The network protocol analyzer developed and maintained by the Wireshark Foundation

learn more… | top users | synonyms

0
votes
1answer
42 views

Computer is sending / receiving data form a computer and I don't know why

So I have been playing with WireShark and I have found something weird. After closing every application that uses the internet (As far as I know) I have found that my computer is sending / receiving ...
1
vote
1answer
45 views

Monitor Mode doesn't work in Kali 2.0

For the last year or so I have been using this exact setup with Kali 1.0. Everything worked fine with Wireshark. Now, when I am connected to a Wi-Fi access point my card REFUSES to stay in monitor ...
1
vote
1answer
13 views

Promiscuous mode not working with ubuntu and wireshark

I am running Ubuntu Linux and have installed wireshark on it. I can see the incoming and outgoing traffic just fine. Now I want to see the traffic from other devices which are on my LAN. So, I did: ...
0
votes
3answers
30 views

Can WireShark be used to collect packets on same network?

I am trying to sniff packets using Wireshark. But Wireshark collects packets of computers connected to my Router only. If i know the IP address of a Computer , can i sniff the packets of that Computer ...
0
votes
0answers
20 views

Confusion in Iperf server report?

I am connecting one of my computers to LAN which is connected to 802.11n Access Point using ethernet cable while my other computer is connected to wifi. When I send 20Mbps traffic from iperf while ...
0
votes
0answers
8 views

How can I use Microsoft Network Monitor to view messages sent via socket client/server

I would like to view the exact messages sent/received in Microsoft network monitor, but I do not know how. I have build a program to send messages via TCP socket and If a message "ready" is sent over ...
1
vote
1answer
24 views

How to resolve DNS from java like WIRESHARK does?

Could you explain how Wireshark makes a DNS query in order to resolve the name of an IP address? My issue is about the mismatch between the domain name resolved by Wireshark and that returned by ...
0
votes
0answers
19 views

Wireshark won't open

I'm having trouble with wireshark on Kali Linux 1.1.0 when I try to open it the process bar loads to 100% and says "loading configuration files" but it gets stuck there. Anyone know how I can fix ...
1
vote
3answers
55 views

How does Wireshark resolve DNS names?

Could you explain how Wireshark makes a DNS query in order to resolve the name of an IP address? My issue is about the mismatch between the domain name resolved by Wireshark and that returned by ...
0
votes
0answers
10 views

Is there a light exe / sniffer to ensure that certain traffic is traveling over intended ports to validate vpn/ssh settings?

I'm using ssh and split-tunneling vpn and I'd like to get a log of which traffic is sent over which ports. Is there a simple software to do this? Is there a way to easily show this over wireshark ...
0
votes
0answers
15 views

Multiple syn's before handshake connection?

I have a scenario, I'm analyzing ssl (decrpyt) traffic to my webserver. I'm investigating server and end-to-end delay issues. In between this I'm stuck at following traffic pattern for which I need ...
0
votes
1answer
11 views

libpcap : Filter by ether_type and by speficied bytes

Thanks to pcap_filter, I want to filter by ether_type : Protocol 0x88b5 AND by specific bytes in the payload : "ASK", or 0x41434b It's ethernet-level => no network layer, directly the payload. => ...
0
votes
0answers
25 views

TCP Retransmission on the receiver side

How does Wireshark knows that a packet on the receiver side is being retransmitted. I mean it makes sense on the sender side: Wireshark sees two identical packets (with the same sequence number) being ...
0
votes
0answers
58 views

packets information in tcpdump /capinfos

I'm testing the packet capture efficiency of a sniffer application (netsniff-ng) w.r.t a proprietary sniffer recorder. I had a linux system use tcpreplay to send 25 pcap files @ 100Mbps to both the ...
0
votes
1answer
42 views

find url of radio stream

I'm trying to find the actual stream URL of an radio stream, specifically this one. There are a bunch of questions for this, but none of them have helped at all. Some have said that I can use ...
0
votes
0answers
30 views

Bluetooth Capture Interface missing on Wireshark / Kali Linux 1.1.0a

I'm trying to capture local bluetooth traffic from my device running Kali Linux 1.0.0a with wireshark. However, the bluetooth capture interface is not shown. According to the documenation it should be ...
0
votes
0answers
24 views

Identifying SSH sub flows in tshark

I am currently considering the implementation of a research paper for which i need to identify the transport, connection and authentication protocols in SSH. I went through the RFC and have concluded ...
0
votes
1answer
41 views

Unable to start npf driver

I need to start the npf driver for Wireshark but when I try to type "net start npf" in cmd prompt, I get the following error: "System error 1058 has occurred. The service cannot be started, either ...
1
vote
0answers
43 views

How to use wireshark to decode SSL stream from remote API server?

