Open-source network packet analyzer

learn more… | top users | synonyms

0
votes
0answers
15 views

init-p01md.apple.com/bag - iMessage?

I have a question about Apple network traffic. In my network program I can see these three domains (GET) http://init-01md.apple.com/bag http://init.ess.apple.com/WebObjects/VCInit.woa/wa/getBag?ix=1 ...
0
votes
0answers
21 views

Random TCP RST packets interrupting connection over IPv6

I recently got a new router and ever since then google sites have been loading really slow and so I contacted my ISP...after running in circles with them for a bit they said it was a problem between ...
0
votes
1answer
17 views

Multiple TCP Connections to download simple webpage and images?

I created a very simple webpage: <html> <body> foo bar <img src="img1.png"/> <img src="img2.png"/> <img src="img3.png"/> Hello world </body> </html> And ...
-2
votes
0answers
20 views

Buffering and accumation of packets send via TCP, setsocketopt is set in no delay mode, nagle is off [closed]

While creating the TCP socket we set the socket in TCP_NODELAY mode using the following code: if (!nagle) { int noDelay = 1; if ( ::setsockopt( m_clientSocket, IPPROTO_TCP, TCP_NODELAY, ( char* ...
1
vote
0answers
49 views

How to use Charles as proxy to decrypt HTTPS messages in Wireshark?

I know I can view decrypted HTTPS data directly in Charles. But I want to view lower level SSL messages in Wireshark. So I setup Charles as the SSL proxy, using my own certificate, and I setup SSL ...
0
votes
0answers
13 views

Frame logging of third party hardware on my router (specifically smart TV)

After reading recently about so-called smart TVs "listening" to sound in a person's home, and transmitting this recorded sound across the internet for speech-to-text translation, I have become curious ...
0
votes
0answers
14 views

Can I use a Windows 7 Computer as a Bridge and Sniff Traffic

Sorry if this has been asked before, but I've been searching for quite a while. My question is simple - can I use a Windows 7 computer as a bridge, and run WireShark to capture all of the packets at ...
0
votes
0answers
12 views

WLAN topology: does it work like a bus?

Does wifi work as a star network with a switch or does it work like a bus ? To be more precise, if I am in promiscuous mode, do I only see my traffic and broadcasted messages or do I get every packet ...
0
votes
0answers
38 views

HTTP Sniffing using wireshark

I am using Wireshark on my Mac, which is running Yosemite. When I am sniffing the HTTP protocol, I can only see the HTTP/get and I cannot see the HTTP/OK.. Is there a way to enable this on my MAC? I ...
0
votes
1answer
18 views

I see frequent PTR requests in my wireshark capture, are they normal?

Lately I've been getting very frequent DNS lookup failuers (I use Google's dns servers) so I set up wireshark to see some of the traffic and I see many PTR requests for IP's that don't seem relevant. ...
2
votes
1answer
74 views

wireshark usb traces explanations

I am trying to reverse engineer an usb (HID) device and cannot really figure out how what I see on wireshark (usbmon + wireshark on linux, or windows) relates to the usb protocol?. I have looked at ...
1
vote
3answers
19 views

Binary file viewer tool support file format information extraction

I'm always curious about what is hidden inside those files, like pdf, mid, mp3, mkv, etc. I can read the spec in the wikipedia, but it is hard to understand. Tools like wireshark can extract data ...
-1
votes
0answers
16 views

how to check total number of HTTP Get requests for a source address using wireshark?

I am trying to find out the entropy for the network traffic. And in need to know the total number of HTTP Get requests for a source address using wireshark. Please help me out. I have already ...
0
votes
0answers
28 views

Why does lldpctl show no neighbors on standalone Ubuntu system?

I have installed sudo apt-get install lldp in two different ubuntu system and in both system I have set (/etc/default/lldp) DAEMON_ARGS="-x -c -s -e -l" I have check in wireshark also transmitted ...
0
votes
1answer
14 views

LAN over RF link leads to intermittent errors

We have an odd error occurring with our network, the setup is: IP Camera -> Radio LAN repeater -> Local switch -> PC The IP camera is streaming video over RTSP / UDP and we can control it ...
1
vote
1answer
22 views

Filter all packages that not use a specific port

I use wireshark to watch a captured pcap file. I see a lot of communication on a specific port, that I am not interessted in, so i want to filter it to see only the rest of the communication. I used ...
1
vote
1answer
40 views

Why am I not seeing ARP requests from my own machine in wireshark?

