The network protocol analyzer developed and maintained by the Wireshark Foundation

learn more… | top users | synonyms

0
votes
1answer
40 views

Snort wont trigger alert from tap interface eth0

I have snort set up on a raspberry pi running a modified Ubuntu. Between my modem and router I have a switch that mirrors all the traffic to a port that is connected to the eth0 interface on my ...
0
votes
1answer
39 views

Routing between two NICs same PC

I have two NICs, 192.168.56.0/24 and my wifi NIC 192.168.1.0/24. Can I route between these two NICs to be able to ping from my Physical HOST to any host on 192.168.56.0/24 while using VMs? I know ...
0
votes
2answers
59 views

How to see DHCP boot setup in wireshark?

My client tries to boot wrong file with DHCP and I'd like to debug it. My previous configuration was to boot with lpxelinux.0 file but now I changed it to pxelinux.0. But client is still looking for ...
0
votes
2answers
113 views

My DNS server queries root servers?

So, I have a DNS server and a host in a lab environment. When my host queries for the IP of an web-address, like www.[somewedishwebsite].se (Swedish domain), it first queries my DNS server with IPv4 &...
1
vote
3answers
73 views

I can hear it pinging and talking, but it can't hear anything

I got one-way connectivity to some devices and sometimes(randomly) no connectivity, with odd link-status LED lighting. There are 1 PC(mine) and 2 routers('A' and 'B') connected to a switch(unmanaged) ...
0
votes
2answers
282 views

Wireshark to capture all IP devices on a network

I have a Windows PC with hardwired Ethernet and two wireless Linux devices on a LAN. My Wireless router is an Asus RT-AC68U. The Windows PC is running Wireshark. I would like to capture all network ...
1
vote
1answer
89 views

Hide one VM's traffic from another when using Wireshark in Virtual Box

Versions: Host OS: Windows 10 Virtual box: 5.0.10 r104061 VM1: Kali Linux 2.0.0 VM2: Ubuntu 15.04 I have two VMs that I'm practicing penetration testing on. I'm trying to create a man in the ...
0
votes
2answers
156 views

Sniff packets from router

So I have TP-Link router and I want to sniff all the packets going through the router. I'm using Wireshark right now but not able to get the packets which passes through my router. So What I've tried ...
0
votes
1answer
56 views

Cannot see VOIP calls in Wireshark 2.0.0

I received a pcap dump from a site, running Cisco JTAPI, who's VOIP traffic I need to analyse. I use Wireshark's VOIP calls analyser via the menu: The conversations display fine in Wireshark v1.10....
0
votes
3answers
309 views

Relation between TCP conversations and TCP streams in Wireshark

I have read about Conversations and TCP Streams but I'm still a bit unsure how they relate to each other if they are on the same layer. For different layers, it's clear to me that e.g. an IP ...
1
vote
0answers
22 views

Logging individual application network usage in Windows 8.1

I'm writing a review on ACD (Amazon Cloud Drive), and I need to know the following data for the ACD process: Which addresses does it visit, IP and domain; How much data does it send; Bandwidth usage ...
2
votes
0answers
47 views

Tshark. List all traffic between two IP's?

I am learning to use Tshark. I am trying to retrieve a list of all conversations between two IP addresses using Tshark. The two IP's are: 192.168.1.158|64.12.24.50 In Wireshark I am able to see the ...
0
votes
1answer
92 views

What do all the “icons” mean in Wireshark 2.0?

I have recently started using Wireshark 2.0 and it seems the "icons" in the frame number column help me better understand the traffic. However, I'm not sure what some of them mean. Looking at chapter ...
0
votes
1answer
33 views

Capture only UDP traffic that cannot be identified as another protocol

I have applied the udp filter in order to just capture UDP traffic, as described in Wireshark Wiki: Show only the UDP based traffic: udp However, this does not only show UDP traffic. It shows ...
1
vote
0answers
82 views

Decoding HTTP GET parameter in Wireshark

I am capturing HTTP GET traffic with Wireshark and I have plenty of URLs that contain "cryptic" URL-encoded data. I'd like to see the URI split into the individual parameters see the parameter ...
0
votes
2answers
30 views

Wifi packets and adapters

When I connect a wifi adapter to my computer I can see the available wireless networks listed, but when I use Wireshark and set it to listen with that interface/adapter, no packets are captured (when ...
1
vote
2answers
213 views

