Open-source network packet analyzer

learn more… | top users | synonyms

0
votes
0answers
9 views

Wireshark capture file: getting “missing packet” now, was not there 1 year ago

I captured data on a LAN. I then opened the pcap file with wireshark and could extract an email which was sent unencrypted on purpose. Means, I selected a package from the email and used "follow TCP ...
1
vote
0answers
23 views

Why does a radio stream not appear on a packet monitoring tool?

I am currently trying to find the URL to the audio stream for a webradio that only provides a flash player, that I would like to use with MusicBee's radio reader. After using Wireshark to monitor my ...
0
votes
0answers
11 views

How is the FID generated for a SMB “Create AndX Request?”

I see in the traces while accessing a network share, there are multiple CreateAndX requests (which opens the folders) with an FID associated with them. However, some of them don’t and they get a ...
1
vote
0answers
11 views

Creating a Network Diagram with .pcap [migrated]

I have a Wireshark .pcap Capture of around 500k packets and I would like to enumerate a Network Diagram with all the Routers, Switches, PCs etc. Is there a tool that I could use to automatically ...
0
votes
0answers
15 views

VirtualBox Network confusion?

I'm trying to adjust my VirtualBox guest network in order for my guest O/S traffic look like its coming from my Host. Can I do this with NAT? Here's a simpler outlook on what I am trying to achieve ...
1
vote
2answers
32 views

Wireshark only captures packets to or from this device

I use wireshark on ubuntu 14.04 and I am trying to sniff wifi traffic of other devices in my network. I run wireshark or tshark on wlan0, start capturing packets and send some pings or open some pages ...
-1
votes
1answer
37 views

Wireshark - Browser software

I just touched wireshark yesterday from my class. I was told to run wireshark while browsing www.kompas.com, and there is this question that is quite ambiguous. "What browser software shown in ...
0
votes
2answers
35 views

TCP Dup ACK/Retransmission, bad configuration?

I'm currently investigating network issues of a friends LAN (again). The Internet connectivity is very slow and unreliable and sometimes services simply don't work. I've monitored the traffic for ...
0
votes
3answers
73 views

How to find IP address of a DNS server

I'm a CS student and currently taking a (basic) course in information security. I was given an assignment which required me to analyse a given .pcap file using Wireshark and obtain information on the ...
0
votes
0answers
10 views

Wireshark capture SSL only

I would like to capture SSL or HTTPS traffic only in Wireshark, this is not something that can be filtered after due to the length of the time I would be recording the data after and the size of the ...
0
votes
0answers
74 views

Whatsapp traffic analyzed by WireShark

how to know info about the person I chat with in the Whatsapp by analyzing traffic got by WireShark Software where is he located at the moment of chatting. regards, Samad
0
votes
0answers
25 views

Do not fragment bit and windows 7

Recently had an issue where the DF bit was set to 1 going from a W7 workstation to the update server, the issue is it was sending 32K of data when the MTU was set to 1500. When the packet hits the NIC ...
0
votes
1answer
84 views

wireshark monitor mode, decrypting capture

I have a network, which has 2 nodes (a phone, a MacBook) both are connected to same wireless network, I know the SSID and password for the wireless network password: mypassword ssid: myssid security: ...
0
votes
0answers
43 views

init-p01md.apple.com/bag - iMessage?

I have a question about Apple network traffic. In my network program I can see these three domains (GET) http://init-01md.apple.com/bag http://init.ess.apple.com/WebObjects/VCInit.woa/wa/getBag?ix=1 ...
0
votes
0answers
48 views

Random TCP RST packets interrupting connection over IPv6

I recently got a new router and ever since then google sites have been loading really slow and so I contacted my ISP...after running in circles with them for a bit they said it was a problem between ...
0
votes
1answer
20 views

Multiple TCP Connections to download simple webpage and images?

I created a very simple webpage: <html> <body> foo bar <img src="img1.png"/> <img src="img2.png"/> <img src="img3.png"/> Hello world </body> </html> And ...
1
vote
0answers
90 views

How to use Charles as proxy to decrypt HTTPS messages in Wireshark?

