Open-source network packet analyzer

learn more… | top users | synonyms

2
votes
3answers
3k views

Problem with Wireshark on Wifi

I am using wireshark over wifi from my network card Atheros AR9825 network card but it but it is showing the following error. What is the issue? ""The capture session could not be initiated (failed ...
2
votes
3answers
4k views

Wireshark - permission problem in Ubuntu

I installed wireshark (tshark) using sudo apt-get install tshark this installed the tshark executable in /usr/bin/tshark. The problem now is that I am unable to run it without root permissions. ...
2
votes
1answer
2k views

wireshark: how to capture traffic between guest and host OS?

I'm trying to set up a lab to demonstrate ipv6 attack and detection mechanism on my Macbook. This is my set up with virtualbox: Host OS: OS X 10.8.2 IPv6 automatically, wireless connection Geust OS: ...
2
votes
3answers
1k views

Wireshark on home-network

So basically I want to make WireShark ( Windows ) capture packets of the home network. As you know, home-networks are usually set by local IPs ( 192.168 or 10.0 range ) instead of the WAN IP so if we ...
2
votes
2answers
5k views

Usefulness of packets in wireshark? SSDP protocol, rather than HTTP?

I used to be able to filter my wireshark packets to get useful information from them. However, with my current configuration on OSX, all of the HTTP traffic is coming through as the SSDP protocol and ...
2
votes
2answers
243 views

Real-time loopback interface packet capture on Windows with RawCap, Wireshark, and some pipe utility

After stumbling across another Super User post about loopback packet capture on Windows, I was directed to RawCap, a utility that provides pseudo-capture of loopback packets. RawCap writes to libpcap ...
2
votes
1answer
3k views

Wireshark - How do i filter the TCP[RST] packet?

I am looking for filter out the TCP[RST] packets on wireshark. I have tried tcp.analysis.flag but it didn't help.
2
votes
5answers
15k views

How do I limit packet capturing in Wireshark to only a specific protocol?

I would like to listen to HTTP traffic on port 8080. When I start capturing packets in Wireshark, it's flooded by packets using the SSDP protocol on port 1900. I would like to limit the packet ...
2
votes
1answer
12k views

TCP segment of a reassembled PDU

In wireshark sometimes I see this: 478195 5738.896809 192.168.1.79 61.213.44.124 TCP [TCP segment of a reassembled PDU] What is a PDU? Was it reassembled? What does this mean?
2
votes
3answers
11k views

promiscuous mode with Intel Centrino Advanced-N 6200 AGN wireless card

I'm trying to solve this problem for a long time, googling, reading and trying with no help. I have laptop with Intel Centrino Advanced-N 6200 AGN wireless card which suppose to support promiscuous ...
2
votes
2answers
5k views

What does this UDP Packet mean?

I'm total newbie at tcp/ip and I was experimenting with Wireshark. What this mean: 1824 578.194204 xxx.xxx.xxx.xxx yyy.yyy.yyy.yyy UDP Source port: 17500 Destination port: 17500 In data I ...
2
votes
1answer
785 views

Have wireshark save the capture-stream at a certain amount of frames, then start new capture

Wireshark can easily capture hundreds of thousands of captures in under an hour. I'm wondering if it's possible to configure Wireshark to have WireShark save the capture after a certain amount of ...
2
votes
1answer
55 views

Simple way of demonstrating that a VPN is working, that is easy for novices to understand/comprehend?

I am developing a Linux-based security appliance. One of its functions is to cloak a user's traffic within a VPN, and I need a simple way of demonstrating that this function is working properly, and ...
2
votes
1answer
81 views

how to see all network requests made by an application [duplicate]

Suppose i have an application running abc.exe, how to see all the network requests made by this application? Wireshark is good to see all the requests from the pc, but is there any filter for requests ...
2
votes
2answers
375 views

What's the difference between wlan.sa, wlan.ra, wlan.ta and wlan.da?

Tshark/wireshark (CLI) has several fields to display for WLAN, including these four (+ description from manual): wlan.sa: Source address wlan.ra: Receiver address wlan.ta: Transmitter address ...
2
votes
1answer
94 views

LAN assembly 2 packets into 1 packets?

