The network protocol analyzer developed and maintained by the Wireshark Foundation

learn more… | top users | synonyms

0
votes
1answer
18 views

Human readable SSL/TLS packets

If I have a protocol-analyzer/packet-sniffer, such as wireshark installed on a particular device.. (or in this case; tcpdump & tshark etc. on my smartphone..) ..should I be able to read ...
-1
votes
2answers
14 views

Why does a USB Adapter set to monitor mode on Linux not capture non-WiFi traffic send on the same frequency (2.4GHz) as WiFi ?

I have a WiFi Adapter from Alfa that can function in Monitor mode on Linux. Once I set it up and run Wireshark, I am able to see traffic across other routers and devices. If there is a new protocol ...
1
vote
1answer
19 views

Wireshark's reassembled PDU consists of TCP segment size > MSS?

I'm looking into a Wireshark record provided by someone, to analyze something for them. Wireshark has conveniently reassembled 3 TCP segments that all transported a single TLS packet. The TLS packet ...
0
votes
0answers
27 views

Windows Server 2012 r2 DHCP not serving addresses

Yesterday I encoutered a DHCP problem. After windows update and restart, my dhcp won't serve any new IP addresses. The ones wich has been sent before are working but no new IP-s. I tried restarting ...
3
votes
0answers
41 views

where does Windows Task Manager measure network data rate

I am trying to build a 10Gbps Ethernet channel between an FPGA and a Windows 7 PC. For a rough estimate, I measured the bandwidth usage of the link using Windows Task Manager's Network Tab. Later I ...
0
votes
0answers
14 views

Using TCPView / wireshark to find exact address application reaches

I think a c++ application I have on my computer is download a virus from a server. I have used wire shark and TCPView and have determined the global broadcasting address it is connecting to. However ...
0
votes
0answers
16 views

Unable to find traffic for specific device w/ Wireshark (over Wi-Fi)

I have a device communicating with a TCP server running on my machine. My machine is normally connected to the network via ethernet, however I also have a wireless adapter that I can use to connect to ...
1
vote
2answers
44 views

all outgoing tcp packets have source port 0.0.0.0

Currently I am connected to a network 169.254.x.x (a Hostel's Network) and there are three gateways that work as dhcp servers as well: 169.254.10.1 169.254.20.1 169.254.30.1 From a windows machine ...
1
vote
2answers
22 views

Can't decipher capture file

I'm playing with airodump-ng and wireshark (I'm not a networking specialist). I have captured some packets from my network with airodump-ng and wanted to open them in wireshark, but they seem to be ...
0
votes
1answer
571 views

How can I set up remote capturing in Wireshark, capturing from a CentOS server on my Windows laptop?

I'm looking to capture packets from a remote server network interface. The remote server is running CentOS and has tshark installed. I'm working on a Windows 8 machine with Wireshark installed. ...
2
votes
1answer
45 views

Using wireshark to snoop on RTSP over wifi

I just got a video baby monitor. It has several ports open including RTSP (554) by using Fing which is acting like nmap. I'd like to figure out what the full URL is of the stream. I have tried to ...
0
votes
1answer
12 views

Allow http request over specific port in iptables

I'm running Kodi with a web service for the remote control. The web server is listening to port 11734, however opening that port (UDP and TCP) doesn't seem to work. Once I accept all incoming traffic ...
0
votes
0answers
40 views

Simple ICMP DOS attack example with cmd on Windows 10 crashing the attacker's computer?

I had to make a simple batch file as an assignment in which I had to attack another pc on the same network by a ICMP DOS attack and analyze the traffic using Wire-Shark. Here the code which I used: ...
0
votes
1answer
39 views

Intercept traffic from a RJ45 TV box

I'm using a box that connects to the internet using an RJ45 cable. I would like to see the HTTP traffic that goes in and out the box. Would you plug a computer to the same network and run Wireshark, ...
0
votes
0answers
6 views

Capturing virtual machine traffic from Mac OS

I am running Windows 8.1 pro on VMware hosted by Mac OS. I want to capture the VM traffic via Wireshark installed on Mac. The Network Adapter on VM is set as Bridge (Ethernet). When I set ...
1
vote
0answers
49 views

Packet injection in a Wi-Fi network with card in monitor mode

I have a computer connected to a WEP-protected Wi-Fi network. With scapy I can forge packets (let's say ICMP) and send them to another station of the same network. If I put my wireless card in ...
0
votes
1answer
62 views

Sniff wireless (Wi-Fi) traffic with Wireshark

I have a wireless card (ALFA AWUS036H) in monitor mode (with airmon-ng start wlan0) on my Debian machine. In Wireshark, in "capture options", all my interfaces are in promiscuous mode. The test ...
0
votes
0answers
24 views

Problems with NAT - Wireshark shows TCP Dup ACK

I'm having some issues with NATing to a couple of web servers on my site. I initially thought it was my firewall after an update (smoothwall) but I blanked it and reinstalled and its still not ...
0
votes
1answer
31 views

How to use the old Wireshark interface?

