The wireshark tag has no wiki summary.
-1
votes
0answers
33 views
Decode packet content as plain text with Wireshark
Sometimes I use Wireshark to capture network traffic encoded with custom, home-grown (text-based) protocols, or with software that implements the protocols so bad that Wireshark refuses to decode it, ...
0
votes
1answer
30 views
1 VoIP Conversation but 2 RTP Streams?
I'm testing a VoIP system based on OpenSIPS. It has no RTPproxy, so calls do not pass through OpenSIPS.
I tried to make a call between two smartphones, and it succeeded. I also turned on Wireshark, ...
1
vote
2answers
76 views
Do machines connected to the same switch belong to the same subnet?
When we talk about a subnet - do we mean all the systems connected to the same switch?
If I have an assigned IP address of 10.0.2.1, am I in the same subnet as that of 10.0.1.39?
When we talk about ...
2
votes
3answers
71 views
Wireshark on home-network
So basically I want to make WireShark ( Windows ) capture packets of the home network. As you know, home-networks are usually set by local IPs ( 192.168 or 10.0 range ) instead of the WAN IP so if we ...
0
votes
0answers
39 views
Saving traffic on a port to pcap format using an active intermediary
I have a service which listens on host1:5000. My intention is to redirect my client to localhost:5000.
What I desire is a service running on localhost:5000 that redirects all traffic to host1:5000 ...
0
votes
2answers
102 views
What is the protocol 'ftp-data' identified by wireshark?
Just implementing a FTP server and use wireshark to analize the protocol. I find there is a protocol identified by wireshark FTP-DATA. What is that? Any document or RFC can be referred?
Thanks and ...
0
votes
0answers
114 views
Windows 7 PC sends a lot of NetBIOS Name Queries for non-existent computer names
I have a Windows 7 PC, and have been monitoring network traffic using Wireshark, and I'm seeing this PC send out a lot of NetBIOS Name Queries for non-existent computer names.
These are some of the ...
1
vote
1answer
156 views
How can I stop my computer from doing arp poisoning attacks?
I have a small LAN in my home about 4 - 5 computers. The problem is that when there are usually 3 or more pc's online we keep losing the Internet access randomly about every 2 minutes.
So we took a ...
0
votes
1answer
91 views
running tshark command in windows batch file
I have written a batch file that runs a tshark command to filter fields from a wireshark pcap file and write them to a csv file. When i ran on the windows cmd CLI, i had to change the current working ...
0
votes
1answer
92 views
Can I use Wireshark to see what URL's my computer is invoking?
Is it possible to use Wireshark to see what URL and what params are being requested by my computer?
Something like:
www.foobar.com/someendpoint/bazboo
Does Wireshark offer this information in ...
4
votes
1answer
396 views
Wireshark WPA 4-way handshake
From this wiki page:
WPA and WPA2 use keys derived from an EAPOL handshake to encrypt traffic. Unless all four handshake packets are present for the session you're trying to decrypt, Wireshark ...
0
votes
0answers
28 views
dns returning null answer when using dnscache
I have a strange issue with Ubuntu's dnscache package. I am connected with an ethernet cable to my router (NAT is on), and I assigned myself a static ip. I set the dns server location to 127.0.0.1 ...
0
votes
1answer
94 views
Replace sensitive IP addresses in Wireshark with XXX.XXX.XXX.XXX
What would be an easy way to replace a sensitive IP address in a Wireshark packet capture with XXX.XXX.XXX.XXX? When I export the pcap in txt or csv I can no longer import it into Wireshark.
0
votes
1answer
34 views
Wireshark: Byte order changes when data exported
I am looking at a packet capture in Wireshark and try to export the data from a packet.
In Wireshark, it looks like this:
46 a5 e2 fb bd 69 ...
Then, after downloading, hexdump shows:
a5 46 fb e2 ...
1
vote
1answer
240 views
Cannot connect to website - SSL handshaking fails
So I cannot connect to certain websites. Just a few, most are OK. The one I really care about is paypal.com.
I have done the usual things. Let's see:
Cleared browsing history
Tried different ...
4
votes
0answers
462 views
How do I decrypt WPA2 encrypted packets using Wireshark?
I am trying to decrypt my WLAN data with Wireshark. I have already read and tried eveything on this page but without any success (well, I tried the example dump on that page and succeeded, but I fail ...
1
vote
0answers
68 views
how to find tcp streams without final ack/fin sequence in a huge packet capture file
I have a huge pcap file which contains a large number of individual tcp streams.But out of these , there are some invalid streams which dont have the final fin/ack sequence. Is there any way i can ...
