while ...
0
votes
1answer
28 views

How to identify an internet hog?

Our small office network will occasionally slow when a coworker starts a large download or a large file transfer between an in-house server and their local machine. How can I identify this hog on my ...
0
votes
1answer
123 views

promiscuous mode not working

I've searched, and heard that the promiscuous mode lets us listen to all wireless trafic in the Access Point that we are associated with. But when i use this mode with wireshark, i don't get the exact ...
0
votes
1answer
27 views

Does Ventrilo encrypt the VoIP stream, session, and/or communications?

If you're not familiar, Ventrilo is a voice chatroom used for gaming. Here's the wiki for Ventrilo and similar software Mumble and TeamSpeak to give you an idea of what the software is about. I ...
0
votes
1answer
18 views

Capture Only HTTP traffic in tshark

I am new to tshark tool usage. I am trying to use tshark tool for capturing only HTTP traffic but i am unable to do it. Here is the cmd i run to get the all traffic: tshark -c 1000 -w packetFile.pcap ...
-1
votes
0answers
45 views

Windows IIS: FTP 530 Error, but not everywhere (sniffed log attached)

Got server (Windows Web Server 2008R2, IIS 7.5) with ftp server, attached to domain ftp.example.com. Problem is Unreal Commander can create FTP connection to that server, but browsers and other ...
0
votes
0answers
25 views

NAT doesn't allow TCP ACK for sent TCP SYN

We are using TCP Simultaneous Open for connecting TCP socket. Lets call one SideA and other SideB. From the wireshark log I see that first two SYN sent from SideB is blocked by SideA NAT. Then SideA ...
1
vote
1answer
34 views

Why am I seeing packets intended for other recipients while behind a router?

I'm using a wired internet connection. The ISP provides an ethernet cable, a static private IP, and a dynamic public IP. I bought a router and gave the router the static private IP. I'm using ...
0
votes
1answer
10 views

How can specify limit for trace collection in OS X wireshark?

Wireshark noob here, trying to figure out how to set a limit for trace collection in OS X Wireshark. I did a search on the wiki page but nothing comes up in the results.
-3
votes
0answers
39 views

Network Sniffing Doesn't working

I am curious about knowing about wireless networks and it's security. I Have a home setup of 2 computers A and B. I am running windows 7 on both. I opened up facebook in computer A and I started ...
0
votes
1answer
15 views

Safe Capture of WAN Packets

I have an aggregating network tap between my WAN connetion and my home router. I have a dedicated machine running Wireshark to capture all WAN traffic via the network tap. This machine is running ...
0
votes
0answers
12 views

Wireshark FTP multiple ACK?

I'm trying to visualise somes frames that correspond to a file transfer between two machines on Wireshark. The thing is that there are multiple ACK for each FTP-DATA segment and I don't understand ...
0
votes
0answers
21 views

How to check which TLS cipher suite is used in tcp connection

I am using imapfilter to sort my mails on a remote IMAP server provided by some company. My configuration restricts imapfilter to the usage of TLS 1.2 via STARTTLS. I do know how to check which TLS ...
-1
votes
2answers
38 views

Can only see the traffic of the host in Wireshark?

I need to analyze the traffic of my network; the outgoing traffic that hosts in that LAN generate directed to a certain IP using HTTP protocol. I've tested it with Wireshark, but I can only see the ...
0
votes
0answers
46 views

Spying on Wi-Fi-connected device from laptop

I want to capture (and possibly modify) packets from a WiFi-connected device using my MacBook Pro and I am trying to figure out the most straightforward way of doing so. I have solved the problem ...
0
votes
1answer
47 views

What does a sequence of retransmissions with PSH,ACK flags mean (and a spurious retransmission back)?

I am on server 192.168.0.2 and want to make a HTTP call to 192.168.0.1(both servers are RPis and run Linux (raspbian)). curl -XGET http://192.168.0.1:8081/api The API on 192.168.0.1 (which I am ...
0
votes
0answers
53 views

Replay captured TCP packets

I captured a tcp traffic using wireshark and saved the traffic in pcap file. I did two tests: Test 1: sudo tcprewrite --infile=capturedtraffic.pcap --outfile=temp.pcap ...
0
votes
1answer
28 views

Snort wont trigger alert from tap interface eth0

I have snort set up on a raspberry pi running a modified Ubuntu. Between my modem and router I have a switch that mirrors all the traffic to a port that is connected to the eth0 interface on my ...
0
votes
0answers
18 views

Routing between two NICs same PC

I have two NICs, 192.168.56.0/24 and my wifi NIC 192.168.1.0/24. Can I route between these two NICs to be able to ping from my Physical HOST to any host on 192.168.56.0/24 while using VMs? I know ...
0
votes
2answers
33 views

How to see DHCP boot setup in wireshark?