I am using Windows 7. I open up Wireshark and start a live capture with the filter: ip.src == THIS.IS.MY.IP I then go to a command line and do an arp -d * and ping a bunch of stuff. I see my ICMP ...
1
vote
0answers
34 views

How to split pcap files maintaining tcp sessions

I have a pcap file which contains tcp traces. I was wondering if there's a way to split these traces in order to maintain tcp flows, but also filtering the traffic on a src ip basis. For example, if ...
0
votes
0answers
53 views

Windows7 LIVE CD with winpcap

Is it possible to create a LiveCD of windows 7 with winpcap installed for wireshark. I already tried with winbuilder 0.82 but there is no working script for winpcap and since it is not a portable app ...
-1
votes
1answer
66 views

Can my history be tracked if I'm connected to my cellular data instead of wifi

If my phone is using its cellular data instead of being connected to wifi, can wireshark still see what I'm doing?
0
votes
0answers
34 views

Wifi sniffing only outgoing packets

When I am setting my wifi card in monitor mode and disconnecting it from wifi I am able to sniff every packet coming in and out from my tablet (http requests and responses) but when I connect to ...
0
votes
1answer
24 views

Make CISCO RVS4000 into hub mode

I am trying to do packet analysis with a RVS4000 Cisco device that has four computers connected. The device is not broadcasting packets to the other devices connected to the device. For my lab, I ...
0
votes
1answer
21 views

Wireshark capture a website packets

In my browser I connect to www.superuser.com In wireshark filter I want to access to those packet which I receive from this web site. what is that filter? Note : I do not want to use ip address.
3
votes
3answers
184 views

Windows 8 DNS lookup fails but wireshark shows that the query completes

I'm having a very weird problem. My dad recently purchased a new wireless router. We have at least 8 devices connected wirelessly, and all of them continued working just as they had before, except ...
0
votes
2answers
259 views

Wireshark does not show wlan traffic of iOs/Android devices (but shows traffic of my others devices)

i am trying to sniff the Wifi traffic of my home network. for that, i run Backtrack LiveCD on a laptop with a DLINK AirPlus DWL g650 wifi adapter. i set my WPA key in wireshark, and running wlan ...
0
votes
2answers
55 views

Bittorrent protocol not used by uTorrent client

I created a virtual environment for torrent download which included 4 virtual machines. Of the four, three machines acts as peers and the other acts as a tracker. Using uTorrent I created a torrent ...
0
votes
0answers
62 views

packet sniffing 3ds

I am trying to packet sniff my 3DS just to see what information is available. With Wireshark I noticed that I can only capture traffic which communicates with my computer directly, and not any device ...
0
votes
2answers
48 views

How to get the exact order of pieces downloaded by bittorrent client?

To know more about torrent download, I used wireshark to capture the packets transferred during the download. I was able to find that a file is split into multiple pieces that comes from different ...
0
votes
1answer
36 views

Check if I'm supervised [closed]

Is there any software that I can use to check If my computer is supervised? I want to know if anyone is sniffing my traffic out of my computer with wireshark or another software. Is this possible?
1
vote
1answer
63 views

How to detect TOR usage with Wireshark?

I use TOR inside a Virtual Machine. I run Wireshark on my Host. I want to detect TOR usage (for learning/studying) with Wireshark but don't know how. I've tried this: ...
0
votes
1answer
44 views

Force homebrew to completely reinstall wireshark

I've messed up trying to install wireshark on OSX. Here's what I did. I downloaded and installed wireshark from their website. It didn't work due to missing X11. I started to troubleshoot this, but ...
0
votes
0answers
211 views

How to change mode of an airmon-ng created interface(mon0) from managed to monitor?