0
votes
1answer
186 views
Do the “follow TCP stream” option in wireshark include duplicate packets?
When I tried to follow a TCP stream in wireshark, I found some duplicate packets. I wanted to know whether wireshark excludes duplicate(or retransmission) TCP packets from the "follow TCP stream" ...
-1
votes
1answer
48 views
I can not see ipv4 and http, I can just see ipv6 and SSDP [closed]
I have a real huge problem, when I am connected through the wireless of my university, I can just see adresses like this :
1823731 14856.287768 fe80::74b6:2d79:4343:41e1 ff02::c SSDP ...
1
vote
1answer
125 views
Why can't Wireshark read packets from ping?
I have Wireshark started, then I ping an IP address.
But Wireshark is not picking up any packet sending to or receiving (echoing) from the destination address.
Why? Is ping "protected" from being ...
2
votes
1answer
83 views
Wireshark and promiscous mode
I am using Wireshark for class. Does Wireshark put your card in promiscuous mode automatically, or must you manually do it? I've searched everywhere I can, and cannot find the answer. I have it ...
0
votes
0answers
200 views
Decrypting SSL in Wireshark with only private key of certificate signed with a DSA signature
I've generated a self signed certificate with corresponding key that is used to MITM a research object using sslsniff. This works, however, I'd would be fitting to have the traffic decrypted in ...
0
votes
0answers
19 views
Is it possible to use dissectors targeting different versions of Wireshark on the same computer?
I have two third party wireshark dissectors I wish to use. One was built against Wireshark 1.2, and does not work in the current version (1.6.x). The other was built against a recent version of ...
0
votes
1answer
314 views
Decrypting SSL traffic in Wireshark. Only headers get decrypted
I'm trying to decrypt SSL traffic in Wireshark, and it partially works because I'm able to view the decrypted headers. The problem is that I don't see any of the packet contents, only their headers. ...
0
votes
4answers
299 views
How do I limit packet capturing in Wireshark to only a specific protocol?
I would like to listen to HTTP traffic on port 8080. When I start capturing packets in Wireshark, it's flooded by packets using the SSDP protocol on port 1900. I would like to limit the packet ...
0
votes
1answer
162 views
How to set Wireshark to log ONLY DNS requests?
This works:
tethereal -i eth0 -w /root/mycapture.pcap
but it captures every packet. I only need to capture DNS requests. Is this possible? The server is Linux.
Other thing is: is it possible to ...
3
votes
3answers
358 views
Wireshark (Linux) captures only packet from and to my PC when in promiscuous mode
I've installed Wireshark and configured it to let my user run it with all needed privileges (I enabled dumpcap and added my user to wireshark group, then restarted).
Devices are shown and capture ...
1
vote
1answer
197 views
Filtering sniffed logs using Wireshark
I'm experimenting with packet sniffing and log examination using Wireshark, and I'm quickly realizing that I'm not nearly as safe as I should be when using public hot spots. In efforts to better ...
0
votes
1answer
90 views
What is fjappmgrbulk?
I captured a udp packet from wireshark which ones port is 2510 and destination ip is 81.64.155.202. What is that port for? I found this post) mentioning:
"it's for fjappmgrbulk, fjappmgrbulk ...
1
vote
1answer
302 views
Trying convert webserver certificate to PEM file for wireshark to monitor ssl traffic in HTTP format
I am trying to monitor https traffic as readable HTML.
I have downloaded the certificate from the server.
"In Internet Explorer, I selected the certificate and copy to file, DER encoded binary X.509 ...
3
votes
1answer
198 views
Vista DPI Scaling: Cannot disable DPI Scaling for Wireshark
I'm trying to disable dpi scaling for Wireshark, except Windows won't let me:
Yet i pick any other random executable in the folder, uninstall.exe for instance, i can do it fine:
What gives?
i ...
0
votes
1answer
46 views
WireShark: How do i use “Apply as filter”?
i'm seeing some packets in WireShark that i don't want to see:
No problem, right-click on SSDP and click
Apply as Filter
...and not Selected
Except i've never been able to get the Appy as ...
0
votes
0answers
191 views
Wireless sniffing to catch URL visited by user - Kismet
I am designing a software to record only the URL visited by students while giving exam. So I somehow need to know which IP is visiting which site.
I will have a list of all the IPs of students. I ...
0
votes
1answer
249 views
Wireshark sniffing “microsoft-ds [syn] seq=0..”