I'm trying to troubleshoot some issues with what my code is sending to a remote API (over https). I've seen a ton of articles on Wireshark and decoding SSL, but they all make up their own test server ...
2
votes
5answers
160 views

Can I collect wireless packets using Wireshark while being connected to the Internet via cable?

I am working on a PC which is connected to my router using a LAN cable, and the other computers in my house are connected to my router using WiFi. We are all connected to the same network, so I ...
0
votes
0answers
26 views

Wireshark 1.99 monitor mode?

Relatively new to Wireshark, running 1.99.7 on a MacBook Pro (2015), OS X Yosemite 10.10.3. I have no problem with basic capture via wifi, but have been unable to figure out how to turn on monitor ...
0
votes
0answers
33 views

Tshark vs. Wireshark - performance

I have a 10Gig NIC that I want to sniff. Shall I expect a better performance when using Tshark in place of Wireshark? I wonder if there is no expected boost, since I didn't find any benchmarks.
0
votes
0answers
26 views

how to parse a pcap file for specific words

I got a 90GB pcap file that I am trying to calculate the tcp retransmission rate for. As the file is very large I was thinking just parse it locally on the redhat server that it is sitting on. FTPing ...
1
vote
0answers
55 views

TCPDUMP Network IPv6 Packets

I am new to tcpdump tool and I am working in the analysis of network packets, I have analysed the IPv4 Ip packtes generated in case of wifi. But Now I am running my android phone in sim's 3g network ...
0
votes
0answers
20 views

I cannot capture DHCPv6 packets on GNS3 using Wireshark

I have got a router set up as a DHCPv6 server connected to a host that gets an IPv4 & IPv6 addresses from it, however I am not able to capture any DHCPv6 packets at any point of the connection. ...
0
votes
0answers
39 views

Connection interruptions on Debian router, possibly due to excessive duplicate ACKs?

I have a Debian server as a house router, which for a year has been working flawlessly. However, I recently moved and switched service providers from FiOS to Comcast, and possibly as a result am ...
0
votes
0answers
13 views

Tshark interface to sniff on

I have a MQTT broker and a MQTT client both running on the same machine. The client sends publish packets to the broker. The broker processes it and sends it back to the same client as publish packet. ...
0
votes
1answer
28 views

iperf and Wireshark show different data rate

I was testing the capture performance of a sniffer application in Linux. I have a Windows machine that sends UDP multicast packets to the capture port of the sniffer system using iperf at 8Mbits/s. I ...
0
votes
0answers
31 views

Using I/O graph how to interept bytes/tick against packet details information?

I'm working on a trace-file which has reported ISP throttling occurrences in it. My task is to use IO graph to understand at what point in time the throttling process effected client upload ...
0
votes
1answer
36 views

Get entire packets size in Wireshark

Is there a way to show the size of all of the packets received in Wireshark? For example, if I have 10 packets received and the size of each packet is 1 KB, then Wireshark would display: 10 KB.
1
vote
2answers
115 views

What causes dropping of ARP response packets in a wireless network?

I have a network of wireless access points (APs) in my local area network (LAN). Some PCs in the network can get ping responses from some other PCs/devices in the network but not some others. I have ...
0
votes
0answers
36 views

Monitor TCP port traffic and get a sound alert when a specific text string is found on Windows

I need to watch a port for several hours and make an audible alert whenever a specific string comes through. Windows only. Is this possible with Wireshark or another sniffer tool or maybe a sniffer ...
2
votes
1answer
33 views

router automatically disables wifi and enables after 2-3min

Router: Netgear DGN2200v2 Problem: THe router disables the wifi network automatically(with no human interference what so ever), thus all pc's disconnect and have no network access(as if the router ...
0
votes
1answer
142 views

Possible network loop with WiFi and Ethernet when docked

I have been seeing a weird problem that I can't reproduce on demand and have a suspicion on the root cause. The Issue: Intermittently the entire network goes down until I walk around and unplug ...
1
vote
1answer
242 views

tcpdump not displaying RSSI

I am monitoring Wi-Fi probe requests via tcpdump on Debian and am trying to capture the RSSI (signal strength) of each probe request element. Currently, the output from tcpdump for each probe request ...
0
votes
0answers
44 views

How to get Alfa awus036nha to work with Ubuntu 14.04?

