The network protocol analyzer developed and maintained by the Wireshark Foundation

learn more… | top users | synonyms

0
votes
1answer
5 views

libpcap : Filter by ether_type and by speficied bytes

Thanks to pcap_filter, I want to filter by ether_type : Protocol 0x88b5 AND by specific bytes in the payload : "ASK", or 0x41434b It's ethernet-level => no network layer, directly the payload. => ...
0
votes
0answers
21 views

TCP Retransmission on the receiver side

How does Wireshark knows that a packet on the receiver side is being retransmitted. I mean it makes sense on the sender side: Wireshark sees two identical packets (with the same sequence number) being ...
0
votes
0answers
46 views
+50

packets information in tcpdump /capinfos

I'm testing the packet capture efficiency of a sniffer application (netsniff-ng) w.r.t a proprietary sniffer recorder. I had a linux system use tcpreplay to send 25 pcap files @ 100Mbps to both the ...
0
votes
1answer
27 views

find url of radio stream

I'm trying to find the actual stream URL of an radio stream, specifically this one. There are a bunch of questions for this, but none of them have helped at all. Some have said that I can use ...
0
votes
0answers
16 views

Bluetooth Capture Interface missing on Wireshark / Kali Linux 1.1.0a

I'm trying to capture local bluetooth traffic from my device running Kali Linux 1.0.0a with wireshark. However, the bluetooth capture interface is not shown. According to the documenation it should be ...
0
votes
0answers
12 views

Identifying SSH sub flows in tshark

I am currently considering the implementation of a research paper for which i need to identify the transport, connection and authentication protocols in SSH. I went through the RFC and have concluded ...
0
votes
1answer
20 views

Unable to start npf driver

I need to start the npf driver for Wireshark but when I try to type "net start npf" in cmd prompt, I get the following error: "System error 1058 has occurred. The service cannot be started, either ...
1
vote
0answers
22 views

How to use wireshark to decode SSL stream from remote API server?

I'm trying to troubleshoot some issues with what my code is sending to a remote API (over https). I've seen a ton of articles on Wireshark and decoding SSL, but they all make up their own test server ...
2
votes
5answers
100 views

Can I collect wireless packets using Wireshark while being connected to the Internet via cable?

I am working on a PC which is connected to my router using a LAN cable, and the other computers in my house are connected to my router using WiFi. We are all connected to the same network, so I ...
0
votes
0answers
18 views

Wireshark 1.99 monitor mode?

Relatively new to Wireshark, running 1.99.7 on a MacBook Pro (2015), OS X Yosemite 10.10.3. I have no problem with basic capture via wifi, but have been unable to figure out how to turn on monitor ...
0
votes
0answers
22 views

Tshark vs. Wireshark - performance

I have a 10Gig NIC that I want to sniff. Shall I expect a better performance when using Tshark in place of Wireshark? I wonder if there is no expected boost, since I didn't find any benchmarks.
0
votes
0answers
23 views

how to parse a pcap file for specific words

I got a 90GB pcap file that I am trying to calculate the tcp retransmission rate for. As the file is very large I was thinking just parse it locally on the redhat server that it is sitting on. FTPing ...
1
vote
0answers
36 views

TCPDUMP Network IPv6 Packets

I am new to tcpdump tool and I am working in the analysis of network packets, I have analysed the IPv4 Ip packtes generated in case of wifi. But Now I am running my android phone in sim's 3g network ...
0
votes
0answers
16 views

I cannot capture DHCPv6 packets on GNS3 using Wireshark

I have got a router set up as a DHCPv6 server connected to a host that gets an IPv4 & IPv6 addresses from it, however I am not able to capture any DHCPv6 packets at any point of the connection. ...
0
votes
0answers
34 views

Connection interruptions on Debian router, possibly due to excessive duplicate ACKs?

I have a Debian server as a house router, which for a year has been working flawlessly. However, I recently moved and switched service providers from FiOS to Comcast, and possibly as a result am ...
0
votes
0answers
11 views

Tshark interface to sniff on

I have a MQTT broker and a MQTT client both running on the same machine. The client sends publish packets to the broker. The broker processes it and sends it back to the same client as publish packet. ...
0
votes
1answer
22 views

iperf and Wireshark show different data rate

I was testing the capture performance of a sniffer application in Linux. I have a Windows machine that sends UDP multicast packets to the capture port of the sniffer system using iperf at 8Mbits/s. I ...
0
votes
0answers
19 views

Using I/O graph how to interept bytes/tick against packet details information?

