The network protocol analyzer developed and maintained by the Wireshark Foundation

learn more… | top users | synonyms

1
vote
0answers
23 views

TCP packet issue with 802.11ac but not with 802.11n on an Android Nexus 6

I have an Android Nexus 6 that connects to my computer via an ad-hoc network. When my phone connects to the 802.11n card (TP-LINK 300Mbps Wireless N), the bytes are sent with no issue; verified with ...
0
votes
1answer
24 views

Why filtering on udp port in TCPDUMP gives only fragmented IP frames

I've a device capturing traffic with Tcpdump filtering on "upd dst port" then it creates a pcap file to be read in wireshark. what I obtain from running: tcpdump udp dst port 5201 -qUns 0 -i wlan0 ...
0
votes
1answer
23 views

Wireshark loopback on mac os x [closed]

I have selected loopback (in capture options) to capture http traffic on my localhost server, but everytime I do and HTTP I only can see TCP.
0
votes
0answers
7 views

How to capture VirtualBox VM packets

I am currently running a series of three Ubuntu 14.04 VMs on my Windows 7 x64 host. The guests are all configured thusly: Host-Only Adapter Intel Pro/1000 MT Desktop Promiscuous Mode: Allow VMs Cable ...
3
votes
0answers
41 views

why am I not seeing traffic using TCPDUMP while sniffing on wireless interface with the station in WDS mode

I've 2 wireless interfaces one has the type of AP and the other has the type monitor. the AP is attached to a bridge br-lan. When I run for example: tcpdump port 5201 -s 0 -ni wlan0 TCPdump is ...
0
votes
0answers
23 views

Https request call capture in Wireshark

I have installed Wireshark and Windows based application(to be analyzed) which uses https request authentication to validate user.When I use interfaces -- > capture all the request of my system is ...
0
votes
1answer
26 views

Graphical representation of iperf3 results

I'm using Iperf3 on 2 machines and actually I'm running 2 instances of Iperf3, one to generate traffic with high priority and the other generates traffic with low priority. I would like to generate a ...
1
vote
0answers
30 views

Viewing Xbox One Network Traffic

I am trying to view the HTTP/HTTPS traffic going from my XBOX one so I can see what is being requested. I started off trying to use Charles proxy like this https://www.youtube.com/watch?v=MP4ZcwSHxbw. ...
1
vote
0answers
17 views

Long SMB session setup delay

I have a Windows machine connecting to an SMB share on a local Debian server. Everything works flawlessly, when it's connected, but the first connection (either after a boot / reboot, or after ...
0
votes
0answers
28 views

WireShark - Vmware Network Interfaces

I've recently installed wireshark v1.12.4 on my Windows 8 Machine, and I am totally new to the program. I have a virtual machine running on vmware (Red Hat Linux 7.2) and got all the network ...
0
votes
0answers
92 views

Wireshark fails to install on OS X 10.10.3 using brew

I've encountered the following issue while installing wireshark via brew. ➜ ~ brew reinstall wireshark --with-qt5 ==> Reinstalling wireshark with --with-qt5 ==> Downloading ...
0
votes
0answers
25 views

Decrypt SSL Data in wireshark

In all the tutorials which I saw in web, they pointed me to add key file in Edit->Prefereces->Protocols->SSL->SSL key file but there is no such SSL key file in version I use. Can somebody guide how ...
0
votes
0answers
27 views

Reading packets with Wireshark

How do I read packets captured with Wireshark. I was finally able to capture incoming and outgoing data in hopes of developing something along the lines of an IDS. Thanks in advance for the help. A ...
0
votes
2answers
57 views

Duplicate IP address Telnet and ARP

I have 3 hosts (PC1, PC2, and PC3). I set the IP addresses for PC2 and PC3 to be 10.0.0.2 and PC3 to be 10.0.0.1. I telnet from PC1 to 10.0.0.2. I then am logged in to PC3. I can see in Wireshark that ...
-2
votes
0answers
23 views

Duplicate IP address Telnet and ARP [duplicate]

I have 3 hosts (PC1, PC2, and PC3). I set the IP addresses for PC2 and PC3 to be 10.0.0.2 and PC3 to be 10.0.0.1. I telnet from PC1 to 10.0.0.2. I then am logged in to PC3. I can see in Wireshark that ...
0
votes
0answers
12 views

tcptrace from wireshark capture

How can I use tcptrace to generate tcptrace graph from captures on wireshark ? I already know how to generate the tcptrace on wireshark itself, but I want to generate the graph outside wireshark ...
0
votes
1answer
16 views

How to find 802.11 protocol variant, and decipher packet_payload_info in PcapNG files?