I installed Ubuntu 14.04 in a dual boot configuration with OS X Yosemite. I then installed Wireshark on Ubuntu and I'm going to use an Alfa AWUS036NHA (Atheros chipset) adapter. The problem is that ...
0
votes
1answer
62 views

wireshark save capture directly to file with filter

I am looking to have a long-term packet capture running to monitor DNS requests on my machine. I generally use wireshark for network monitoring, but since I am only interested in DNS packets, and over ...
0
votes
2answers
70 views

How to run sniffing demonstration using virtualbox and wireshark

I am going to have a demonstration of packet sniffing using wireshark. Therefore, I decided to create two vitual machines in virtualbox (with "host-only adapter" network config) and monitor the ...
1
vote
0answers
57 views

TCP packet issue with 802.11ac but not with 802.11n on an Android Nexus 6

I have an Android Nexus 6 that connects to my computer via an ad-hoc network. When my phone connects to the 802.11n card (TP-LINK 300Mbps Wireless N), the bytes are sent with no issue; verified with ...
0
votes
1answer
223 views

Why filtering on udp port in TCPDUMP gives only fragmented IP frames

I've a device capturing traffic with Tcpdump filtering on "upd dst port" then it creates a pcap file to be read in wireshark. what I obtain from running: tcpdump udp dst port 5201 -qUns 0 -i wlan0 ...
0
votes
1answer
76 views

Wireshark loopback on mac os x [closed]

I have selected loopback (in capture options) to capture http traffic on my localhost server, but everytime I do and HTTP I only can see TCP.
0
votes
0answers
32 views

How to capture VirtualBox VM packets

I am currently running a series of three Ubuntu 14.04 VMs on my Windows 7 x64 host. The guests are all configured thusly: Host-Only Adapter Intel Pro/1000 MT Desktop Promiscuous Mode: Allow VMs Cable ...
4
votes
0answers
96 views

why am I not seeing traffic using TCPDUMP while sniffing on wireless interface with the station in WDS mode

I've 2 wireless interfaces one has the type of AP and the other has the type monitor. the AP is attached to a bridge br-lan. When I run for example: tcpdump port 5201 -s 0 -ni wlan0 TCPdump is ...
0
votes
0answers
44 views

Https request call capture in Wireshark

I have installed Wireshark and Windows based application(to be analyzed) which uses https request authentication to validate user.When I use interfaces -- > capture all the request of my system is ...
0
votes
1answer
143 views

Graphical representation of iperf3 results

I'm using Iperf3 on 2 machines and actually I'm running 2 instances of Iperf3, one to generate traffic with high priority and the other generates traffic with low priority. I would like to generate a ...
1
vote
0answers
87 views

Viewing Xbox One Network Traffic

I am trying to view the HTTP/HTTPS traffic going from my XBOX one so I can see what is being requested. I started off trying to use Charles proxy like this https://www.youtube.com/watch?v=MP4ZcwSHxbw. ...
1
vote
0answers
26 views

Long SMB session setup delay

I have a Windows machine connecting to an SMB share on a local Debian server. Everything works flawlessly, when it's connected, but the first connection (either after a boot / reboot, or after ...
0
votes
0answers
117 views

WireShark - Vmware Network Interfaces

I've recently installed wireshark v1.12.4 on my Windows 8 Machine, and I am totally new to the program. I have a virtual machine running on vmware (Red Hat Linux 7.2) and got all the network ...
0
votes
0answers
161 views

Wireshark fails to install on OS X 10.10.3 using brew

I've encountered the following issue while installing wireshark via brew. ➜ ~ brew reinstall wireshark --with-qt5 ==> Reinstalling wireshark with --with-qt5 ==> Downloading ...
0
votes
0answers
42 views

Decrypt SSL Data in wireshark

In all the tutorials which I saw in web, they pointed me to add key file in Edit->Prefereces->Protocols->SSL->SSL key file but there is no such SSL key file in version I use. Can somebody guide how ...