The network protocol analyzer developed and maintained by the Wireshark Foundation

learn more… | top users | synonyms

0
votes
0answers
120 views

Wireshark won't open

I'm having trouble with wireshark on Kali Linux 1.1.0 when I try to open it the process bar loads to 100% and says "loading configuration files" but it gets stuck there. Anyone know how I can fix this?...
1
vote
3answers
516 views

How does Wireshark resolve DNS names?

Could you explain how Wireshark makes a DNS query in order to resolve the name of an IP address? My issue is about the mismatch between the domain name resolved by Wireshark and that returned by ...
0
votes
0answers
17 views

Is there a light exe / sniffer to ensure that certain traffic is traveling over intended ports to validate vpn/ssh settings?

I'm using ssh and split-tunneling vpn and I'd like to get a log of which traffic is sent over which ports. Is there a simple software to do this? Is there a way to easily show this over wireshark (...
0
votes
0answers
49 views

Multiple syn's before handshake connection?

I have a scenario, I'm analyzing ssl (decrpyt) traffic to my webserver. I'm investigating server and end-to-end delay issues. In between this I'm stuck at following traffic pattern for which I need ...
0
votes
1answer
31 views

libpcap : Filter by ether_type and by speficied bytes

Thanks to pcap_filter, I want to filter by ether_type : Protocol 0x88b5 AND by specific bytes in the payload : "ASK", or 0x41434b It's ethernet-level => no network layer, directly the payload. => ...
0
votes
0answers
38 views

TCP Retransmission on the receiver side

How does Wireshark knows that a packet on the receiver side is being retransmitted. I mean it makes sense on the sender side: Wireshark sees two identical packets (with the same sequence number) being ...
0
votes
0answers
94 views

packets information in tcpdump /capinfos

I'm testing the packet capture efficiency of a sniffer application (netsniff-ng) w.r.t a proprietary sniffer recorder. I had a linux system use tcpreplay to send 25 pcap files @ 100Mbps to both the ...
0
votes
2answers
160 views

find url of radio stream

I'm trying to find the actual stream URL of an radio stream, specifically this one. There are a bunch of questions for this, but none of them have helped at all. Some have said that I can use ...
0
votes
0answers
91 views

Bluetooth Capture Interface missing on Wireshark / Kali Linux 1.1.0a

I'm trying to capture local bluetooth traffic from my device running Kali Linux 1.0.0a with wireshark. However, the bluetooth capture interface is not shown. According to the documenation it should be ...
0
votes
0answers
133 views

Identifying SSH sub flows in tshark

I am currently considering the implementation of a research paper for which i need to identify the transport, connection and authentication protocols in SSH. I went through the RFC and have concluded ...
0
votes
1answer
242 views

Unable to start npf driver

I need to start the npf driver for Wireshark but when I try to type "net start npf" in cmd prompt, I get the following error: "System error 1058 has occurred. The service cannot be started, either ...
2
votes
0answers
124 views

How to use wireshark to decode SSL stream from remote API server?

I'm trying to troubleshoot some issues with what my code is sending to a remote API (over https). I've seen a ton of articles on Wireshark and decoding SSL, but they all make up their own test server ...
2
votes
5answers
981 views

Can I collect wireless packets using Wireshark while being connected to the Internet via cable?

I am working on a PC which is connected to my router using a LAN cable, and the other computers in my house are connected to my router using WiFi. We are all connected to the same network, so I ...
0
votes
0answers
45 views

Wireshark 1.99 monitor mode?

Relatively new to Wireshark, running 1.99.7 on a MacBook Pro (2015), OS X Yosemite 10.10.3. I have no problem with basic capture via wifi, but have been unable to figure out how to turn on monitor ...
0
votes
0answers
59 views

how to parse a pcap file for specific words

I got a 90GB pcap file that I am trying to calculate the tcp retransmission rate for. As the file is very large I was thinking just parse it locally on the redhat server that it is sitting on. FTPing ...
1
vote
0answers
161 views

TCPDUMP Network IPv6 Packets

I am new to tcpdump tool and I am working in the analysis of network packets, I have analysed the IPv4 Ip packtes generated in case of wifi. But Now I am running my android phone in sim's 3g network ...
0
votes
0answers
53 views

I cannot capture DHCPv6 packets on GNS3 using Wireshark

I have got a router set up as a DHCPv6 server connected to a host that gets an IPv4 & IPv6 addresses from it, however I am not able to capture any DHCPv6 packets at any point of the connection. ...
0
votes
0answers
52 views

Connection interruptions on Debian router, possibly due to excessive duplicate ACKs?