Listing all devices connected to a simple router remotely

I have two simple routers given to me by my ISP. One is Technicolor TC7200 and the other one is Thomson TWG870UG. I would like to remotely list all of the devices connected to the router (their IP and ...
1
vote
1answer
46 views

Configure Wireshark to capture any packages between host machine, and guest (VM)

I'm new to this whole Wireshark thing. I have a VM running inside my local Mac via VMWare Fusion. VM IP Address : 172.16.139.129 Mac IP Address : 10.0.0.4 I want to capture http connection between ...
0
votes
0answers
21 views

Windows 7 frequent download interruption

I just upgraded to Windows 7 Pro from Home Premium, and now almost all downloads (Youtube videos, online games, ftp/http downloads) are interrupted after a random length of time. Sometimes the ...
1
vote
0answers
156 views

NAS causing Internet Time Outs on other computers

Yesterday I installed a new Synology DS715 NAS server. Since then the internet connection on all other LAN connected PCs encounter disconnects. This is most noticable when playing online games, which ...
0
votes
0answers
57 views

Wireshark isn't showing all interfaces in Windows 7

This is what I've done to check what was going on: Restarted PC Made sure WinPCAP driver (NPF) was installed Stopped and started NPF driver Running as admin But it's only showing one interface, ...
0
votes
0answers
43 views

IKEv2, ESP PFS. Which packets includes the configuration?

i am investigating currently the IKEv2 protocol with ESP payload encryption. For ESP i want to use PFS with DH Group 5 (which works). However, i am not able to figure out in which packet this settings ...
0
votes
1answer
50 views

Is there an ethernet header in IEEE 802.11

I have been capturing some packets over wifi using wireshark for analysis. If I captured IEEE 802.11 frames on an interface in monitor mode. If I capture an IEEE packet on an open network without ...
0
votes
3answers
126 views

I am flying tonight and wonder if I can use wireshark even without paying for inflight wifi

I am flying tonight and am learning about networks. I was wondering if I use wireshark or other packet capturing program, will I see traffic if I am connected to the network but do not pay for it? I ...
0
votes
2answers
58 views

Force a process in Windows 7 to store capture in RAM without doing actual I/O operation and writing to the disk

I'm Using Wireshark's cyclic buffers configuration capturing mode: I am sniffing a 10Gig port, and I was expecting Wireshark to work cyclically with buffers on the DDR only, but apparently it doesn'...
0
votes
3answers
556 views

Converting a Raw g722 File to a .wav with SOX

I am trying to troubleshoot some VOIP issues, and have been capturing the packets for the trouble calls. However my calls are all encoded in g722 and I am having trouble decoding this. I have ...
0
votes
0answers
151 views

TCP connect fails with certain websites

I am running Windows 10. I am unable to browse a few seemingly random websites (CBS.com is one of them) using any of my browsers, although I can successfully ping all of them. Also, other computers ...
1
vote
1answer
190 views

How does Wireshark sniff the packets? [closed]

When I have Wireshark running on, say, 192.168.1.100, how is it able to capture the packets that 192.1.123 sends to the router or to another computer/device in the LAN? My theory is that when a ...
0
votes
0answers
148 views

Clients have problems sending DNS requests

Some of my clients can't use internal DNS server to resolve internal addresses. All IP addresses can be pinged, but I can't ping name or name.domain.com. Restart DNS client service or ipconfig /...
1
vote
1answer
109 views

Port forwarding capture on localhost with WireShark

Is it possible to do a simple, port forwarding type capture on localhost (Windows) with WireShark? I have been using the following Java code to do this: package tapnet; import java.net.*; import ...
0
votes
0answers
46 views

Can't see HTTP in Wireshark on OSX

Every Youtube video that even explains how to install Wireshark sees HTTP traffic. Why can't I see it? Fresh Wireshark install, I am capturing WiFi traffic and I made some HTTP requests. TCP, UDP, ...
0
votes
0answers
38 views

Wireshark in Linux not receiving packets, and Linux is in a VirtualBox

I am using Kali Linux, but on a VirtualBox. So when I'm using Wireshark, I can't capture any packets. I can't use the wireless card directly so I'm using eth0 through the Mac OS. is there any way to ...
1
vote
0answers
18 views

TCP Rentransmission when connecting sepcific website

Question: I'm an administrator of couple of websites. Every website is set on the same server provided by linuxpl.com. The server ip is: 95.211.176.132. The problem is, when I try to reach the server ...
2
votes
1answer
1k views