I'm building a (Python) parser of PcapNG files created by Wireshark. After reading https://www.winpcap.org/ntar/draft/PCAP-DumpFileFormat.html, I'm having the following problems: I'd like to ...
0
votes
1answer
20 views

Does connecting to one's computer via local router automatically uses the loopback?

I have a TCP application that doesn't show up on Wireshark. I read it was because Wireshark is not able to sniff Loopback communication on Windows. So, instead of connecting to 127.0.0.1, I connected ...
0
votes
0answers
16 views

Wireshark capture file: getting “missing packet” now, was not there 1 year ago

I captured data on a LAN. I then opened the pcap file with wireshark and could extract an email which was sent unencrypted on purpose. Means, I selected a package from the email and used "follow TCP ...
1
vote
0answers
35 views

Why does a radio stream not appear on a packet monitoring tool?

I am currently trying to find the URL to the audio stream for a webradio that only provides a flash player, that I would like to use with MusicBee's radio player. After using Wireshark to monitor my ...
0
votes
0answers
22 views

How is the FID generated for a SMB “Create AndX Request?”

I see in the traces while accessing a network share, there are multiple CreateAndX requests (which opens the folders) with an FID associated with them. However, some of them don’t and they get a ...
0
votes
0answers
20 views

VirtualBox Network confusion?

I'm trying to adjust my VirtualBox guest network in order for my guest O/S traffic look like its coming from my Host. Can I do this with NAT? Here's a simpler outlook on what I am trying to achieve ...
1
vote
2answers
79 views

Wireshark only captures packets to or from this device

I use wireshark on ubuntu 14.04 and I am trying to sniff wifi traffic of other devices in my network. I run wireshark or tshark on wlan0, start capturing packets and send some pings or open some pages ...
-1
votes
1answer
38 views

Wireshark - Browser software

I just touched wireshark yesterday from my class. I was told to run wireshark while browsing www.kompas.com, and there is this question that is quite ambiguous. "What browser software shown in ...
0
votes
2answers
91 views

TCP Dup ACK/Retransmission, bad configuration?

I'm currently investigating network issues of a friends LAN (again). The Internet connectivity is very slow and unreliable and sometimes services simply don't work. I've monitored the traffic for ...
0
votes
3answers
160 views

How to find IP address of a DNS server

I'm a CS student and currently taking a (basic) course in information security. I was given an assignment which required me to analyse a given .pcap file using Wireshark and obtain information on the ...
0
votes
0answers
23 views

Wireshark capture SSL only

I would like to capture SSL or HTTPS traffic only in Wireshark, this is not something that can be filtered after due to the length of the time I would be recording the data after and the size of the ...
0
votes
0answers
185 views

Whatsapp traffic analyzed by WireShark

how to know info about the person I chat with in the Whatsapp by analyzing traffic got by WireShark Software where is he located at the moment of chatting. regards, Samad
0
votes
0answers
31 views

Do not fragment bit and windows 7

Recently had an issue where the DF bit was set to 1 going from a W7 workstation to the update server, the issue is it was sending 32K of data when the MTU was set to 1500. When the packet hits the NIC ...
0
votes
1answer
102 views

wireshark monitor mode, decrypting capture

I have a network, which has 2 nodes (a phone, a MacBook) both are connected to same wireless network, I know the SSID and password for the wireless network password: mypassword ssid: myssid security: ...
0
votes
0answers
75 views

init-p01md.apple.com/bag - iMessage?

I have a question about Apple network traffic. In my network program I can see these three domains (GET) http://init-01md.apple.com/bag http://init.ess.apple.com/WebObjects/VCInit.woa/wa/getBag?ix=1 ...
0
votes
1answer
22 views

Multiple TCP Connections to download simple webpage and images?

I created a very simple webpage: <html> <body> foo bar <img src="img1.png"/> <img src="img2.png"/> <img src="img3.png"/> Hello world </body> </html> And ...
1
vote
0answers
155 views

How to use Charles as proxy to decrypt HTTPS messages in Wireshark?

