The network protocol analyzer developed and maintained by the Wireshark Foundation

learn more… | top users | synonyms

3
votes
2answers
3k views

tcpdump - just packet data

When using tcpdump, how can I print just the packet data? For example (anonymized): sudo tcpdump -X 'tcp port 80 and (((ip[2:2] - ((ip[0]&0xf)<<2)) - ((tcp[12]&0xf0)>>2)) != 0)' ...
3
votes
2answers
6k views

What does this UDP Packet mean?

I'm total newbie at tcp/ip and I was experimenting with Wireshark. What this mean: 1824 578.194204 xxx.xxx.xxx.xxx yyy.yyy.yyy.yyy UDP Source port: 17500 Destination port: 17500 In data I ...
3
votes
1answer
2k views

Wireshark doesn't capture 802.11 data packets

Lately I have been trying to analyze wifi traffic over my own test router. I looked on the wireshark website on how to do this and setup my own testing network. my network: dd-wrt router with WPA2 ...
3
votes
3answers
1k views

How to measure network traffic by protocol?

I would like to select a type of traffic, as I do in Wireshark, and measure the total traffic in each way for this filter. Is it possible with Wireshark? Is it possible with another Windows tool?
3
votes
1answer
2k views

wireshark usb traces explanations

I am trying to reverse engineer an usb (HID) device and cannot really figure out how what I see on wireshark (usbmon + wireshark on linux, or windows) relates to the usb protocol?. I have looked at ...
3
votes
1answer
222 views

how to see all network requests made by an application [duplicate]

Suppose i have an application running abc.exe, how to see all the network requests made by this application? Wireshark is good to see all the requests from the pc, but is there any filter for requests ...
3
votes
3answers
12k views

Wireshark Not Displaying Packets From Other Network Devices, Even in Promisc Mode

System Setup: MacBook Air running Mountain Lion and connected wirelessly to a router. Wireshark installed and capturing packets (I have "capture all in promiscuous mode" checked) I filter out all ...
3
votes
2answers
4k views

Why can't Wireshark read packets from ping?

I have Wireshark started, then I ping an IP address. But Wireshark is not picking up any packet sending to or receiving (echoing) from the destination address. Why? Is ping "protected" from being ...
3
votes
2answers
2k views

How do I trace HTTP packets with Wireshark?

What can I do in order to see packets that come from different sessions in a web page? For example when I open yahoo.com there are different sessions in yahoo; I dont know how to see which packet is ...
3
votes
1answer
152 views

Interactive network sniffing

I'm looking for what essentially amounts to an "interactive" Wireshark. I am looking for a tool that allows me to view network traffic on a given port and allow/deny/modify traffic on a per-packet ...
3
votes
1answer
2k views

How do I use tshark to extract bittorrent piece data to a file for post processing/reporting

Wireshark does a good job of extracting bittorrent PIECE messages sent to specific peers from other peers using a filter like the following e.g.: bittorrent.piece.data and ip.dst_host == 192.168.3....
3
votes
2answers
2k views

How do I monitor network traffic for IPP (LPD/LPR)?

I'm writing an application that sends print jobs over IPP to an LPR print server. I need a way to monitor the traffic going between that server and my development box. Right now I'm just sending jobs ...
3
votes
3answers
669 views

Windows 8 DNS lookup fails but wireshark shows that the query completes

I'm having a very weird problem. My dad recently purchased a new wireless router. We have at least 8 devices connected wirelessly, and all of them continued working just as they had before, except one....
3
votes
0answers
47 views

where does Windows Task Manager measure network data rate

I am trying to build a 10Gbps Ethernet channel between an FPGA and a Windows 7 PC. For a rough estimate, I measured the bandwidth usage of the link using Windows Task Manager's Network Tab. Later I ...
3
votes
1answer
133 views

ICMP Fails after first packet

I'm trying to ping any ip, other than my LAN IP & localhost, it fails except the first packet!! Snapshot from CMD with the pings But Wireshark capture shows that the ICMP is success!! ...
3
votes
1answer
2k views

SYN-ACK not received

On a standard TCP connection between server and client, I have this issue: the SYN-ACK is not received from the client, while it is sent from the server. I could see this on Wireshark from both server ...
3
votes
1answer
646 views

How to properly use stunnel?