My client tries to boot wrong file with DHCP and I'd like to debug it. My previous configuration was to boot with lpxelinux.0 file but now I changed it to pxelinux.0. But client is still looking for ...
0
votes
2answers
37 views

My DNS server queries root servers?

So, I have a DNS server and a host in a lab environment. When my host queries for the IP of an web-address, like www.[somewedishwebsite].se (Swedish domain), it first queries my DNS server with IPv4 ...
1
vote
3answers
67 views

I can hear it pinging and talking, but it can't hear anything

I got one-way connectivity to some devices and sometimes(randomly) no connectivity, with odd link-status LED lighting. There are 1 PC(mine) and 2 routers('A' and 'B') connected to a switch(unmanaged) ...
0
votes
2answers
85 views

Wireshark to capture all IP devices on a network

I have a Windows PC with hardwired Ethernet and two wireless Linux devices on a LAN. My Wireless router is an Asus RT-AC68U. The Windows PC is running Wireshark. I would like to capture all network ...
1
vote
1answer
54 views

Hide one VM's traffic from another when using Wireshark in Virtual Box

Versions: Host OS: Windows 10 Virtual box: 5.0.10 r104061 VM1: Kali Linux 2.0.0 VM2: Ubuntu 15.04 I have two VMs that I'm practicing penetration testing on. I'm trying to create a man in the ...
0
votes
2answers
76 views

Sniff packets from router

So I have TP-Link router and I want to sniff all the packets going through the router. I'm using Wireshark right now but not able to get the packets which passes through my router. So What I've tried ...
0
votes
0answers
30 views

Cannot see VOIP calls in Wireshark 2.0.0

I received a pcap dump from a site, running Cisco JTAPI, who's VOIP traffic I need to analyse. I use Wireshark's VOIP calls analyser via the menu: The conversations display fine in Wireshark ...
0
votes
3answers
79 views

Relation between TCP conversations and TCP streams in Wireshark

I have read about Conversations and TCP Streams but I'm still a bit unsure how they relate to each other if they are on the same layer. For different layers, it's clear to me that e.g. an IP ...
1
vote
0answers
18 views

Logging individual application network usage in Windows 8.1

I'm writing a review on ACD (Amazon Cloud Drive), and I need to know the following data for the ACD process: Which addresses does it visit, IP and domain; How much data does it send; Bandwidth usage ...
2
votes
0answers
33 views

Tshark. List all traffic between two IP's?

I am learning to use Tshark. I am trying to retrieve a list of all conversations between two IP addresses using Tshark. The two IP's are: 192.168.1.158|64.12.24.50 In Wireshark I am able to see the ...
0
votes
1answer
63 views

What do all the “icons” mean in Wireshark 2.0?

I have recently started using Wireshark 2.0 and it seems the "icons" in the frame number column help me better understand the traffic. However, I'm not sure what some of them mean. Looking at chapter ...
0
votes
1answer
22 views

Capture only UDP traffic that cannot be identified as another protocol

I have applied the udp filter in order to just capture UDP traffic, as described in Wireshark Wiki: Show only the UDP based traffic: udp However, this does not only show UDP traffic. It shows ...
1
vote
0answers
28 views

Decoding HTTP GET parameter in Wireshark

I am capturing HTTP GET traffic with Wireshark and I have plenty of URLs that contain "cryptic" URL-encoded data. I'd like to see the URI split into the individual parameters see the parameter ...
0
votes
2answers
29 views

Wifi packets and adapters

When I connect a wifi adapter to my computer I can see the available wireless networks listed, but when I use Wireshark and set it to listen with that interface/adapter, no packets are captured (when ...
1
vote
2answers
46 views

Listing all devices connected to a simple router remotely

I have two simple routers given to me by my ISP. One is Technicolor TC7200 and the other one is Thomson TWG870UG. I would like to remotely list all of the devices connected to the router (their IP and ...
1
vote
1answer
26 views