I download Wireshark 2.0 and it has a new interface. The Release Notes 2.0 say: Wireshark 2.0 features a completely new user interface which should provide a smoother, faster user experience. The ...
0
votes
0answers
15 views

How do I configure an ESP SA for wireshark 2.0.2 to decrypt ? It doesn't seem to let me set up the SAs

I read detailed directions which do not correspond to what I see in ESP (Edit->Preferences->Protocols->ESP) I see ESP SAs [Edit..] but, clicking edit, I cannot edit. What is the trick ?
1
vote
0answers
34 views

Use Ethernet only for Wireshark when WiFi is enabled (Linux)

I'm using Wireshark to capture network traffic (via a SharkTap 10/100.) This works well but when I plug in the Ethernet cable the laptop treats it as a normal LAN connection and routes all laptop ...
0
votes
1answer
18 views

A bunch of tcp unseen segments and duplicates on wireshark?

Recently, my Mac has been unable to use the internet well. Even though it said my ping was between the ranges of 10-20 ms and my download speed was around 20 Mbps along with around a 10 Mbps upload ...
1
vote
1answer
20 views

Acknowledgement number of an RST packet

This question states that the acknowledgement number of an RST packet should be 0, but I have found it to be other than 0 when I captured some HTTP packets using Wireshark. So when does the ...
0
votes
2answers
64 views

Wireshark showing only my own packets in promiscuous mode even in open Wi-Fi

I am doing some tests for my project, and I am connected to my Access Point (which is open; no security) wirelessly. Theoretically, when I start a capture in promiscuous mode, Wireshark should ...
1
vote
0answers
67 views

How to parse a Wireshark pcap for a string

What efficient ways exist to parse a Wireshark capture to check for a given string? I'm trying to find a STOP command for an embedded device that its plaintext in the Wireshark 'info' field. Are ...
0
votes
2answers
34 views

Wireshark does not display ARP frames before ICMP frames on a ping request

So far I know that if Wireshark does not display ARP frames before ICMP frames, it's usually because there are ARP requests in the cache. I did check the cache and deleted any ARP data in the cache: ...
0
votes
1answer
41 views

Is there a way to reliably search for command line execution in Wireshark?

Let's suppose I wish to inspect the Packet Bytes section and search for inbound shell command execution--specifically, the "dir" command on a Windows machine. From a remote attacker's CLI, I'll ...
0
votes
1answer
300 views

how fix configure: error: Qt is not available when install wireshark?

this is my problem: cd '/home/james/Desktop/wireshark-2.0.2' ./configure ... checking if profile builds must be generated... no checking for Qt5Core - version >= 5.0.0... no checking for QtCore ...
0
votes
0answers
26 views

Troubleshooting dropped packets in Telegram Messenger

I'm experiencing problems in using Telegram Messenger on my Mac, but only when connected at home (specifications at the end). More specifically, when uploading and downloading media (or even while ...
0
votes
1answer
30 views

How to identify an internet hog?

Our small office network will occasionally slow when a coworker starts a large download or a large file transfer between an in-house server and their local machine. How can I identify this hog on my ...
0
votes
1answer
156 views

promiscuous mode not working

I've searched, and heard that the promiscuous mode lets us listen to all wireless trafic in the Access Point that we are associated with. But when i use this mode with wireshark, i don't get the exact ...
0
votes
1answer
38 views

Does Ventrilo encrypt the VoIP stream, session, and/or communications?

If you're not familiar, Ventrilo is a voice chatroom used for gaming. Here's the wiki for Ventrilo and similar software Mumble and TeamSpeak to give you an idea of what the software is about. I ...
0
votes
1answer
36 views

Capture Only HTTP traffic in tshark

I am new to tshark tool usage. I am trying to use tshark tool for capturing only HTTP traffic but i am unable to do it. Here is the cmd i run to get the all traffic: tshark -c 1000 -w packetFile.pcap ...
0
votes
0answers
47 views

NAT doesn't allow TCP ACK for sent TCP SYN

We are using TCP Simultaneous Open for connecting TCP socket. Lets call one SideA and other SideB. From the wireshark log I see that first two SYN sent from SideB is blocked by SideA NAT. Then SideA ...
1
vote
1answer
40 views

Why am I seeing packets intended for other recipients while behind a router?