I'm trying to setup Wireshark ssl debugging, and to do this, I'm trying to follow instructions in this article. I'm currently at stunnel part, and I'm trying to execute sudo stunnel -p ps.pem -d ...
3
votes
1answer
2k views

Having trouble Getting “RTSP over HTTP”

There is an axis camera that is connected to our site (camba.tv) through axis one click connection component (which acts as proxy). We can communicate with this camera only through http by setting the ...
2
votes
5answers
1k views

Can I collect wireless packets using Wireshark while being connected to the Internet via cable?

I am working on a PC which is connected to my router using a LAN cable, and the other computers in my house are connected to my router using WiFi. We are all connected to the same network, so I ...
2
votes
1answer
487 views

How to protect Cisco router from getting hacked by Wireshark software? [closed]

I can see my user name and password of my router on my laptop with a second machine connected to my Cisco router, when I use Wireshark on the second machine. How do I protect myself from such attacks?...
2
votes
3answers
7k views

Decrypting SSL traffic in Wireshark. Only headers get decrypted

I'm trying to decrypt SSL traffic in Wireshark, and it partially works because I'm able to view the decrypted headers. The problem is that I don't see any of the packet contents, only their headers. ...
2
votes
2answers
620 views

Program to record data transmission between two computers using a TCP port

I am looking for a way to view data being transmitted over a TCP port between two computers. Is there a software package that allows this? I suppose I could script something to re-route data coming ...
2
votes
2answers
6k views

Usefulness of packets in wireshark? SSDP protocol, rather than HTTP?

I used to be able to filter my wireshark packets to get useful information from them. However, with my current configuration on OSX, all of the HTTP traffic is coming through as the SSDP protocol and ...
2
votes
3answers
1k views

Wireshark on home-network

So basically I want to make WireShark ( Windows ) capture packets of the home network. As you know, home-networks are usually set by local IPs ( 192.168 or 10.0 range ) instead of the WAN IP so if we ...
2
votes
5answers
26k views

How do I limit packet capturing in Wireshark to only a specific protocol?

I would like to listen to HTTP traffic on port 8080. When I start capturing packets in Wireshark, it's flooded by packets using the SSDP protocol on port 1900. I would like to limit the packet ...
2
votes
3answers
3k views

Problem with Wireshark on Wifi

I am using wireshark over wifi from my network card Atheros AR9825 network card but it but it is showing the following error. What is the issue? ""The capture session could not be initiated (failed ...
2
votes
2answers
4k views

How can I monitor the traffic on a single port?

I am developing a python messenger client but I feel this is more targeted to superuser than StackOverflow. My server application seems not to get the data sent from time to time, so I want to see ...
2
votes
3answers
2k views

What's the difference between wlan.sa, wlan.ra, wlan.ta and wlan.da?

Tshark/wireshark (CLI) has several fields to display for WLAN, including these four (+ description from manual): wlan.sa: Source address wlan.ra: Receiver address wlan.ta: Transmitter address ...
2
votes
1answer
1k views

Can't capture any telnet packets

I'm running a Telnet server and client on my Windows 7 computer. Meanwhile, I'm running Wireshark to try to sniff the telnet login. I have been unable to get Telnet to send any packets that can be ...
2
votes
1answer
10k views

Wireshark on WPA2-PSK [AES] not decrypting

I am trying to capture all packets on my network from all devices connected to an SSID . I started up airmon-ng Started Monitoring on mon0 Changed Preferences in wireshark to 'enable decrytion' ...
2
votes
3answers
6k views

Sniff traffic coming from one particular application?

Basically I'd like to sniff HTTP requests made by an .exe on Windows. I tried using wireshark, but it's somewhat unhandy since it sniffs all traffic on the interface. Are there any alternatives?
2
votes
4answers
6k views

Wireshark - permission problem in Ubuntu

I installed wireshark (tshark) using sudo apt-get install tshark this installed the tshark executable in /usr/bin/tshark. The problem now is that I am unable to run it without root permissions. ...
2
votes
1answer
2k views

.exe file (specifically Wireshark) will not launch anymore on Windows 8.1

I use Wireshark x64 daily in my work. Suddenly today, it refuses to open. When I doubleclick a pcap (or pcapng) file, Windows tells me the file I tried to click was not found. When I try to start ...
2
votes
4answers
3k views

