Open-source network packet analyzer

learn more… | top users | synonyms

0
votes
1answer
118 views

Mismatch between libpcap configured snap length and actual capture length

I have a couple of pcap files where the capture length reported by Wireshark is larger than the actual capture length. The difference is 10 bytes, and I don't understand why it reports this higher ...
1
vote
1answer
53 views

Combining two linux commands

Im trying to use mergecap to merge 15 old pcap files in a folder. I tried to use FILES=($(find /mnt/md0/capture/DCN/ -maxdepth 1 -type f -name "*.pcap" -print0 | xargs -0 ls -lt | tail -15 | awk ...
1
vote
0answers
71 views

mergecap fails to create output file when run from crontab

I have created a script to merge pcap files using 'mergecap -w '. The script doesn't work as the output file is not already present. So I tried to use 'touch outputfile.pcap' before the mergecap ...
1
vote
3answers
1k views

SSL (imap) doesn't work from some machines - ssl handshake failure - how to narrow down further?

A few days ago our IMAP SSL (port 993) connections stopped working from our home network two Windows 7 PCs in our home network. Two other PCs, one with Windows XP, one also with Win7 professional ...
0
votes
0answers
24 views

Configure Fiddler to capture from bridged network or specific network adapter [duplicate]

Is it possible to configure Fiddler to capture from a bridged network or specific network adapter? I have a TV plugged into my PC network card. Wireshark sees all packets to and from the TV but ...
0
votes
0answers
184 views

Using Fiddler to capture traffic from smart tv

I've set up Fiddler to capture HTTPS CONNECTs and decrypt HTTPS traffic using a certificate. I also enabled "Allow remote computers to connect" and set up the proxy on both Fiddler and my tv. It ...
1
vote
0answers
20 views

Utility service that logs total network usage

I would like to know the total bandwidth our internet provider essentially provides to the many competing devices in our home. Is there a simple windows service that uses a wireshark like trick to log ...
2
votes
1answer
55 views

Simple way of demonstrating that a VPN is working, that is easy for novices to understand/comprehend?

I am developing a Linux-based security appliance. One of its functions is to cloak a user's traffic within a VPN, and I need a simple way of demonstrating that this function is working properly, and ...
0
votes
0answers
65 views

How to send packet on tor network to get back to my computer?

Can anyone tell me how to configure system (I think Linux is the best option for this) to be able to send packet by Tor Network back to my own computer? I have to conduct research on how it behaves (I ...
2
votes
1answer
81 views

how to see all network requests made by an application [duplicate]

Suppose i have an application running abc.exe, how to see all the network requests made by this application? Wireshark is good to see all the requests from the pc, but is there any filter for requests ...
1
vote
1answer
1k views

Using Wireshark to decrypt tls encrypted file with private key

I have a packet encrypted with TLS in a .pcap file. I also have the private key in a .priv file. How can I decrypt the .pcap file using Wireshark? I tried going to edit -> preferences -> protocols -> ...
0
votes
0answers
137 views

wireshark: decrypt live SSL traffic

w.r.t decryting SSL traffic with wireshark, I've seen the sample capture from wireshark website and it worked fine. What I'd like to achieve is to decode live traffic. So the key I guess is to ...
1
vote
1answer
176 views

What are “Difference” and “Delta” in Wireshark RTP Analysis?

I tried to find this in the documentation, but had no luck. I would love to dig the sources to find out, but I honestly don't have the time. I tried to google this, but either people do not get any ...
1
vote
1answer
416 views

wireshark cannot capture VM traffic

Here is my setup: A windows 7 laptop running as a host running VirtualBox Inside Virtualbox, I have a debian VM. The eth0 of the VM is created as a bridged device from the physical ethernet port on ...
0
votes
0answers
111 views

Passing through TOS/DSCP through two layers of OpenVPN, possible?

About a week ago I posted about a problem I am having getting usable VoIP connections working on a machine configured using mirimir's dual-VPN isolation system. (For details on the setup see my ...
0
votes
1answer
70 views

Capturing more WLAN frames than sending/receiving Ethernet frames

I'm trying to determine whether a computer capturing WLAN frames on an 802.11n network does this correctly. I do this by letting one computer (1) generate traffic by downloading some files, and ...
0
votes
1answer
407 views

How do I find my e-mail password hash in Wireshark?

