The network protocol analyzer developed and maintained by the Wireshark Foundation

learn more… | top users | synonyms

3
votes
1answer
2k views

How do I use tshark to extract bittorrent piece data to a file for post processing/reporting

Wireshark does a good job of extracting bittorrent PIECE messages sent to specific peers from other peers using a filter like the following e.g.: bittorrent.piece.data and ip.dst_host == ...
3
votes
3answers
1k views

How to measure network traffic by protocol?

I would like to select a type of traffic, as I do in Wireshark, and measure the total traffic in each way for this filter. Is it possible with Wireshark? Is it possible with another Windows tool?
3
votes
1answer
4k views

why still dns lookup when using proxy?

I've configured my browser(firefox) to use proxy ,but I find that it's still looking up the dns when I visit http://domain.name, why is that still necessary?
3
votes
3answers
344 views

Windows 8 DNS lookup fails but wireshark shows that the query completes

I'm having a very weird problem. My dad recently purchased a new wireless router. We have at least 8 devices connected wirelessly, and all of them continued working just as they had before, except ...
3
votes
1answer
94 views

ICMP Fails after first packet

I'm trying to ping any ip, other than my LAN IP & localhost, it fails except the first packet!! Snapshot from CMD with the pings But Wireshark capture shows that the ICMP is success!! ...
3
votes
1answer
1k views

SYN-ACK not received

On a standard TCP connection between server and client, I have this issue: the SYN-ACK is not received from the client, while it is sent from the server. I could see this on Wireshark from both server ...
3
votes
1answer
458 views

How to properly use stunnel?

I'm trying to setup Wireshark ssl debugging, and to do this, I'm trying to follow instructions in this article. I'm currently at stunnel part, and I'm trying to execute sudo stunnel -p ps.pem -d ...
3
votes
1answer
2k views

Having trouble Getting “RTSP over HTTP”

There is an axis camera that is connected to our site (camba.tv) through axis one click connection component (which acts as proxy). We can communicate with this camera only through http by setting the ...
2
votes
1answer
437 views

How to protect Cisco router from getting hacked by Wireshark software? [closed]

I can see my user name and password of my router on my laptop with a second machine connected to my Cisco router, when I use Wireshark on the second machine. How do I protect myself from such ...
2
votes
2answers
516 views

Program to record data transmission between two computers using a TCP port

I am looking for a way to view data being transmitted over a TCP port between two computers. Is there a software package that allows this? I suppose I could script something to re-route data coming ...
2
votes
3answers
3k views

Problem with Wireshark on Wifi

I am using wireshark over wifi from my network card Atheros AR9825 network card but it but it is showing the following error. What is the issue? ""The capture session could not be initiated (failed ...
2
votes
2answers
6k views

Usefulness of packets in wireshark? SSDP protocol, rather than HTTP?

I used to be able to filter my wireshark packets to get useful information from them. However, with my current configuration on OSX, all of the HTTP traffic is coming through as the SSDP protocol and ...
2
votes
3answers
5k views

Wireshark - permission problem in Ubuntu

I installed wireshark (tshark) using sudo apt-get install tshark this installed the tshark executable in /usr/bin/tshark. The problem now is that I am unable to run it without root permissions. ...
2
votes
3answers
1k views

Wireshark on home-network

So basically I want to make WireShark ( Windows ) capture packets of the home network. As you know, home-networks are usually set by local IPs ( 192.168 or 10.0 range ) instead of the WAN IP so if we ...
2
votes
1answer
7k views

Wireshark on WPA2-PSK [AES] not decrypting

I am trying to capture all packets on my network from all devices connected to an SSID . I started up airmon-ng Started Monitoring on mon0 Changed Preferences in wireshark to 'enable decrytion' ...
2
votes
3answers
3k views

Sniff traffic coming from one particular application?

Basically I'd like to sniff HTTP requests made by an .exe on Windows. I tried using wireshark, but it's somewhat unhandy since it sniffs all traffic on the interface. Are there any alternatives?
2
votes
5answers
21k views

How do I limit packet capturing in Wireshark to only a specific protocol?

