The network protocol analyzer developed and maintained by the Wireshark Foundation

learn more… | top users | synonyms

0
votes
0answers
137 views

monitor and log LAN network traffic on CentOS 6.x

I've been fiddling with this one for almost a week now. My setup is: LAN (windows/linux PCs/servers) <-> CentOS gateway/firewall box <-> ISP I'm trying to setup a monitoring solution which ...
1
vote
0answers
68 views

What causes these corrupted downloads and spurious retransmissions?

I encountered many corrupted downloads recently. Sometimes compressed files wouldn’t open or checksums would not match. Sometimes images on Websites would just be grey (or a wild mix of colour) after ...
1
vote
0answers
53 views

Wireshark does not show my USB dongle as capture interface

I am using wireshark 1.12.6 on windows 8.1. I cannot set my USB dongle as the capture interface (in linux it shows the dongle also as the capture interface. How can I do this in Windows?
-2
votes
1answer
46 views

tcptrace from wireshark 802.11 capture

I have the same question Lukas asked on April 1... How can I use tcptrace to generate tcptrace graph from captures on Wireshark? Guy responded by asking if just feeding the Wireshark output to ...
0
votes
1answer
23 views

Is it possible to sniff packets from a client connected router via Wi-Fi while I am connected through Ethernet?

How to sniff packets (using wireshark) from the other client connected to the same router (Linksys) but through Ethernet cable while I’m connected to that router via Wi-Fi. Is it possible?
0
votes
1answer
94 views

Use SSH to pipe tcpdump into wireshark with “command” in authorized_keys

we want to enable real-time network tracing for Application Testing. We want to grant as little permissions/rights on the remote host that will run tcpdump. So i tried to setup an authorized key ...
0
votes
1answer
105 views

Strange MAC address on Wireshark screen

I trying to see Wi-Fi (802.11) packets through Wireshark. Here's information of my wireless interface: $ ifconfig wlan1 Link encap:Ethernet HWaddr c0:f8:da:21:ce:68 # and so on blahblah ...
0
votes
1answer
140 views

Computer is sending / receiving data form a computer and I don't know why

So I have been playing with WireShark and I have found something weird. After closing every application that uses the internet (As far as I know) I have found that my computer is sending / receiving ...
1
vote
2answers
2k views

Monitor Mode doesn't work in Kali 2.0

For the last year or so I have been using this exact setup with Kali 1.0. Everything worked fine with Wireshark. Now, when I am connected to a Wi-Fi access point my card REFUSES to stay in monitor ...
1
vote
1answer
28 views

Promiscuous mode not working with ubuntu and wireshark

I am running Ubuntu Linux and have installed wireshark on it. I can see the incoming and outgoing traffic just fine. Now I want to see the traffic from other devices which are on my LAN. So, I did: ...
0
votes
3answers
53 views

Can WireShark be used to collect packets on same network?

I am trying to sniff packets using Wireshark. But Wireshark collects packets of computers connected to my Router only. If i know the IP address of a Computer , can i sniff the packets of that Computer ...
0
votes
0answers
50 views

Confusion in Iperf server report?

I am connecting one of my computers to LAN which is connected to 802.11n Access Point using ethernet cable while my other computer is connected to wifi. When I send 20Mbps traffic from iperf while ...
0
votes
0answers
43 views

How can I use Microsoft Network Monitor to view messages sent via socket client/server

I would like to view the exact messages sent/received in Microsoft network monitor, but I do not know how. I have build a program to send messages via TCP socket and If a message "ready" is sent over ...
1
vote
1answer
64 views

How to resolve DNS from java like WIRESHARK does?

Could you explain how Wireshark makes a DNS query in order to resolve the name of an IP address? My issue is about the mismatch between the domain name resolved by Wireshark and that returned by ...
0
votes
0answers
60 views

Wireshark won't open

I'm having trouble with wireshark on Kali Linux 1.1.0 when I try to open it the process bar loads to 100% and says "loading configuration files" but it gets stuck there. Anyone know how I can fix ...
1
vote
3answers
237 views

How does Wireshark resolve DNS names?

Could you explain how Wireshark makes a DNS query in order to resolve the name of an IP address? My issue is about the mismatch between the domain name resolved by Wireshark and that returned by ...
0
votes
0answers
13 views

Is there a light exe / sniffer to ensure that certain traffic is traveling over intended ports to validate vpn/ssh settings?