I'm working on a trace-file which has reported ISP throttling occurrences in it. My task is to use IO graph to understand at what point in time the throttling process effected client upload ...
0
votes
1answer
36 views

Get entire packets size in Wireshark

Is there a way to show the size of all of the packets received in Wireshark? For example, if I have 10 packets received and the size of each packet is 1 KB, then Wireshark would display: 10 KB.
1
vote
2answers
76 views

What causes dropping of ARP response packets in a wireless network?

I have a network of wireless access points (APs) in my local area network (LAN). Some PCs in the network can get ping responses from some other PCs/devices in the network but not some others. I have ...
0
votes
0answers
28 views

Monitor TCP port traffic and get a sound alert when a specific text string is found on Windows

I need to watch a port for several hours and make an audible alert whenever a specific string comes through. Windows only. Is this possible with Wireshark or another sniffer tool or maybe a sniffer ...
0
votes
0answers
24 views

router automatically disables wifi and enables after 2-3min

Router: Netgear DGN2200v2 Problem: THe router disables the wifi network automatically(with no human interference what so ever), thus all pc's disconnect and have no network access(as if the router ...
0
votes
1answer
96 views

Possible network loop with WiFi and Ethernet when docked

I have been seeing a weird problem that I can't reproduce on demand and have a suspicion on the root cause. The Issue: Intermittently the entire network goes down until I walk around and unplug ...
1
vote
1answer
188 views

tcpdump not displaying RSSI

I am monitoring Wi-Fi probe requests via tcpdump on Debian and am trying to capture the RSSI (signal strength) of each probe request element. Currently, the output from tcpdump for each probe request ...
0
votes
0answers
34 views

How to get Alfa awus036nha to work with Ubuntu 14.04?

I installed Ubuntu 14.04 in a dual boot configuration with OS X Yosemite. I then installed Wireshark on Ubuntu and I'm going to use an Alfa AWUS036NHA (Atheros chipset) adapter. The problem is that ...
0
votes
1answer
44 views

wireshark save capture directly to file with filter

I am looking to have a long-term packet capture running to monitor DNS requests on my machine. I generally use wireshark for network monitoring, but since I am only interested in DNS packets, and over ...
0
votes
2answers
56 views

How to run sniffing demonstration using virtualbox and wireshark

I am going to have a demonstration of packet sniffing using wireshark. Therefore, I decided to create two vitual machines in virtualbox (with "host-only adapter" network config) and monitor the ...
1
vote
0answers
46 views

TCP packet issue with 802.11ac but not with 802.11n on an Android Nexus 6

I have an Android Nexus 6 that connects to my computer via an ad-hoc network. When my phone connects to the 802.11n card (TP-LINK 300Mbps Wireless N), the bytes are sent with no issue; verified with ...
0
votes
1answer
156 views

Why filtering on udp port in TCPDUMP gives only fragmented IP frames

I've a device capturing traffic with Tcpdump filtering on "upd dst port" then it creates a pcap file to be read in wireshark. what I obtain from running: tcpdump udp dst port 5201 -qUns 0 -i wlan0 ...
0
votes
1answer
60 views

Wireshark loopback on mac os x [closed]

I have selected loopback (in capture options) to capture http traffic on my localhost server, but everytime I do and HTTP I only can see TCP.
0
votes
0answers
27 views

How to capture VirtualBox VM packets

I am currently running a series of three Ubuntu 14.04 VMs on my Windows 7 x64 host. The guests are all configured thusly: Host-Only Adapter Intel Pro/1000 MT Desktop Promiscuous Mode: Allow VMs Cable ...
4
votes
0answers
84 views

why am I not seeing traffic using TCPDUMP while sniffing on wireless interface with the station in WDS mode

I've 2 wireless interfaces one has the type of AP and the other has the type monitor. the AP is attached to a bridge br-lan. When I run for example: tcpdump port 5201 -s 0 -ni wlan0 TCPdump is ...
0
votes
0answers
39 views

Https request call capture in Wireshark

I have installed Wireshark and Windows based application(to be analyzed) which uses https request authentication to validate user.When I use interfaces -- > capture all the request of my system is ...
0
votes
1answer
103 views