I would like to listen to HTTP traffic on port 8080. When I start capturing packets in Wireshark, it's flooded by packets using the SSDP protocol on port 1900. I would like to limit the packet ...
2
votes
2answers
1k views

What's the difference between wlan.sa, wlan.ra, wlan.ta and wlan.da?

Tshark/wireshark (CLI) has several fields to display for WLAN, including these four (+ description from manual): wlan.sa: Source address wlan.ra: Receiver address wlan.ta: Transmitter address ...
2
votes
1answer
5k views

Wireshark - How do i filter the TCP[RST] packet?

I am looking for filter out the TCP[RST] packets on wireshark. I have tried tcp.analysis.flag but it didn't help.
2
votes
3answers
2k views

FTP disconnects after entering passive mode b/c packets are lost

For some reason, no matter how many times I try, after a client sends the PASV command (which is correctly received by the server), the server's reply (227 Entering Passive Mode) doesn't get back to ...
2
votes
1answer
1k views

Record multicast stream on multi-homed Linux host

I have what sounds like the simplest possible use case, and yet nothing is satisfactory. I have a multi-homed host and I would like to listen to multicasts on eth1, and shove all the payload (NOT ...
2
votes
2answers
2k views

Wireshark: Accessing USB Bus Interfaces without sudo

I am trying to monitor some USB traffic using Wireshark on Linux (Ubuntu). If I start Wireshark as my normal user without root privileges, the USB bus interfaces are not listed. If I sudo wireshark ...
2
votes
1answer
5k views

How can I stop my computer from doing arp poisoning attacks?

I have a small LAN in my home about 4 - 5 computers. The problem is that when there are usually 3 or more pc's online we keep losing the Internet access randomly about every 2 minutes. So we took a ...
2
votes
2answers
2k views

tcpdump - just packet data

When using tcpdump, how can I print just the packet data? For example (anonymized): sudo tcpdump -X 'tcp port 80 and (((ip[2:2] - ((ip[0]&0xf)<<2)) - ((tcp[12]&0xf0)>>2)) != 0)' ...
2
votes
1answer
4k views

How to find HTTP GETs in Wireshark

How can I use the filter in Wireshark to find only those lines that have HTTP GET in them?
2
votes
1answer
852 views

Have wireshark save the capture-stream at a certain amount of frames, then start new capture

Wireshark can easily capture hundreds of thousands of captures in under an hour. I'm wondering if it's possible to configure Wireshark to have WireShark save the capture after a certain amount of ...
2
votes
2answers
1k views

Real-time loopback interface packet capture on Windows with RawCap, Wireshark, and some pipe utility

After stumbling across another Super User post about loopback packet capture on Windows, I was directed to RawCap, a utility that provides pseudo-capture of loopback packets. RawCap writes to libpcap ...
2
votes
1answer
256 views

Eavesdropping on a WPA2 (PSK) network

I’m trying to capture frames sent and / or received by other clients on my wireless (WPA2-PSK) network. I installed Wireshark, activated the promiscuous mode and set the decryption key, but I’m unable ...
2
votes
1answer
83 views

Simple way of demonstrating that a VPN is working, that is easy for novices to understand/comprehend?

I am developing a Linux-based security appliance. One of its functions is to cloak a user's traffic within a VPN, and I need a simple way of demonstrating that this function is working properly, and ...
2
votes
1answer
2k views

Only shown problematic packets in WireShark

I am using WireShark to analyse millions of packets. Is there a filter which will only show those packets which have errors? By "error", I mean an IP error (e.g. incorrect IP header checksum), an TCP ...
2
votes
2answers
759 views

Why cocoa packet analyzer shows “capture packets to a trace file” menu?

I am trying to use 'cocoa packet analyzer'('C.P.A'). I uses mac OSX and I installed this from appstore. After installed this, when I launch this program a popup comes out. Others say that to get ...
2
votes
1answer
136 views

LAN assembly 2 packets into 1 packets?