I'm using ssh and split-tunneling vpn and I'd like to get a log of which traffic is sent over which ports. Is there a simple software to do this? Is there a way to easily show this over wireshark ...
0
votes
0answers
28 views

Multiple syn's before handshake connection?

I have a scenario, I'm analyzing ssl (decrpyt) traffic to my webserver. I'm investigating server and end-to-end delay issues. In between this I'm stuck at following traffic pattern for which I need ...
0
votes
1answer
25 views

libpcap : Filter by ether_type and by speficied bytes

Thanks to pcap_filter, I want to filter by ether_type : Protocol 0x88b5 AND by specific bytes in the payload : "ASK", or 0x41434b It's ethernet-level => no network layer, directly the payload. => ...
0
votes
0answers
35 views

TCP Retransmission on the receiver side

How does Wireshark knows that a packet on the receiver side is being retransmitted. I mean it makes sense on the sender side: Wireshark sees two identical packets (with the same sequence number) being ...
0
votes
0answers
85 views

packets information in tcpdump /capinfos

I'm testing the packet capture efficiency of a sniffer application (netsniff-ng) w.r.t a proprietary sniffer recorder. I had a linux system use tcpreplay to send 25 pcap files @ 100Mbps to both the ...
0
votes
2answers
108 views

find url of radio stream

I'm trying to find the actual stream URL of an radio stream, specifically this one. There are a bunch of questions for this, but none of them have helped at all. Some have said that I can use ...
0
votes
0answers
76 views

Bluetooth Capture Interface missing on Wireshark / Kali Linux 1.1.0a

I'm trying to capture local bluetooth traffic from my device running Kali Linux 1.0.0a with wireshark. However, the bluetooth capture interface is not shown. According to the documenation it should be ...
0
votes
0answers
78 views

Identifying SSH sub flows in tshark

I am currently considering the implementation of a research paper for which i need to identify the transport, connection and authentication protocols in SSH. I went through the RFC and have concluded ...
0
votes
1answer
156 views

Unable to start npf driver

I need to start the npf driver for Wireshark but when I try to type "net start npf" in cmd prompt, I get the following error: "System error 1058 has occurred. The service cannot be started, either ...
1
vote
0answers
98 views

How to use wireshark to decode SSL stream from remote API server?

I'm trying to troubleshoot some issues with what my code is sending to a remote API (over https). I've seen a ton of articles on Wireshark and decoding SSL, but they all make up their own test server ...
2
votes
5answers
554 views

Can I collect wireless packets using Wireshark while being connected to the Internet via cable?

I am working on a PC which is connected to my router using a LAN cable, and the other computers in my house are connected to my router using WiFi. We are all connected to the same network, so I ...
0
votes
0answers
40 views

Wireshark 1.99 monitor mode?

Relatively new to Wireshark, running 1.99.7 on a MacBook Pro (2015), OS X Yosemite 10.10.3. I have no problem with basic capture via wifi, but have been unable to figure out how to turn on monitor ...
0
votes
0answers
48 views

how to parse a pcap file for specific words

I got a 90GB pcap file that I am trying to calculate the tcp retransmission rate for. As the file is very large I was thinking just parse it locally on the redhat server that it is sitting on. FTPing ...
1
vote
0answers
105 views

TCPDUMP Network IPv6 Packets

I am new to tcpdump tool and I am working in the analysis of network packets, I have analysed the IPv4 Ip packtes generated in case of wifi. But Now I am running my android phone in sim's 3g network ...
0
votes
0answers
42 views

I cannot capture DHCPv6 packets on GNS3 using Wireshark

I have got a router set up as a DHCPv6 server connected to a host that gets an IPv4 & IPv6 addresses from it, however I am not able to capture any DHCPv6 packets at any point of the connection. ...
0
votes
0answers
50 views

Connection interruptions on Debian router, possibly due to excessive duplicate ACKs?

I have a Debian server as a house router, which for a year has been working flawlessly. However, I recently moved and switched service providers from FiOS to Comcast, and possibly as a result am ...
0
votes
0answers
24 views

Tshark interface to sniff on

I have a MQTT broker and a MQTT client both running on the same machine. The client sends publish packets to the broker. The broker processes it and sends it back to the same client as publish packet. ...
0
votes
1answer
100 views

iperf and Wireshark show different data rate

I was testing the capture performance of a sniffer application in Linux. I have a Windows machine that sends UDP multicast packets to the capture port of the sniffer system using iperf at 8Mbits/s. I ...
0
votes
0answers
67 views

Using I/O graph how to interept bytes/tick against packet details information?