I use wireshark and I wanted (within education) get the password to my email. I found the line [truncated] Cookie: ... There is my login, but I do not know where the "hash" responsible for my ...
4
votes
1answer
5k views

How to block the Whatsapp Android application in a network

I need to block the users from accessing Whatsapp Android application who have logged in to my network. I tried to take Wireshark logs and tried to find the server's IP Address and port number, but I ...
3
votes
1answer
55 views

ICMP Fails after first packet

I'm trying to ping any ip, other than my LAN IP & localhost, it fails except the first packet!! Snapshot from CMD with the pings But Wireshark capture shows that the ICMP is success!! ...
1
vote
1answer
121 views

Wireshark TLS communication shows green HTTP packets when using CCProxy proxy server?

Client <--> CCProxy <--> Server I have IE configured to use a proxy server for HTTP and Secure connections. I also have a proxy server is set up with CCProxy. It is my understanding that ...
3
votes
1answer
407 views

SYN-ACK not received

On a standard TCP connection between server and client, I have this issue: the SYN-ACK is not received from the client, while it is sent from the server. I could see this on Wireshark from both server ...
0
votes
1answer
119 views

Wireshark : Why is a TTL value of the DNS response not 128?

Im just looking for help with a question on Wireshark. If the TTL value of a DNS query is always 128 why is the response TTL not 128? Will the DNS Query TTL always be 128 by default and the response ...
0
votes
0answers
49 views

How to run Wireshark on desktop computer with tablet display manager (Ubuntu 12.04, x64)?

I'm running Ubuntu 12.04 (x64). I installed Wireshark with apt-get. When I go to Ubuntu Button -> Search "Wireshark" -> Wireshark, the wireshark program launches. Unfortunately there's no interfaces ...
0
votes
1answer
51 views

How to know at what point a request fails on Windows 8

I'm testing a small script on Windows 8, which tries to fetch a simple web page on port 80. However the network connection fails everytime with error 10053. I thought initially of a firewall problem ...
0
votes
1answer
121 views

How do I configure Wireshark to see only the problems?

I know a bit about networks but I have so far failed to define a filter which removes all "good" traffic from the display (i.e. all packets that were replied, all data transfers which were completed ...
1
vote
2answers
135 views

How to view other lan users packets via wireshark

It seems that I can only view my own packets, how to view other lan users packets via wireshark?
0
votes
0answers
191 views

dnsmasq doesn't provide IP address to udhcpc

We have an embedded Linux device using udhcpc to get a DHCP IP address and a Wifi access point that provides it. Originally the WAP used udhcpc as well and this worked fine, but in order to add DNS ...
0
votes
0answers
77 views

How can cfosspeed udp broadcast or multicast?

I tried to figure how cfosspeed uses broadcast and multicast. I use wireshark with a couple of rules like udp.dstport == 889 and (eth.dst[0]&1) to no avail. In the incomming packets I don't see ...
1
vote
1answer
169 views

Wireshark on OS X: I can configure my Airport channel, but how about bandwidth?

This is what I currently do to capture 802.11 packets with Wireshark on my Macbook Pro From my AP, I set the channel to 40 and channel bandwidth to 20MHz. From Terminal, I set the Airport channel ...
2
votes
2answers
375 views

What's the difference between wlan.sa, wlan.ra, wlan.ta and wlan.da?

Tshark/wireshark (CLI) has several fields to display for WLAN, including these four (+ description from manual): wlan.sa: Source address wlan.ra: Receiver address wlan.ta: Transmitter address ...
0
votes
1answer
455 views

Which Wireshark settings to see connections from phone

I am trying to find out which URLs my phone is accessing when on a local WIFI network. My trials so far have been running an Ad-hoc network on my Laptop and sharing Internet through it (this works). ...
0
votes
1answer
203 views

What is the RSA SecurID packet format?