Capturing traffic by HTTP host name, not by IP, via WireShark

I'm trying to filter traffic only to a given HTTP host name. I have a server, and I have dozens of websites on it. It only has one interface and one IP address. Thus filtering to my IP address is not ...
0
votes
1answer
41 views

Resolution to a very slow network

For some reason I have a very slow network (~10kbps over a 100mbps network). It only happens in office hours which leads me to believe that someone is bottlenecking the network. I need to find out who ...
1
vote
0answers
109 views

Running into problems while spoofing IP Address

I have a machine (IP:192.168.1.185) and i want to send spoofed IP address (e.g. 192.168.1.212) to another machine(192.168.1.213) . I am using a spoofing program for this which uses raw sockets. Now ...
1
vote
0answers
250 views

monitor and log LAN network traffic on CentOS 6.x

I've been fiddling with this one for almost a week now. My setup is: LAN (windows/linux PCs/servers) <-> CentOS gateway/firewall box <-> ISP I'm trying to setup a monitoring solution which ...
1
vote
0answers
140 views

What causes these corrupted downloads and spurious retransmissions?

I encountered many corrupted downloads recently. Sometimes compressed files wouldn’t open or checksums would not match. Sometimes images on Websites would just be grey (or a wild mix of colour) after ...
1
vote
0answers
110 views

Wireshark does not show my USB dongle as capture interface

I am using wireshark 1.12.6 on windows 8.1. I cannot set my USB dongle as the capture interface (in linux it shows the dongle also as the capture interface. How can I do this in Windows?
-2
votes
1answer
76 views

tcptrace from wireshark 802.11 capture

I have the same question Lukas asked on April 1... How can I use tcptrace to generate tcptrace graph from captures on Wireshark? Guy responded by asking if just feeding the Wireshark output to ...
0
votes
1answer
33 views

Is it possible to sniff packets from a client connected router via Wi-Fi while I am connected through Ethernet?

How to sniff packets (using wireshark) from the other client connected to the same router (Linksys) but through Ethernet cable while I’m connected to that router via Wi-Fi. Is it possible?
0
votes
1answer
133 views

Use SSH to pipe tcpdump into wireshark with “command” in authorized_keys

we want to enable real-time network tracing for Application Testing. We want to grant as little permissions/rights on the remote host that will run tcpdump. So i tried to setup an authorized key ...
0
votes
1answer
165 views

Strange MAC address on Wireshark screen

I trying to see Wi-Fi (802.11) packets through Wireshark. Here's information of my wireless interface: $ ifconfig wlan1 Link encap:Ethernet HWaddr c0:f8:da:21:ce:68 # and so on blahblah ...
0
votes
1answer
309 views

Computer is sending / receiving data form a computer and I don't know why

So I have been playing with WireShark and I have found something weird. After closing every application that uses the internet (As far as I know) I have found that my computer is sending / receiving ...
1
vote
2answers
3k views

Monitor Mode doesn't work in Kali 2.0

For the last year or so I have been using this exact setup with Kali 1.0. Everything worked fine with Wireshark. Now, when I am connected to a Wi-Fi access point my card REFUSES to stay in monitor ...
1
vote
1answer
34 views

Promiscuous mode not working with ubuntu and wireshark

I am running Ubuntu Linux and have installed wireshark on it. I can see the incoming and outgoing traffic just fine. Now I want to see the traffic from other devices which are on my LAN. So, I did: ...
0
votes
3answers
96 views

Can WireShark be used to collect packets on same network?

I am trying to sniff packets using Wireshark. But Wireshark collects packets of computers connected to my Router only. If i know the IP address of a Computer , can i sniff the packets of that Computer ...
0
votes
0answers
57 views

Confusion in Iperf server report?

I am connecting one of my computers to LAN which is connected to 802.11n Access Point using ethernet cable while my other computer is connected to wifi. When I send 20Mbps traffic from iperf while ...
0
votes
0answers
74 views

How can I use Microsoft Network Monitor to view messages sent via socket client/server

I would like to view the exact messages sent/received in Microsoft network monitor, but I do not know how. I have build a program to send messages via TCP socket and If a message "ready" is sent over ...
1
vote
1answer
108 views

How to resolve DNS from java like WIRESHARK does?

Could you explain how Wireshark makes a DNS query in order to resolve the name of an IP address? My issue is about the mismatch between the domain name resolved by Wireshark and that returned by ...