I know I can view decrypted HTTPS data directly in Charles. But I want to view lower level SSL messages in Wireshark. So I setup Charles as the SSL proxy, using my own certificate, and I setup SSL ...
0
votes
0answers
15 views

Frame logging of third party hardware on my router (specifically smart TV)

After reading recently about so-called smart TVs "listening" to sound in a person's home, and transmitting this recorded sound across the internet for speech-to-text translation, I have become curious ...
0
votes
0answers
17 views

Can I use a Windows 7 Computer as a Bridge and Sniff Traffic

Sorry if this has been asked before, but I've been searching for quite a while. My question is simple - can I use a Windows 7 computer as a bridge, and run WireShark to capture all of the packets at ...
0
votes
0answers
15 views

WLAN topology: does it work like a bus?

Does wifi work as a star network with a switch or does it work like a bus ? To be more precise, if I am in promiscuous mode, do I only see my traffic and broadcasted messages or do I get every packet ...
0
votes
0answers
43 views

HTTP Sniffing using wireshark

I am using Wireshark on my Mac, which is running Yosemite. When I am sniffing the HTTP protocol, I can only see the HTTP/get and I cannot see the HTTP/OK.. Is there a way to enable this on my MAC? I ...
0
votes
1answer
25 views

I see frequent PTR requests in my wireshark capture, are they normal?

Lately I've been getting very frequent DNS lookup failuers (I use Google's dns servers) so I set up wireshark to see some of the traffic and I see many PTR requests for IP's that don't seem relevant. ...
2
votes
1answer
135 views

wireshark usb traces explanations

I am trying to reverse engineer an usb (HID) device and cannot really figure out how what I see on wireshark (usbmon + wireshark on linux, or windows) relates to the usb protocol?. I have looked at ...
1
vote
3answers
30 views

Binary file viewer tool support file format information extraction

I'm always curious about what is hidden inside those files, like pdf, mid, mp3, mkv, etc. I can read the spec in the wikipedia, but it is hard to understand. Tools like wireshark can extract data ...
0
votes
0answers
46 views

Why does lldpctl show no neighbors on standalone Ubuntu system?

I have installed sudo apt-get install lldp in two different ubuntu system and in both system I have set (/etc/default/lldp) DAEMON_ARGS="-x -c -s -e -l" I have check in wireshark also transmitted ...
0
votes
1answer
16 views

LAN over RF link leads to intermittent errors

We have an odd error occurring with our network, the setup is: IP Camera -> Radio LAN repeater -> Local switch -> PC The IP camera is streaming video over RTSP / UDP and we can control it ...
1
vote
1answer
25 views

Filter all packages that not use a specific port

I use wireshark to watch a captured pcap file. I see a lot of communication on a specific port, that I am not interessted in, so i want to filter it to see only the rest of the communication. I used ...
1
vote
1answer
54 views

Why am I not seeing ARP requests from my own machine in wireshark?

I am using Windows 7. I open up Wireshark and start a live capture with the filter: ip.src == THIS.IS.MY.IP I then go to a command line and do an arp -d * and ping a bunch of stuff. I see my ICMP ...
1
vote
0answers
46 views

How to split pcap files maintaining tcp sessions

I have a pcap file which contains tcp traces. I was wondering if there's a way to split these traces in order to maintain tcp flows, but also filtering the traffic on a src ip basis. For example, if ...
0
votes
0answers
59 views

Windows7 LIVE CD with winpcap

Is it possible to create a LiveCD of windows 7 with winpcap installed for wireshark. I already tried with winbuilder 0.82 but there is no working script for winpcap and since it is not a portable app ...
-1
votes
1answer
77 views

Can my history be tracked if I'm connected to my cellular data instead of wifi

If my phone is using its cellular data instead of being connected to wifi, can wireshark still see what I'm doing?
0
votes
0answers
37 views

Wifi sniffing only outgoing packets

When I am setting my wifi card in monitor mode and disconnecting it from wifi I am able to sniff every packet coming in and out from my tablet (http requests and responses) but when I connect to ...
0
votes
1answer
30 views

Make CISCO RVS4000 into hub mode

I am trying to do packet analysis with a RVS4000 Cisco device that has four computers connected. The device is not broadcasting packets to the other devices connected to the device. For my lab, I ...
0
votes
1answer
23 views