I know I can view decrypted HTTPS data directly in Charles. But I want to view lower level SSL messages in Wireshark. So I setup Charles as the SSL proxy, using my own certificate, and I setup SSL ...
0
votes
0answers
19 views

Frame logging of third party hardware on my router (specifically smart TV)

After reading recently about so-called smart TVs "listening" to sound in a person's home, and transmitting this recorded sound across the internet for speech-to-text translation, I have become curious ...
0
votes
0answers
26 views

Can I use a Windows 7 Computer as a Bridge and Sniff Traffic

Sorry if this has been asked before, but I've been searching for quite a while. My question is simple - can I use a Windows 7 computer as a bridge, and run WireShark to capture all of the packets at ...
0
votes
0answers
16 views

WLAN topology: does it work like a bus?

Does wifi work as a star network with a switch or does it work like a bus ? To be more precise, if I am in promiscuous mode, do I only see my traffic and broadcasted messages or do I get every packet ...
0
votes
0answers
46 views

HTTP Sniffing using wireshark

I am using Wireshark on my Mac, which is running Yosemite. When I am sniffing the HTTP protocol, I can only see the HTTP/get and I cannot see the HTTP/OK.. Is there a way to enable this on my MAC? I ...
0
votes
1answer
35 views

I see frequent PTR requests in my wireshark capture, are they normal?

Lately I've been getting very frequent DNS lookup failuers (I use Google's dns servers) so I set up wireshark to see some of the traffic and I see many PTR requests for IP's that don't seem relevant. ...
2
votes
1answer
240 views

wireshark usb traces explanations

I am trying to reverse engineer an usb (HID) device and cannot really figure out how what I see on wireshark (usbmon + wireshark on linux, or windows) relates to the usb protocol?. I have looked at ...
1
vote
3answers
47 views

Binary file viewer tool support file format information extraction

I'm always curious about what is hidden inside those files, like pdf, mid, mp3, mkv, etc. I can read the spec in the wikipedia, but it is hard to understand. Tools like wireshark can extract data ...
0
votes
0answers
68 views

Why does lldpctl show no neighbors on standalone Ubuntu system?

I have installed sudo apt-get install lldp in two different ubuntu system and in both system I have set (/etc/default/lldp) DAEMON_ARGS="-x -c -s -e -l" I have check in wireshark also transmitted ...
0
votes
1answer
16 views

LAN over RF link leads to intermittent errors

We have an odd error occurring with our network, the setup is: IP Camera -> Radio LAN repeater -> Local switch -> PC The IP camera is streaming video over RTSP / UDP and we can control it ...
1
vote
1answer
30 views

Filter all packages that not use a specific port

I use wireshark to watch a captured pcap file. I see a lot of communication on a specific port, that I am not interessted in, so i want to filter it to see only the rest of the communication. I used ...
1
vote
1answer
79 views

Why am I not seeing ARP requests from my own machine in wireshark?

I am using Windows 7. I open up Wireshark and start a live capture with the filter: ip.src == THIS.IS.MY.IP I then go to a command line and do an arp -d * and ping a bunch of stuff. I see my ICMP ...
1
vote
0answers
62 views

How to split pcap files maintaining tcp sessions

I have a pcap file which contains tcp traces. I was wondering if there's a way to split these traces in order to maintain tcp flows, but also filtering the traffic on a src ip basis. For example, if ...
0
votes
0answers
64 views

Windows7 LIVE CD with winpcap

Is it possible to create a LiveCD of windows 7 with winpcap installed for wireshark. I already tried with winbuilder 0.82 but there is no working script for winpcap and since it is not a portable app ...
-1
votes
1answer
103 views

Can my history be tracked if I'm connected to my cellular data instead of wifi

If my phone is using its cellular data instead of being connected to wifi, can wireshark still see what I'm doing?
0
votes
0answers
40 views

Wifi sniffing only outgoing packets

When I am setting my wifi card in monitor mode and disconnecting it from wifi I am able to sniff every packet coming in and out from my tablet (http requests and responses) but when I connect to ...
0
votes
1answer
37 views

Make CISCO RVS4000 into hub mode

I am trying to do packet analysis with a RVS4000 Cisco device that has four computers connected. The device is not broadcasting packets to the other devices connected to the device. For my lab, I ...
0
votes
1answer
29 views

Wireshark capture a website packets

In my browser I connect to www.superuser.com In wireshark filter I want to access to those packet which I receive from this web site. what is that filter? Note : I do not want to use ip address.