Open-source network packet analyzer

learn more… | top users | synonyms

0
votes
0answers
23 views

Unable to intercept data intended for gateway by using ARP

I am having trouble with what seems to be a very simple problem. I manage to be able to successfully spoof the ARP table of one computer on my network (as reported by arp -a). But even enabling a ...
0
votes
0answers
29 views

RST, ACK from 216.98.48.133 without any SYN from me? For real? How? Why?

I am trying to figure out why I always get "The Ubisoft server is not available at the time. Please try again later." Apparently, the server is actually up and running, so it seems the problem is on ...
-1
votes
1answer
30 views

How to sniff download information of different pc's on a network(router)

I am making a Log Analyzer for downloads on a network by different users. So I want to know who downloaded what in the same network (WLAN). How can I sniff this information from other users of the ...
1
vote
2answers
38 views

Simple http traffic monitor (capture by process) [closed]

I know, questions like this have been asked a lot before. I have a big problem using Wireshark because of the following reasons: It is not able to trace down which process sent/received a packet ...
0
votes
0answers
63 views

Wireshark Capture Filter

I am new to wireshark and I am trying to capture an ICMP packet over 802.11g, I am using windows and pingplotter. The issue is that on wireshark capture I am not getting any ICMP packets no matter how ...
0
votes
1answer
18 views

Intercept HTTPS traffic of a IP energy consumption monitor device

I have this device connected to my home network, and I'm curious about what it's sending to the Internet. It seems to generate a lot of traffic. I've connected it to my laptop and I've shared the ...
0
votes
2answers
74 views

Wireshark filtering for one network

How do i make Wireshark filter results so it just shows results from one wifi net work. I have had a look on Google but found nothing. Can any one help.
1
vote
1answer
26 views

Bandwidth monitoring grouped by domain/process

Under Windows platform, what is the simplest way to achieve bandwidth monitoring with the following grouping use cases: monitor all incoming/outgoing bandwidth grouped by domain/ip (http requests ...
0
votes
1answer
27 views

Wireshark merging pcap files

I'm trying to merge 15 pcap files using wireshark. The merging is successful. I'm using the appending function so that the second file is just added to the bottom of the first file. But when this is ...
0
votes
1answer
27 views

How does a packet of RDP mouse/keyboard click look?

I just cant find it on wireshark when sniffing the RDP connection.. Can anyone show me how they look and how can I distinguish between them? Of course it would be encrypted but the main question is ...
0
votes
1answer
44 views

Store handshake to use later

I successfully captured my client's 4WHS with airodump-ng and Wireshark is decrypting everthing corectly. I decided to store the 4WHS in a cap file, the idea is that when I do a new capture I don't ...
0
votes
1answer
54 views

How I can start to capture packets and saving it by command line using Wireshark

Could you tell me how I can start to capture packets with specific interface by command line and saving it by command line using Wireshark? I would like to save it on my Desktop. OS X 10.9.2 ...
0
votes
1answer
23 views

Get external email from action “mailto”-form

Is it possible to pick out the email adress that a "mailto"-form will send an external email to? example from this (swedish "ebay" - ad) ...
1
vote
1answer
64 views

Eavesdropping on a WPA2 (PSK) network

I’m trying to capture frames sent and / or received by other clients on my wireless (WPA2-PSK) network. I installed Wireshark, activated the promiscuous mode and set the decryption key, but I’m unable ...
0
votes
2answers
46 views

Wireshark, Find Protocol Layers

I'm using Wireshark to analyze network traffic. I'm a bit confused by what's displayed under the "Protocol" column. If I'm not mistaken, DNS and HTTP are Application layer protocols while TCP is ...
1
vote
1answer
30 views

Looking for a tool to inspect HTTP data between a mobile phone and AV receiver

I am trying to dissect the protocol used by my AV receiver and its mobile app on my phone. Basically, I'd like to see all the GET/POST requests from the app on the phone and the responses from the ...
0
votes
0answers
31 views

How to enable LUA in wireshark?