Wireshark capture a website packets

In my browser I connect to www.superuser.com In wireshark filter I want to access to those packet which I receive from this web site. what is that filter? Note : I do not want to use ip address.
3
votes
3answers
233 views

Windows 8 DNS lookup fails but wireshark shows that the query completes

I'm having a very weird problem. My dad recently purchased a new wireless router. We have at least 8 devices connected wirelessly, and all of them continued working just as they had before, except ...
0
votes
2answers
327 views

Wireshark does not show wlan traffic of iOs/Android devices (but shows traffic of my others devices)

i am trying to sniff the Wifi traffic of my home network. for that, i run Backtrack LiveCD on a laptop with a DLINK AirPlus DWL g650 wifi adapter. i set my WPA key in wireshark, and running wlan ...
0
votes
2answers
60 views

Bittorrent protocol not used by uTorrent client

I created a virtual environment for torrent download which included 4 virtual machines. Of the four, three machines acts as peers and the other acts as a tracker. Using uTorrent I created a torrent ...
0
votes
0answers
75 views

packet sniffing 3ds

I am trying to packet sniff my 3DS just to see what information is available. With Wireshark I noticed that I can only capture traffic which communicates with my computer directly, and not any device ...
0
votes
2answers
52 views

How to get the exact order of pieces downloaded by bittorrent client?

To know more about torrent download, I used wireshark to capture the packets transferred during the download. I was able to find that a file is split into multiple pieces that comes from different ...
0
votes
1answer
38 views

Check if I'm supervised [closed]

Is there any software that I can use to check If my computer is supervised? I want to know if anyone is sniffing my traffic out of my computer with wireshark or another software. Is this possible?
1
vote
1answer
88 views

How to detect TOR usage with Wireshark?

I use TOR inside a Virtual Machine. I run Wireshark on my Host. I want to detect TOR usage (for learning/studying) with Wireshark but don't know how. I've tried this: ...
0
votes
1answer
50 views

Force homebrew to completely reinstall wireshark

I've messed up trying to install wireshark on OSX. Here's what I did. I downloaded and installed wireshark from their website. It didn't work due to missing X11. I started to troubleshoot this, but ...
0
votes
0answers
306 views

How to change mode of an airmon-ng created interface(mon0) from managed to monitor?

I am connecting to a home router using wifi. The detais of my wireless cards are as follows: #lspci 01:00.0 Network controller: Qualcomm Atheros AR9485 Wireless Network Adapter (rev 01) #lspci -vv ...
1
vote
3answers
190 views

Wireshark and Playstation 3

I'm looking to capture all network traffic when playing my ps3 and find the external IP addresses of other players in my servers or game. I'm wondering if this is possible? If so how?
0
votes
0answers
26 views

Wireshark dont work after install VirtualBox

I have the following problem whit Wireshark. I function normally until I installed Oracle VM VirtualBox, after installation of said program to me at the start Wireshark occur following problem: "No ...
1
vote
1answer
49 views

Ethernet Data Traffic hidden from Wireshark capture

I have a puzzle I am not able to figure out, I would appreciate any help. I am connected to a remote desktop using windows default remote desktop utility (Windows 8 locally, Windows 7 remotely). The ...
0
votes
0answers
29 views

Eliminating extraneous network traffic

If I wanted to get the best performance (high data rate, low latency) out of an isolated gigabit ethernet LAN (N.B. NOT connected to the internet) I would assume this would occur when there was no ...
0
votes
0answers
92 views

Capturing 802.11n HT control on wireshark

1) Using wireshark 1.12.2 with kernel 3.8.0-44-generic I cannot see any HTC+ fields in my packets. Is this a dissector issue in wireshark or related to my wireless nic. I have tried on both an alfa ...
0
votes
1answer
60 views

How do I get Wireshark to filter for a specific web host?

I'm using Wireshark on OSX, but I can't make any sense out of the filtering system. I have this filter set up: But when I hit that server, I don't see anything show up in the capture log. If I ...
0
votes
0answers
23 views

Mergecap multithread

I need to merge a lot of pcap files into one. I ran the command "mergecap *.pcap -w outputFile" , and it actually merges the files, but it's really slow. I was wondering if there's a way to launch a ...