I have two computers A and B, there is a TCP connection between them. I use TCPdump to capture the packets. I notice that when A sends a lot of TCP packets to B, each IP packets are 1514 bytes. In ...
2
votes
1answer
803 views

need display filter to display tcp packets of non zero payload in wireshark

i have a pcap which contains only tcp packets. now i want to see only those packets which have non zero payload length. can someone please let me know which display filter to use ? using data.len or ...
2
votes
2answers
863 views

Wireshark: Accessing USB Bus Interfaces without sudo

I am trying to monitor some USB traffic using Wireshark on Linux (Ubuntu). If I start Wireshark as my normal user without root privileges, the USB bus interfaces are not listed. If I sudo wireshark ...
2
votes
1answer
672 views

Sniffing SSL Traffic with Wireshark Locally

I ahve an application that is submitting and recieving information via HTTPS. If I place wireshark on the same box and the client. Will I be able to decrypt all of the data within the communication ...
2
votes
1answer
3k views

How can I stop my computer from doing arp poisoning attacks?

I have a small LAN in my home about 4 - 5 computers. The problem is that when there are usually 3 or more pc's online we keep losing the Internet access randomly about every 2 minutes. So we took a ...
2
votes
1answer
368 views

Forwarding wifi traffic to wired pc

I'm trying to play around with Wireshark on my home network, and was wondering if there is a way to create a new connection on my PC that receives all wifi packets on the network. The PC is a wired ...
2
votes
1answer
665 views

Excessive “name query” and “standard query” activity on Wireshark?

I started using Wireshark on some class at university and decided to look at my home wireless network with it, just out of curiosity. But now I'm noticing excessive activity to what it looks like a ...
2
votes
2answers
1k views

How do I monitor network traffic for IPP (LPD/LPR)?

I'm writing an application that sends print jobs over IPP to an LPR print server. I need a way to monitor the traffic going between that server and my development box. Right now I'm just sending jobs ...
2
votes
1answer
2k views

How do I un-gzip data captured by Wireshark?

I have a Wireshark capture file with a HTTP request, however, the request is gzipped. My question is how can I ungzip it so see what data was transfered in cleartext? The capture file is here if ...
2
votes
1answer
17 views

Explanation of port protocols in Wireshark?

When using Wireshark you can display the packets with just the plain number of the port, or with a "transport layer name resolution" (via the View/Name Resolution menu, for example). Unfortunately, ...
2
votes
1answer
487 views

Change TCP sequence numbers for packet replay?

First off, I'm using wireshark for capture and colasoft for replay. I'm attempting to replay a group of captured packets back, looped to be done several times over (the purpose of this is just to send ...
2
votes
2answers
628 views

usbmon (wireshark, tshark) for regular user

I have libpcap set up with the newest cvs version. Regular users can run Wireshark and tshark. Specifically, they have been added to the wireshark group and can capture from 1. eth0 2. br0 3. nflog ...
2
votes
1answer
2k views

How can I monitor traffic on my home network?

I have admin access to my D-Link DSL G604T router which controls one switch (and 2 computers) and three other computers. I want to monitor traffic on this router to find out who is downloading what / ...
2
votes
1answer
2k views

Cannot connect to website - SSL handshaking fails

So I cannot connect to certain websites. Just a few, most are OK. The one I really care about is paypal.com. I have done the usual things. Let's see: Cleared browsing history Tried different ...
2
votes
1answer
2k views

Why do I keep seeing “Wireshark Cookie Dump Ok Cancel” in my input forms within Firefox?

I've recently installed Wireshark on my Macbook Pro. Since doing so, whenever I head over to http://jsfiddle.net, all of the input fields are pre-populated with Wireshark Cookie Dump: ...
2
votes
3answers
573 views

Wireshark filter for different interface

I know that before capturing packets, I can select specific interface. I wonder is there any filter to distinguish different interfaces after I capture packets? That is, at the beginning, I capture ...
2
votes
1answer
154 views

Follow a .pcap file in wireshark like tail -f

I have a .pcap file on my android device, that I can access from my PC with wireshark via smb and wondering if it possible to get a 'Live view' of that file in wireshark. Is there any solution?
2
votes
0answers
818 views

tcp port numbers reused on wireshark

I used raw socket to build a tcp client program on machine A to reproduce tcp 3-way handshake with a simple regular tcp server on machine B I captured packets on the client host and server host, and ...
2
votes
0answers
306 views

Decode SSL packets in WireShark

I have cert.cer, base64 x509 and a Wireshark dump in .pcap format. The packets are encoded, so how do I decode them? Now: [site-ip],443,http,xe.cer but it's still not working.
2
votes
1answer
355 views

What do these fields mean in Wireshark?