This question is for Linux Centos Platform. I am doing a project in which Wireshark Traffic is to to be exported to a .pcap file and later used for further analysis. This Export is to be automatic ...
0
votes
1answer
40 views

Wireshark with lua

I have installed wireshark on my Centos Machine. I want an auto script for it and i am planning to script it using LUA. However, my wireshark is without LUA. How to enable wireshark which allows LUA ...
0
votes
1answer
74 views

Mismatch between libpcap configured snap length and actual capture length

I have a couple of pcap files where the capture length reported by Wireshark is larger than the actual capture length. The difference is 10 bytes, and I don't understand why it reports this higher ...
1
vote
1answer
41 views

Combining two linux commands

Im trying to use mergecap to merge 15 old pcap files in a folder. I tried to use FILES=($(find /mnt/md0/capture/DCN/ -maxdepth 1 -type f -name "*.pcap" -print0 | xargs -0 ls -lt | tail -15 | awk ...
1
vote
0answers
38 views

mergecap fails to create output file when run from crontab

I have created a script to merge pcap files using 'mergecap -w '. The script doesn't work as the output file is not already present. So I tried to use 'touch outputfile.pcap' before the mergecap ...
1
vote
2answers
353 views

SSL (imap) doesn't work from some machines - ssl handshake failure - how to narrow down further?

A few days ago our IMAP SSL (port 993) connections stopped working from our home network two Windows 7 PCs in our home network. Two other PCs, one with Windows XP, one also with Win7 professional ...
0
votes
0answers
24 views

Configure Fiddler to capture from bridged network or specific network adapter [duplicate]

Is it possible to configure Fiddler to capture from a bridged network or specific network adapter? I have a TV plugged into my PC network card. Wireshark sees all packets to and from the TV but ...
0
votes
0answers
87 views

Using Fiddler to capture traffic from smart tv

I've set up Fiddler to capture HTTPS CONNECTs and decrypt HTTPS traffic using a certificate. Also enabled "Allow remote computers to connect" and set up the proxy on both Fiddler and my tv. It ...
1
vote
0answers
20 views

Utility service that logs total network usage

I would like to know the total bandwidth our internet provider essentially provides to the many competing devices in our home. Is there a simple windows service that uses a wireshark like trick to log ...
2
votes
1answer
42 views

Simple way of demonstrating that a VPN is working, that is easy for novices to understand/comprehend?

I am developing a Linux-based security appliance. One of its functions is to cloak a user's traffic within a VPN, and I need a simple way of demonstrating that this function is working properly, and ...
0
votes
0answers
42 views

How to send packet on tor network to get back to my computer?

Can anyone tell me how to configure system (I think linux is the best option for this) to be able to send packet by tor network back to my own computer? I have to conduct researches how it behaves (i ...
2
votes
1answer
62 views

how to see all network requests made by an application [duplicate]

Suppose i have an application running abc.exe, how to see all the network requests made by this application? Wireshark is good to see all the requests from the pc, but is there any filter for requests ...
1
vote
1answer
372 views

Using Wireshark to decrypt tls encrypted file with private key

I have a packet encrypted with TLS in a .pcap file. I also have the private key in a .priv file. How can I decrypt the .pcap file using Wireshark? I tried going to edit -> preferences -> protocols -> ...
0
votes
0answers
73 views

wireshark: decrypt live SSL traffic

w.r.t decryting SSL traffic with wireshark, I've seen the sample capture from wireshark website and it worked fine. What I'd like to achieve is to decode live traffic. So the key I guess is to ...
1
vote
0answers
77 views

What are “Difference” and “Delta” in Wireshark RTP Analysis?

I tried to find this in the documentation, but had no luck. I would love to dig the sources to find out, but I honestly don't have the time. I tried to google this, but either people do not get any ...
1
vote
1answer
101 views

wireshark cannot capture VM traffic

Here is my setup: A windows 7 laptop running as a host running VirtualBox Inside Virtualbox, I have a debian VM. The eth0 of the VM is created as a bridged device from the physical ethernet port on ...
0
votes
0answers
45 views

Passing through TOS/DSCP through two layers of OpenVPN, possible?

About a week ago I posted about a problem I am having getting usable VoIP connections working on a machine configured using mirimir's dual-VPN isolation system. (For details on the setup see my ...
0
votes
1answer
40 views

Capturing more WLAN frames than sending/receiving Ethernet frames

I'm trying to determine whether a computer capturing WLAN frames on an 802.11n network does this correctly. I do this by letting one computer (1) generate traffic by downloading some files, and ...
0
votes
1answer
190 views

How do I find my e-mail password hash in Wireshark?