I am connecting to a home router using wifi. The detais of my wireless cards are as follows: #lspci 01:00.0 Network controller: Qualcomm Atheros AR9485 Wireless Network Adapter (rev 01) #lspci -vv ...
1
vote
3answers
132 views

Wireshark and Playstation 3

I'm looking to capture all network traffic when playing my ps3 and find the external IP addresses of other players in my servers or game. I'm wondering if this is possible? If so how?
0
votes
0answers
25 views

Wireshark dont work after install VirtualBox

I have the following problem whit Wireshark. I function normally until I installed Oracle VM VirtualBox, after installation of said program to me at the start Wireshark occur following problem: "No ...
1
vote
1answer
43 views

Ethernet Data Traffic hidden from Wireshark capture

I have a puzzle I am not able to figure out, I would appreciate any help. I am connected to a remote desktop using windows default remote desktop utility (Windows 8 locally, Windows 7 remotely). The ...
0
votes
0answers
28 views

Eliminating extraneous network traffic

If I wanted to get the best performance (high data rate, low latency) out of an isolated gigabit ethernet LAN (N.B. NOT connected to the internet) I would assume this would occur when there was no ...
0
votes
0answers
76 views

Capturing 802.11n HT control on wireshark

1) Using wireshark 1.12.2 with kernel 3.8.0-44-generic I cannot see any HTC+ fields in my packets. Is this a dissector issue in wireshark or related to my wireless nic. I have tried on both an alfa ...
0
votes
1answer
46 views

How do I get Wireshark to filter for a specific web host?

I'm using Wireshark on OSX, but I can't make any sense out of the filtering system. I have this filter set up: But when I hit that server, I don't see anything show up in the capture log. If I ...
0
votes
0answers
20 views

Mergecap multithread

I need to merge a lot of pcap files into one. I ran the command "mergecap *.pcap -w outputFile" , and it actually merges the files, but it's really slow. I was wondering if there's a way to launch a ...
1
vote
0answers
128 views

Capture network traffic between VM's Virtualbox using Wireshark

I'm trying to capture all network traffic between VMs (and in the VMs to themselves) running on a single host using Virtualbox for the VMs and Wireshark for the capturing. VMs are Ubuntu 14.04 and the ...
1
vote
1answer
28 views

Which HTTP Authentication used?

I need a way to find out which HTTP Auth mechanism is used for a particular website/web-server, which is responding to my HTTP request. I am open to use any browser, or any other tool (like ...
0
votes
0answers
68 views

UPnP Discover can't captured by Wireshark

According to the UPnP standard, the UPnP discover packet should send to 239.255.255.250:1900. However, when my program send to 239.255.255.250:1900, the wireshark can't captured the packet. When my ...
1
vote
0answers
19 views

Route network traffic back to the same wire

I would like to monitor outgoing traffic from my wi-fi connected phone using Wireshark on my Windows desktop. I changed default gateway on the phone to the IP of the desktop and Wireshark can now see ...
0
votes
1answer
37 views

Monitoring physical network traffic with a VM

How can I monitor the physical network's traffic through a virtual machine (VMWare or Virtual Box)? I'm running Wireshark in a Linux VM and I would like to monitor all the network traffic. However ...
1
vote
1answer
695 views

How can I get the actual TCP sequence number in Wireshark?

In Wireshark, TCP sequence numbers are displayed as relative sequence numbers by default. How can I get the actual TCP sequence number?
1
vote
1answer
61 views

Can Wireless Sniffers capture and read your data with and without being connected to the WLAN?

Can some neighbor with his laptop capture the wireless traffic packets which I send and receive from my router, if he is not connected to my WLAN? Can someone connected to my WLAN and without access ...
0
votes
1answer
183 views

http.host filter for tshark capturing

I would like to capture traffic to a specific domain name. I tried the following wireshark filter http.host == 'example.com' It works, but after a few hours the temp data gets very large, so I ...
0
votes
0answers
35 views

Can network sniffing in promisc mode on a network bridge produce “false” TCP retransmissions?

I have a Wireshark log from a computer that was running Ubuntu and tshark. The computer has two NICs and I've connected them to a bridge (using /etc/network/interfaces) and gave that bridge a static ...
0
votes
0answers
75 views

Kerberos authentication failure: “SAM Active Directory Response - user unknown”

Everyone on our network is currently unable to access shared resources on our file server (SBS 2003 server with Windows 7 & XP workstations). A Wireshark packet capture revealed the following ...
1
vote
1answer
118 views

Kerberos failure emergency: need to filter a Wireshark capture to show only Kerberos and SPNEGO traffic

I am attempting to troubleshoot a serious Kerberos authentication problem on our SBS 2003 domain (none of our Windows 7 or XP workstations can authenticate). We have logged failed Kerberos ...