Configure Wireshark to capture any packages between host machine, and guest (VM)

I'm new to this whole Wireshark thing. I have a VM running inside my local Mac via VMWare Fusion. VM IP Address : 172.16.139.129 Mac IP Address : 10.0.0.4 I want to capture http connection between ...
0
votes
0answers
19 views

Windows 7 frequent download interruption

I just upgraded to Windows 7 Pro from Home Premium, and now almost all downloads (Youtube videos, online games, ftp/http downloads) are interrupted after a random length of time. Sometimes the ...
1
vote
0answers
70 views

NAS causing Internet Time Outs on other computers

Yesterday I installed a new Synology DS715 NAS server. Since then the internet connection on all other LAN connected PCs encounter disconnects. This is most noticable when playing online games, which ...
0
votes
0answers
44 views

Wireshark isn't showing all interfaces in Windows 7

This is what I've done to check what was going on: Restarted PC Made sure WinPCAP driver (NPF) was installed Stopped and started NPF driver Running as admin But it's only showing one interface, ...
0
votes
0answers
23 views

IKEv2, ESP PFS. Which packets includes the configuration?

i am investigating currently the IKEv2 protocol with ESP payload encryption. For ESP i want to use PFS with DH Group 5 (which works). However, i am not able to figure out in which packet this settings ...
0
votes
1answer
22 views

Is there an ethernet header in IEEE 802.11

I have been capturing some packets over wifi using wireshark for analysis. If I captured IEEE 802.11 frames on an interface in monitor mode. If I capture an IEEE packet on an open network without ...
0
votes
3answers
118 views

I am flying tonight and wonder if I can use wireshark even without paying for inflight wifi

I am flying tonight and am learning about networks. I was wondering if I use wireshark or other packet capturing program, will I see traffic if I am connected to the network but do not pay for it? I ...
0
votes
2answers
45 views

Force a process in Windows 7 to store capture in RAM without doing actual I/O operation and writing to the disk

I'm Using Wireshark's cyclic buffers configuration capturing mode: I am sniffing a 10Gig port, and I was expecting Wireshark to work cyclically with buffers on the DDR only, but apparently it ...
0
votes
1answer
189 views

Converting a Raw g722 File to a .wav with SOX

I am trying to troubleshoot some VOIP issues, and have been capturing the packets for the trouble calls. However my calls are all encoded in g722 and I am having trouble decoding this. I have ...
0
votes
0answers
92 views

TCP connect fails with certain websites

I am running Windows 10. I am unable to browse a few seemingly random websites (CBS.com is one of them) using any of my browsers, although I can successfully ping all of them. Also, other computers ...
1
vote
1answer
183 views

How does Wireshark sniff the packets? [closed]

When I have Wireshark running on, say, 192.168.1.100, how is it able to capture the packets that 192.1.123 sends to the router or to another computer/device in the LAN? My theory is that when a ...
0
votes
0answers
67 views

Clients have problems sending DNS requests

Some of my clients can't use internal DNS server to resolve internal addresses. All IP addresses can be pinged, but I can't ping name or name.domain.com. Restart DNS client service or ipconfig ...
1
vote
1answer
49 views

Port forwarding capture on localhost with WireShark

Is it possible to do a simple, port forwarding type capture on localhost (Windows) with WireShark? I have been using the following Java code to do this: package tapnet; import java.net.*; import ...
0
votes
0answers
33 views

Can't see HTTP in Wireshark on OSX

Every Youtube video that even explains how to install Wireshark sees HTTP traffic. Why can't I see it? Fresh Wireshark install, I am capturing WiFi traffic and I made some HTTP requests. TCP, UDP, ...
0
votes
0answers
27 views

Wireshark in Linux not receiving packets, and Linux is in a VirtualBox

I am using Kali Linux, but on a VirtualBox. So when I'm using Wireshark, I can't capture any packets. I can't use the wireless card directly so I'm using eth0 through the Mac OS. is there any way to ...
1
vote
0answers
12 views

TCP Rentransmission when connecting sepcific website

Question: I'm an administrator of couple of websites. Every website is set on the same server provided by linuxpl.com. The server ip is: 95.211.176.132. The problem is, when I try to reach the server ...