I'm working on a trace-file which has reported ISP throttling occurrences in it. My task is to use IO graph to understand at what point in time the throttling process effected client upload ...
0
votes
1answer
39 views

Get entire packets size in Wireshark

Is there a way to show the size of all of the packets received in Wireshark? For example, if I have 10 packets received and the size of each packet is 1 KB, then Wireshark would display: 10 KB.
1
vote
2answers
385 views

What causes dropping of ARP response packets in a wireless network?

I have a network of wireless access points (APs) in my local area network (LAN). Some PCs in the network can get ping responses from some other PCs/devices in the network but not some others. I have ...
0
votes
0answers
53 views

Monitor TCP port traffic and get a sound alert when a specific text string is found on Windows

I need to watch a port for several hours and make an audible alert whenever a specific string comes through. Windows only. Is this possible with Wireshark or another sniffer tool or maybe a sniffer ...
2
votes
1answer
49 views

router automatically disables wifi and enables after 2-3min

Router: Netgear DGN2200v2 Problem: THe router disables the wifi network automatically(with no human interference what so ever), thus all pc's disconnect and have no network access(as if the router ...
0
votes
1answer
341 views

Possible network loop with WiFi and Ethernet when docked

I have been seeing a weird problem that I can't reproduce on demand and have a suspicion on the root cause. The Issue: Intermittently the entire network goes down until I walk around and unplug ...
1
vote
1answer
547 views

tcpdump not displaying RSSI

I am monitoring Wi-Fi probe requests via tcpdump on Debian and am trying to capture the RSSI (signal strength) of each probe request element. Currently, the output from tcpdump for each probe request ...
0
votes
0answers
98 views

How to get Alfa awus036nha to work with Ubuntu 14.04?

I installed Ubuntu 14.04 in a dual boot configuration with OS X Yosemite. I then installed Wireshark on Ubuntu and I'm going to use an Alfa AWUS036NHA (Atheros chipset) adapter. The problem is that ...
0
votes
1answer
131 views

wireshark save capture directly to file with filter

I am looking to have a long-term packet capture running to monitor DNS requests on my machine. I generally use wireshark for network monitoring, but since I am only interested in DNS packets, and over ...
0
votes
2answers
141 views

How to run sniffing demonstration using virtualbox and wireshark

I am going to have a demonstration of packet sniffing using wireshark. Therefore, I decided to create two vitual machines in virtualbox (with "host-only adapter" network config) and monitor the ...
1
vote
0answers
86 views

TCP packet issue with 802.11ac but not with 802.11n on an Android Nexus 6

I have an Android Nexus 6 that connects to my computer via an ad-hoc network. When my phone connects to the 802.11n card (TP-LINK 300Mbps Wireless N), the bytes are sent with no issue; verified with ...
0
votes
1answer
534 views

Why filtering on udp port in TCPDUMP gives only fragmented IP frames

I've a device capturing traffic with Tcpdump filtering on "upd dst port" then it creates a pcap file to be read in wireshark. what I obtain from running: tcpdump udp dst port 5201 -qUns 0 -i wlan0 ...
0
votes
1answer
211 views

Wireshark loopback on mac os x [closed]

I have selected loopback (in capture options) to capture http traffic on my localhost server, but everytime I do and HTTP I only can see TCP.
0
votes
0answers
44 views

How to capture VirtualBox VM packets

I am currently running a series of three Ubuntu 14.04 VMs on my Windows 7 x64 host. The guests are all configured thusly: Host-Only Adapter Intel Pro/1000 MT Desktop Promiscuous Mode: Allow VMs Cable ...
4
votes
0answers
198 views

why am I not seeing traffic using TCPDUMP while sniffing on wireless interface with the station in WDS mode

I've 2 wireless interfaces one has the type of AP and the other has the type monitor. the AP is attached to a bridge br-lan. When I run for example: tcpdump port 5201 -s 0 -ni wlan0 TCPdump is ...
0
votes
0answers
53 views

Https request call capture in Wireshark

I have installed Wireshark and Windows based application(to be analyzed) which uses https request authentication to validate user.When I use interfaces -- > capture all the request of my system is ...