FTP disconnects after entering passive mode b/c packets are lost

For some reason, no matter how many times I try, after a client sends the PASV command (which is correctly received by the server), the server's reply (227 Entering Passive Mode) doesn't get back to ...
2
votes
1answer
2k views

Record multicast stream on multi-homed Linux host

I have what sounds like the simplest possible use case, and yet nothing is satisfactory. I have a multi-homed host and I would like to listen to multicasts on eth1, and shove all the payload (NOT ...
2
votes
1answer
7k views

How can I stop my computer from doing arp poisoning attacks?

I have a small LAN in my home about 4 - 5 computers. The problem is that when there are usually 3 or more pc's online we keep losing the Internet access randomly about every 2 minutes. So we took a ...
2
votes
1answer
8k views

How to find HTTP GETs in Wireshark

How can I use the filter in Wireshark to find only those lines that have HTTP GET in them?
2
votes
1answer
891 views

Have wireshark save the capture-stream at a certain amount of frames, then start new capture

Wireshark can easily capture hundreds of thousands of captures in under an hour. I'm wondering if it's possible to configure Wireshark to have WireShark save the capture after a certain amount of ...
2
votes
1answer
57 views

Using wireshark to snoop on RTSP over wifi

I just got a video baby monitor. It has several ports open including RTSP (554) by using Fing which is acting like nmap. I'd like to figure out what the full URL is of the stream. I have tried to ...
2
votes
1answer
1k views

Capturing traffic by HTTP host name, not by IP, via WireShark

I'm trying to filter traffic only to a given HTTP host name. I have a server, and I have dozens of websites on it. It only has one interface and one IP address. Thus filtering to my IP address is not ...
2
votes
2answers
2k views

Real-time loopback interface packet capture on Windows with RawCap, Wireshark, and some pipe utility

After stumbling across another Super User post about loopback packet capture on Windows, I was directed to RawCap, a utility that provides pseudo-capture of loopback packets. RawCap writes to libpcap ...
2
votes
1answer
418 views

Eavesdropping on a WPA2 (PSK) network

I’m trying to capture frames sent and / or received by other clients on my wireless (WPA2-PSK) network. I installed Wireshark, activated the promiscuous mode and set the decryption key, but I’m unable ...
2
votes
1answer
106 views

Simple way of demonstrating that a VPN is working, that is easy for novices to understand/comprehend?

I am developing a Linux-based security appliance. One of its functions is to cloak a user's traffic within a VPN, and I need a simple way of demonstrating that this function is working properly, and ...
2
votes
1answer
1k views

Change TCP sequence numbers for packet replay?

First off, I'm using wireshark for capture and colasoft for replay. I'm attempting to replay a group of captured packets back, looped to be done several times over (the purpose of this is just to send ...
2
votes
2answers
987 views

Why cocoa packet analyzer shows “capture packets to a trace file” menu?

I am trying to use 'cocoa packet analyzer'('C.P.A'). I uses mac OSX and I installed this from appstore. After installed this, when I launch this program a popup comes out. Others say that to get ...
2
votes
1answer
186 views

LAN assembly 2 packets into 1 packets?

I have two computers A and B, there is a TCP connection between them. I use TCPdump to capture the packets. I notice that when A sends a lot of TCP packets to B, each IP packets are 1514 bytes. In B,...
2
votes
2answers
3k views

Filter in Wireshark for TLS's Server Name Indication field

Does wireshark have a filter for TLS's Server Name Indication field?
2
votes
1answer
2k views

need display filter to display tcp packets of non zero payload in wireshark

i have a pcap which contains only tcp packets. now i want to see only those packets which have non zero payload length. can someone please let me know which display filter to use ? using data.len or ...
2
votes
1answer
1k views

Sniffing SSL Traffic with Wireshark Locally

I ahve an application that is submitting and recieving information via HTTPS. If I place wireshark on the same box and the client. Will I be able to decrypt all of the data within the communication ...
2
votes
3answers
2k views

Wireshark filter for different interface

I know that before capturing packets, I can select specific interface. I wonder is there any filter to distinguish different interfaces after I capture packets? That is, at the beginning, I capture ...