I'm new to wireshark. (installed it today)
I'm just looking at the traffic and noticed this kind of packages:
60261 microsoft-ds [syn] seq=0 Win=8192 Len=0 MSS=1460 SACK_PERM=1
its sent to ip: ...
4
votes
4answers
317 views
MTU is 1500, why the first fragment length is 1496 in IPv6?
ping6 ipv6Address -s 1500
This command will result a fragment. Observed by wireshark, the 1st fragment packet's length is 1496 (from layer 3). Since the MTU is 1500, I am confused by this 1496 ...
2
votes
1answer
475 views
Why do I keep seeing “Wireshark Cookie Dump Ok Cancel” in my input forms within Firefox?
I've recently installed Wireshark on my Macbook Pro. Since doing so, whenever I head over to http://jsfiddle.net, all of the input fields are pre-populated with
Wireshark Cookie Dump:
...
1
vote
3answers
177 views
Why do I have so many HTTP packets in Wireshark when I'm not doing anything?
Is it normal that I have huge amount of HTTP packets every second in Wireshark, even if I am not doing anything?
I would like to analyse some packets related to one website in particular, but how can ...
3
votes
2answers
229 views
My Mac trying to connect to a possible intruder's machine, that is not in the network anymore
I just asked a question I think someone else has access to my wireless network. What next?. I have changed wireless security to WPA2, changed the password, disabled file sharing etc as =suggested in ...
0
votes
2answers
86 views
Watching http in wireshark
Wireshark reassembles TCP Segments. For teaching purposes, I'd like to see the actual packets (not the reassembled TCP Segments) that flow on a network when you access a webpage.
Can I do that with ...
1
vote
3answers
566 views
How to test Bit Error Rates on Ethernet Networks?
I need a tool software or otherwise (preferably software) that will allow me to test Bit Error Rates on an Ethernet Network.
I am using a software tool that I did not write and do not have access to ...
0
votes
1answer
61 views
Wireshark filter for different interface
I know that before capturing packets, I can select specific interface.
I wonder is there any filter to distinguish different interfaces after I capture packets?
That is, at the beginning, I capture ...
3
votes
1answer
809 views
How to set up wireshark to run without root on Debian?
I'm trying to use wireshark on a Debian machine, but when I run it with my non-root user account, it doesn't detect any network interface.
I also tried running wireshark as root, but wireshark tells ...
2
votes
1answer
165 views
tcpdump filter for given bytes on given position
I'm searching for a way to filter traffic for specific bytes.
What I have is a stream that I capture with wireshark or tcpdump. Now it logs way too much, so I want to drop every packet that has 0x23 ...
3
votes
2answers
467 views
Unable to capture outgoing traffic with Wireshark on wi-fi network
I'm trying to use Wireshark on Backtrack 5 to capture packets that are transmitted through my home wi-fi network.
I'm perfectly able to capture outgoing traffic from localhost and, it seems, incoming ...
4
votes
1answer
1k views
Why do I see “The NPF driver isn't running. You may have trouble capturing or listing interfaces.” when starting Wireshark?
When I start up Wireshark, why do I see this message?
"The NPF driver isn't running. You may have trouble capturing or listing interfaces."
0
votes
2answers
262 views
tcpdump - just packet data
When using tcpdump, how can I print just the packet data?
For example (anonymized):
sudo tcpdump -X 'tcp port 80 and (((ip[2:2] - ((ip[0]&0xf)<<2)) - ((tcp[12]&0xf0)>>2)) != 0)'
...
6
votes
3answers
690 views
Chrome browser sending Keep-Alive packets?
I ran Wireshark on my PC and found that my chrome browser was sending LOTS of Keep-alive packets even when there are no sites loaded in the browser, and even when there are no extensions installed!! ...
1
vote
2answers
281 views
Networking packet sniffer for Linux that captures the application names?
I tried Wireshark. It shows the source and destination IP address, port number, and packet contents, but nothing about which application is using the packets.
Apparently tcpdump is similar; network ...
0
votes
1answer
361 views
How to wireshark traffic passing through my wifi AP
I know how to monitor the network interfaces on my local computer with wireshark. But how to monitor the traffic flowing through my wireless access point from connected computers?
It seems like this ...
4
votes
2answers
1k views
Wireshark cannot see traffic from a VirtualBox guest on Windows 7
I have been trying to use Wireshark to capture some traffic that comes from a virtual machine.
The setup is:
Windows 7 host
Ubuntu guest
VirtualBox 4
I send some packets from the guest to the ...