I use wireshark and I wanted (within education) get the password to my email. I found the line [truncated] Cookie: ... There is my login, but I do not know where the "hash" responsible for my ...
4
votes
1answer
1k views

How to block the Whatsapp Android application in a network

I need to block the users from accessing Whatsapp Android application who have logged in to my network. I tried to take Wireshark logs and tried to find the server's IP Address and port number, but I ...
3
votes
1answer
44 views

ICMP Fails after first packet

I'm trying to ping any ip, other than my LAN IP & localhost, it fails except the first packet!! Snapshot from CMD with the pings But Wireshark capture shows that the ICMP is success!! ...
1
vote
1answer
68 views

Wireshark TLS communication shows green HTTP packets when using CCProxy proxy server?

Client <--> CCProxy <--> Server I have IE configured to use a proxy server for HTTP and Secure connections. I also have a proxy server is set up with CCProxy. It is my understanding that ...
3
votes
1answer
148 views

SYN-ACK not received

On a standard TCP connection between server and client, I have this issue: the SYN-ACK is not received from the client, while it is sent from the server. I could see this on Wireshark from both server ...
0
votes
1answer
56 views

Wireshark : Why is a TTL value of the DNS response not 128?

Im just looking for help with a question on Wireshark. If the TTL value of a DNS query is always 128 why is the response TTL not 128? Will the DNS Query TTL always be 128 by default and the response ...
0
votes
0answers
36 views

How to run Wireshark on desktop computer with tablet display manager (Ubuntu 12.04, x64)?

I'm running Ubuntu 12.04 (x64). I installed Wireshark with apt-get. When I go to Ubuntu Button -> Search "Wireshark" -> Wireshark, the wireshark program launches. Unfortunately there's no interfaces ...
0
votes
1answer
34 views

How to know at what point a request fails on Windows 8

I'm testing a small script on Windows 8, which tries to fetch a simple web page on port 80. However the network connection fails everytime with error 10053. I thought initially of a firewall problem ...
0
votes
1answer
71 views

How do I configure Wireshark to see only the problems?

I know a bit about networks but I have so far failed to define a filter which removes all "good" traffic from the display (i.e. all packets that were replied, all data transfers which were completed ...
1
vote
2answers
91 views

How to view other lan users packets via wireshark

It seems that I can only view my own packets, how to view other lan users packets via wireshark?
0
votes
0answers
155 views

dnsmasq doesn't provide IP address to udhcpc

We have an embedded Linux device using udhcpc to get a DHCP IP address and a Wifi access point that provides it. Originally the WAP used udhcpc as well and this worked fine, but in order to add DNS ...
0
votes
0answers
42 views

How can cfosspeed udp broadcast or multicast?

I tried to figure how cfosspeed uses broadcast and multicast. I use wireshark with a couple of rules like udp.dstport == 889 and (eth.dst[0]&1) to no avail. In the incomming packets I don't see ...
1
vote
1answer
73 views

Wireshark on OS X: I can configure my Airport channel, but how about bandwidth?

This is what I currently do to capture 802.11 packets with Wireshark on my Macbook Pro From my AP, I set the channel to 40 and channel bandwidth to 20MHz. From Terminal, I set the Airport channel ...
2
votes
2answers
175 views

What's the difference between wlan.sa, wlan.ra, wlan.ta and wlan.da?

Tshark/wireshark (CLI) has several fields to display for WLAN, including these four (+ description from manual): wlan.sa: Source address wlan.ra: Receiver address wlan.ta: Transmitter address ...
0
votes
1answer
173 views

Which Wireshark settings to see connections from phone

I am trying to find out which URLs my phone is accessing when on a local WIFI network. My trials so far have been running an Ad-hoc network on my Laptop and sharing Internet through it (this works). ...
0
votes
1answer
168 views

What is the RSA SecurID packet format?

I am testing a client application that authenticates using RSA SecurID hardware tokens. The authentication is failing and I am not finding any useful information in the log files. I am using ...