I am testing a client application that authenticates using RSA SecurID hardware tokens. The authentication is failing and I am not finding any useful information in the log files. I am using ...
0
votes
0answers
145 views

understanding MCS (Modulation and coding scheme) in 802.11n

The 802.11n has the htcapabilities which contains the MCS (Modulation and coding scheme). This MCS is used to calculate the MAX bite rate of hardware depending on channels and garde interval. Does ...
0
votes
0answers
14 views

Monitoring traffice from an internet enabled printer [duplicate]

I have a WiFi internet enabled printer that can grab content from the web. I want to use something like Fiddler or Wireshark to view the traffic it's sending and receiving. Is possible? How would I go ...
7
votes
3answers
13k views

X11/XQuartz won't auto-launch after upgrading to OS X Mavericks?

I can't use Wireshark on latest OS X 10.9 Mavericks. Previously, I was using XQuartz to run X11 applications like Wireshark. But, yesterday, after I upgraded my iMac operating system to OS X 10.9, ...
0
votes
1answer
237 views

Firewall and Blocking [More] Traffic

I have a MacBook Pro with the firewall on. I'm trying to run a Wireshark trace and the noise bleeding through Apple's firewall is very distracting. According to the image below, most of this noise is ...
0
votes
0answers
136 views

Wireshark on CentOS does not start

I'm using CentOS 6.4 64bit. When I run wireshark i get the following error: No protocol specified (wireshark:3620): Gtk-WARNING **: cannot open display: :0.0 It has come to my attention ...
0
votes
1answer
265 views

Why doesn't Wireshark capture management frames in promiscuous mode?

I am working with Wireshark in promiscuous mode, which is normally used to allow Wireshark to capture all the frames in the connected network. The problem is that Wireshark in this mode doesn't ...
1
vote
1answer
1k views

Sniffing the Router for Packets

I have used WireShark software to sniff my Network Interface. What if i wanted to sniff the router that what other computers on the network are doing? Is there any way to do that? Computers are ...
3
votes
2answers
225 views

Filter packets sent via HTTP to a port other then 80?

I have a database communicating on port 7474 via HTTP (sigh), and I want to debug the queries sent to / from it. However, a filter such as http.request.method == "POST" Filters out every post ...
1
vote
1answer
829 views

Unable to capture wifi traffic with wireshark

Even a few days ago everything was fine, but now simply I can't capture and see tcp, http, etc. wifi traffic but only the traffic for the protocols 802.11 and LLC. I used different wifi spots ...
0
votes
0answers
37 views

Verifying that keep-alives are working?

I'm currently working on a service-oriented architecture, and attempting to verify that keep-alives are working correctly between servers. The HTTP response headers are including Connection: ...
0
votes
2answers
234 views

Why am I getting arp requests from local machine?

I'm connecting wireless network (provided by apartment, so possibly quite a lot of machines connect to it) and I noticed that ARP requests from local machines send to my machine instead broadcast ...
1
vote
1answer
309 views

Wireshark traffice capture- one subnet to another subnet

My setup is a computer with wireshark connected to switch on LAN network. The subnet IP that the wireshark is on is .0.# . I would like to capture traffic between subnet IP of .0.# and .2.#. However ...
1
vote
1answer
489 views

Error in installing compiled wireshark 1.10.2 on Kali 1.0

I've downloaded source code of Wireshark 1.10.2 from it offical website and compile it by following commands: ./configure make make install It was compiled and installed successfully, but when I've ...
1
vote
1answer
123 views

How can I find the modulation schemes used for the packet transmission using wireshark?

I am using wireshark to find the modulation schemes and the type of packets captured for 802.11ac. How can I find the modulation schemes used for the packet transmission? Preferably using wireshark? ...
1
vote
1answer
154 views

Find out what programs are heavily using the network

Currently, I have a process on my Windows 7 system which is saturating the incoming broadband internet connection (75Mbit/s) and almost completely saturating the 100Mbit network controller. I cannot ...
0
votes
1answer
395 views

See file size on wireshark when downloading

Is there a way to see the filesize of a file when starting a download through wireshark? I want to see the size of http downloads on wireshark when i start them but i cant find that information.
0
votes
1answer
72 views

SSTP VPN not encrypt packets?

I had installed SSTP VPN server (windows server 2012) and then tryied to check whether my traffic is encrypted or not. I had used wireshark and got strange result: packets to all servers, but my ...
1
vote
0answers
255 views

How to troubleshoot a VPN connection drop

I have a Windows 8 machine that won't connect to a work VPN (other machines configured the same* way work fine). The IT dept at work says the attempt never shows up in the logs. On my computer, it ...