I'm using a wired internet connection. The ISP provides an ethernet cable, a static private IP, and a dynamic public IP. I bought a router and gave the router the static private IP. I'm using ...
0
votes
1answer
10 views

How can specify limit for trace collection in OS X wireshark?

Wireshark noob here, trying to figure out how to set a limit for trace collection in OS X Wireshark. I did a search on the wiki page but nothing comes up in the results.
0
votes
1answer
20 views

Safe Capture of WAN Packets

I have an aggregating network tap between my WAN connetion and my home router. I have a dedicated machine running Wireshark to capture all WAN traffic via the network tap. This machine is running ...
0
votes
0answers
24 views

Wireshark FTP multiple ACK?

I'm trying to visualise somes frames that correspond to a file transfer between two machines on Wireshark. The thing is that there are multiple ACK for each FTP-DATA segment and I don't understand ...
0
votes
1answer
37 views

How to check which TLS cipher suite is used in tcp connection

I am using imapfilter to sort my mails on a remote IMAP server provided by some company. My configuration restricts imapfilter to the usage of TLS 1.2 via STARTTLS. I do know how to check which TLS ...
-1
votes
2answers
50 views

Can only see the traffic of the host in Wireshark?

I need to analyze the traffic of my network; the outgoing traffic that hosts in that LAN generate directed to a certain IP using HTTP protocol. I've tested it with Wireshark, but I can only see the ...
0
votes
0answers
81 views

Spying on Wi-Fi-connected device from laptop

I want to capture (and possibly modify) packets from a WiFi-connected device using my MacBook Pro and I am trying to figure out the most straightforward way of doing so. I have solved the problem ...
0
votes
1answer
671 views

What does a sequence of retransmissions with PSH,ACK flags mean (and a spurious retransmission back)?

I am on server 192.168.0.2 and want to make a HTTP call to 192.168.0.1(both servers are RPis and run Linux (raspbian)). curl -XGET http://192.168.0.1:8081/api The API on 192.168.0.1 (which I am ...
0
votes
0answers
65 views

Replay captured TCP packets

I captured a tcp traffic using wireshark and saved the traffic in pcap file. I did two tests: Test 1: sudo tcprewrite --infile=capturedtraffic.pcap --outfile=temp.pcap ...
0
votes
1answer
38 views

Snort wont trigger alert from tap interface eth0

I have snort set up on a raspberry pi running a modified Ubuntu. Between my modem and router I have a switch that mirrors all the traffic to a port that is connected to the eth0 interface on my ...
0
votes
0answers
25 views

Routing between two NICs same PC

I have two NICs, 192.168.56.0/24 and my wifi NIC 192.168.1.0/24. Can I route between these two NICs to be able to ping from my Physical HOST to any host on 192.168.56.0/24 while using VMs? I know ...
0
votes
2answers
51 views

How to see DHCP boot setup in wireshark?

My client tries to boot wrong file with DHCP and I'd like to debug it. My previous configuration was to boot with lpxelinux.0 file but now I changed it to pxelinux.0. But client is still looking for ...
0
votes
2answers
91 views

My DNS server queries root servers?

So, I have a DNS server and a host in a lab environment. When my host queries for the IP of an web-address, like www.[somewedishwebsite].se (Swedish domain), it first queries my DNS server with IPv4 ...
1
vote
3answers
71 views

I can hear it pinging and talking, but it can't hear anything

I got one-way connectivity to some devices and sometimes(randomly) no connectivity, with odd link-status LED lighting. There are 1 PC(mine) and 2 routers('A' and 'B') connected to a switch(unmanaged) ...
0
votes
2answers
232 views

Wireshark to capture all IP devices on a network

I have a Windows PC with hardwired Ethernet and two wireless Linux devices on a LAN. My Wireless router is an Asus RT-AC68U. The Windows PC is running Wireshark. I would like to capture all network ...
1
vote
1answer
83 views

Hide one VM's traffic from another when using Wireshark in Virtual Box

Versions: Host OS: Windows 10 Virtual box: 5.0.10 r104061 VM1: Kali Linux 2.0.0 VM2: Ubuntu 15.04 I have two VMs that I'm practicing penetration testing on. I'm trying to create a man in the ...