Graphical representation of iperf3 results

I'm using Iperf3 on 2 machines and actually I'm running 2 instances of Iperf3, one to generate traffic with high priority and the other generates traffic with low priority. I would like to generate a ...
1
vote
0answers
61 views

Viewing Xbox One Network Traffic

I am trying to view the HTTP/HTTPS traffic going from my XBOX one so I can see what is being requested. I started off trying to use Charles proxy like this https://www.youtube.com/watch?v=MP4ZcwSHxbw. ...
1
vote
0answers
24 views

Long SMB session setup delay

I have a Windows machine connecting to an SMB share on a local Debian server. Everything works flawlessly, when it's connected, but the first connection (either after a boot / reboot, or after ...
0
votes
0answers
90 views

WireShark - Vmware Network Interfaces

I've recently installed wireshark v1.12.4 on my Windows 8 Machine, and I am totally new to the program. I have a virtual machine running on vmware (Red Hat Linux 7.2) and got all the network ...
0
votes
0answers
148 views

Wireshark fails to install on OS X 10.10.3 using brew

I've encountered the following issue while installing wireshark via brew. ➜ ~ brew reinstall wireshark --with-qt5 ==> Reinstalling wireshark with --with-qt5 ==> Downloading ...
0
votes
0answers
34 views

Decrypt SSL Data in wireshark

In all the tutorials which I saw in web, they pointed me to add key file in Edit->Prefereces->Protocols->SSL->SSL key file but there is no such SSL key file in version I use. Can somebody guide how ...
0
votes
0answers
38 views

Reading packets with Wireshark

How do I read packets captured with Wireshark. I was finally able to capture incoming and outgoing data in hopes of developing something along the lines of an IDS. Thanks in advance for the help. A ...
0
votes
2answers
89 views

Duplicate IP address Telnet and ARP

I have 3 hosts (PC1, PC2, and PC3). I set the IP addresses for PC2 and PC3 to be 10.0.0.2 and PC3 to be 10.0.0.1. I telnet from PC1 to 10.0.0.2. I then am logged in to PC3. I can see in Wireshark that ...
0
votes
0answers
31 views

tcptrace from wireshark capture

How can I use tcptrace to generate tcptrace graph from captures on wireshark ? I already know how to generate the tcptrace on wireshark itself, but I want to generate the graph outside wireshark ...
0
votes
1answer
27 views

How to find 802.11 protocol variant, and decipher packet_payload_info in PcapNG files?

I'm building a (Python) parser of PcapNG files created by Wireshark. After reading https://www.winpcap.org/ntar/draft/PCAP-DumpFileFormat.html, I'm having the following problems: I'd like to ...
0
votes
1answer
22 views

Does connecting to one's computer via local router automatically uses the loopback?

I have a TCP application that doesn't show up on Wireshark. I read it was because Wireshark is not able to sniff Loopback communication on Windows. So, instead of connecting to 127.0.0.1, I connected ...
0
votes
0answers
22 views

Wireshark capture file: getting “missing packet” now, was not there 1 year ago

I captured data on a LAN. I then opened the pcap file with wireshark and could extract an email which was sent unencrypted on purpose. Means, I selected a package from the email and used "follow TCP ...
2
votes
1answer
51 views

Why does a radio stream not appear on a packet monitoring tool?

I am currently trying to find the URL to the audio stream for a webradio that only provides a flash player, that I would like to use with MusicBee's radio player. After using Wireshark to monitor my ...
0
votes
1answer
70 views

How is the FID generated for a SMB “Create AndX Request?”

I see in the traces while accessing a network share, there are multiple CreateAndX requests (which opens the folders) with an FID associated with them. However, some of them don’t and they get a ...
0
votes
0answers
27 views

VirtualBox Network confusion?

I'm trying to adjust my VirtualBox guest network in order for my guest O/S traffic look like its coming from my Host. Can I do this with NAT? Here's a simpler outlook on what I am trying to achieve ...
1
vote
2answers
255 views

Wireshark only captures packets to or from this device

I use wireshark on ubuntu 14.04 and I am trying to sniff wifi traffic of other devices in my network. I run wireshark or tshark on wlan0, start capturing packets and send some pings or open some pages ...
-1
votes
1answer
39 views

Wireshark - Browser software

I just touched wireshark yesterday from my class. I was told to run wireshark while browsing www.kompas.com, and there is this question that is quite ambiguous. "What browser software shown in ...