I have two computers A and B, there is a TCP connection between them. I use TCPdump to capture the packets. I notice that when A sends a lot of TCP packets to B, each IP packets are 1514 bytes. In ...
2
votes
3answers
9k views

Wireshark Not Displaying Packets From Other Network Devices, Even in Promisc Mode

System Setup: MacBook Air running Mountain Lion and connected wirelessly to a router. Wireshark installed and capturing packets (I have "capture all in promiscuous mode" checked) I filter out all ...
2
votes
1answer
2k views

need display filter to display tcp packets of non zero payload in wireshark

i have a pcap which contains only tcp packets. now i want to see only those packets which have non zero payload length. can someone please let me know which display filter to use ? using data.len or ...
2
votes
1answer
882 views

Sniffing SSL Traffic with Wireshark Locally

I ahve an application that is submitting and recieving information via HTTPS. If I place wireshark on the same box and the client. Will I be able to decrypt all of the data within the communication ...
2
votes
3answers
1k views

Wireshark filter for different interface

I know that before capturing packets, I can select specific interface. I wonder is there any filter to distinguish different interfaces after I capture packets? That is, at the beginning, I capture ...
2
votes
1answer
402 views

Forwarding wifi traffic to wired pc

I'm trying to play around with Wireshark on my home network, and was wondering if there is a way to create a new connection on my PC that receives all wifi packets on the network. The PC is a wired ...
2
votes
1answer
747 views

Excessive “name query” and “standard query” activity on Wireshark?

I started using Wireshark on some class at university and decided to look at my home wireless network with it, just out of curiosity. But now I'm noticing excessive activity to what it looks like a ...
2
votes
2answers
1k views

How do I monitor network traffic for IPP (LPD/LPR)?

I'm writing an application that sends print jobs over IPP to an LPR print server. I need a way to monitor the traffic going between that server and my development box. Right now I'm just sending jobs ...
2
votes
1answer
2k views

How do I un-gzip data captured by Wireshark?

I have a Wireshark capture file with a HTTP request, however, the request is gzipped. My question is how can I ungzip it so see what data was transfered in cleartext? The capture file is here if ...
2
votes
1answer
46 views

Why does a radio stream not appear on a packet monitoring tool?

I am currently trying to find the URL to the audio stream for a webradio that only provides a flash player, that I would like to use with MusicBee's radio player. After using Wireshark to monitor my ...
2
votes
1answer
58 views

Explanation of port protocols in Wireshark?

When using Wireshark you can display the packets with just the plain number of the port, or with a "transport layer name resolution" (via the View/Name Resolution menu, for example). Unfortunately, ...
2
votes
1answer
876 views

Change TCP sequence numbers for packet replay?

First off, I'm using wireshark for capture and colasoft for replay. I'm attempting to replay a group of captured packets back, looped to be done several times over (the purpose of this is just to send ...
2
votes
1answer
3k views

How can I monitor traffic on my home network?

I have admin access to my D-Link DSL G604T router which controls one switch (and 2 computers) and three other computers. I want to monitor traffic on this router to find out who is downloading what / ...
2
votes
1answer
187 views

How can I filter incoming packets to my application?

I have only little experience with Wireshark. The problem is that when my server (3rd party app) receives a faulty packets, it crashes. I would need to filter the incoming packets and filter out such ...
2
votes
1answer
1k views

How to enable the TCP checksum validation in Tshark(Terminal WireShark)

When I run the command tshark -i 3 -c 100 -V less 1514 src 192.168.10.57 and dst 192.168.10.60 and tcp The output is: Transmission Control Protocol, Src Port: commplex-link (5001), Dst Port: ...
2
votes
1answer
2k views

Cannot connect to website - SSL handshaking fails

So I cannot connect to certain websites. Just a few, most are OK. The one I really care about is paypal.com. I have done the usual things. Let's see: Cleared browsing history Tried different ...
2
votes
1answer
2k views

Why do I keep seeing “Wireshark Cookie Dump Ok Cancel” in my input forms within Firefox?

I've recently installed Wireshark on my Macbook Pro. Since doing so, whenever I head over to http://jsfiddle.net, all of the input fields are pre-populated with Wireshark Cookie Dump: ...
2
votes
1answer
431 views

wireshark usb traces explanations

I am trying to reverse engineer an usb (HID) device and cannot really figure out how what I see on wireshark (usbmon + wireshark on linux, or windows) relates to the usb protocol?. I have looked at ...
2
votes
1answer
4k views

Sniffing the Router for Packets

I have used WireShark software to sniff my Network Interface. What if i wanted to sniff the router that what other computers on the network are doing? Is there any way to do that? Computers are ...