What does the following mean in the info section of wireshark? Source Client Destination Server Protocol HTTP Length 522 Info 522 GET /intl/en/images/logo.gif HTTP/1.1 More ...
2
votes
1answer
431 views

Linux alternative to Fiddler2 (different use! Not same question!)

I am aware that this question has been asked before; but my use for fiddler is completely different; Fiddler2 is my example. In Fiddler2 I can download streams from websites; for example if I stream ...
2
votes
0answers
445 views

Wireshark vs Netmon for precise time tagging

I'm using Wireshark to time tag and get some statistics on multicast traffic. When there is not much traffic, the stats looks good, but as soon as there is a bunch of packets arriving at the same ...
2
votes
1answer
258 views

What is wag-service?

Does anyone know what wag-service is? I'm seeing it a lot in Wireshark
1
vote
1answer
154 views

Find out what programs are heavily using the network

Currently, I have a process on my Windows 7 system which is saturating the incoming broadband internet connection (75Mbit/s) and almost completely saturating the 100Mbit network controller. I cannot ...
1
vote
2answers
413 views

Is it possible to know which process opened a connection in Windows?

With netstat -a I can see all connections from my machine to the MySQL Server. There is any way too see which process or executable is responsible for each connection? The only solution I found so ...
1
vote
3answers
2k views

Wireshark can see outside of the virtual machine?

I'm running Windows in a VM inside of OSX. If I start Wireshark inside Windows, then a message from OSX pops up saying that Wireshark is trying to monitor all network traffic. If I accept, then ...
1
vote
2answers
1k views

Do machines connected to the same switch belong to the same subnet?

When we talk about a subnet - do we mean all the systems connected to the same switch? If I have an assigned IP address of 10.0.2.1, am I in the same subnet as that of 10.0.1.39? When we talk about ...
1
vote
2answers
5k views

Decrypting SSL traffic in Wireshark. Only headers get decrypted

I'm trying to decrypt SSL traffic in Wireshark, and it partially works because I'm able to view the decrypted headers. The problem is that I don't see any of the packet contents, only their headers. ...
1
vote
2answers
899 views

Networking packet sniffer for Linux that captures the application names?

I tried Wireshark. It shows the source and destination IP address, port number, and packet contents, but nothing about which application is using the packets. Apparently tcpdump is similar; network ...
1
vote
3answers
359 views

Why would my network slow down?

The network at my work has about 40 computers on it and a quite a few printers. When there are a lot of people working the network will be slow. I can test the ping between my computer and the router ...
1
vote
3answers
2k views

Finding the external (PPPoE, WAN) MAC address of an ADSL router

My ISP is Orange Internet, I have recently ditched my crummy "livebox" and moved to a more stable BT Business Hub with the firmware flashed back to the original SingTel ROM. The thing works great ...
1
vote
1answer
815 views

Using (embedding?) wireshark in a C application for sniffing [closed]

I'm writing a C/C++ application which needs (among other things) to sniff packets and save the output in a file. This file will be read and processed by wireshark after a few days, using a LUA script ...
1
vote
2answers
89 views

Wireshark filtering for one network

How do i make Wireshark filter results so it just shows results from one wifi net work. I have had a look on Google but found nothing. Can any one help.
1
vote
1answer
4k views

Wireshark on WPA2-PSK [AES] not decrypting

I am trying to capture all packets on my network from all devices connected to an SSID . I started up airmon-ng Started Monitoring on mon0 Changed Preferences in wireshark to 'enable decrytion' ...
1
vote
3answers
796 views

RS232 / Ethernet Port Servers - Protocols Involved?

Firstly, I'm not responsible for the equipment, so don't panic that I'm asking such basic questions :) At work we have multiple RS232 / Ethernet port servers (Say the 16 port version of this ...