I have a Debian server as a house router, which for a year has been working flawlessly. However, I recently moved and switched service providers from FiOS to Comcast, and possibly as a result am ...
0
votes
0answers
31 views

Tshark interface to sniff on

I have a MQTT broker and a MQTT client both running on the same machine. The client sends publish packets to the broker. The broker processes it and sends it back to the same client as publish packet. ...
0
votes
1answer
164 views

iperf and Wireshark show different data rate

I was testing the capture performance of a sniffer application in Linux. I have a Windows machine that sends UDP multicast packets to the capture port of the sniffer system using iperf at 8Mbits/s. I ...
0
votes
1answer
42 views

Get entire packets size in Wireshark

Is there a way to show the size of all of the packets received in Wireshark? For example, if I have 10 packets received and the size of each packet is 1 KB, then Wireshark would display: 10 KB.
1
vote
2answers
643 views

What causes dropping of ARP response packets in a wireless network?

I have a network of wireless access points (APs) in my local area network (LAN). Some PCs in the network can get ping responses from some other PCs/devices in the network but not some others. I have ...
0
votes
0answers
71 views

Monitor TCP port traffic and get a sound alert when a specific text string is found on Windows

I need to watch a port for several hours and make an audible alert whenever a specific string comes through. Windows only. Is this possible with Wireshark or another sniffer tool or maybe a sniffer ...
2
votes
1answer
55 views

router automatically disables wifi and enables after 2-3min

Router: Netgear DGN2200v2 Problem: THe router disables the wifi network automatically(with no human interference what so ever), thus all pc's disconnect and have no network access(as if the router ...
0
votes
1answer
536 views

Possible network loop with WiFi and Ethernet when docked

I have been seeing a weird problem that I can't reproduce on demand and have a suspicion on the root cause. The Issue: Intermittently the entire network goes down until I walk around and unplug ...
1
vote
1answer
838 views

tcpdump not displaying RSSI

I am monitoring Wi-Fi probe requests via tcpdump on Debian and am trying to capture the RSSI (signal strength) of each probe request element. Currently, the output from tcpdump for each probe request ...
0
votes
0answers
131 views

How to get Alfa awus036nha to work with Ubuntu 14.04?

I installed Ubuntu 14.04 in a dual boot configuration with OS X Yosemite. I then installed Wireshark on Ubuntu and I'm going to use an Alfa AWUS036NHA (Atheros chipset) adapter. The problem is that ...
0
votes
1answer
173 views

wireshark save capture directly to file with filter

I am looking to have a long-term packet capture running to monitor DNS requests on my machine. I generally use wireshark for network monitoring, but since I am only interested in DNS packets, and over ...
0
votes
2answers
176 views

How to run sniffing demonstration using virtualbox and wireshark

I am going to have a demonstration of packet sniffing using wireshark. Therefore, I decided to create two vitual machines in virtualbox (with "host-only adapter" network config) and monitor the ...
1
vote
0answers
94 views

TCP packet issue with 802.11ac but not with 802.11n on an Android Nexus 6

I have an Android Nexus 6 that connects to my computer via an ad-hoc network. When my phone connects to the 802.11n card (TP-LINK 300Mbps Wireless N), the bytes are sent with no issue; verified with ...
0
votes
1answer
777 views

Why filtering on udp port in TCPDUMP gives only fragmented IP frames

I've a device capturing traffic with Tcpdump filtering on "upd dst port" then it creates a pcap file to be read in wireshark. what I obtain from running: tcpdump udp dst port 5201 -qUns 0 -i wlan0 -...
0
votes
1answer
433 views

Wireshark loopback on mac os x [closed]

I have selected loopback (in capture options) to capture http traffic on my localhost server, but everytime I do and HTTP I only can see TCP.
4
votes
0answers
256 views

why am I not seeing traffic using TCPDUMP while sniffing on wireless interface with the station in WDS mode

I've 2 wireless interfaces one has the type of AP and the other has the type monitor. the AP is attached to a bridge br-lan. When I run for example: tcpdump port 5201 -s 0 -ni wlan0 TCPdump is ...
0
votes
0answers
55 views

Https request call capture in Wireshark

I have installed Wireshark and Windows based application(to be analyzed) which uses https request authentication to validate user.When I use interfaces -- > capture all the request of my system is ...
0
votes
1answer
420 views

Graphical representation of iperf3 results

I'm using Iperf3 on 2 machines and actually I'm running 2 instances of Iperf3, one to generate traffic with high priority and the other generates traffic with low priority. I would like to generate a ...
1
vote
0answers
440 views

Viewing Xbox One Network Traffic

I am trying to view the HTTP/HTTPS traffic going from my XBOX one so I can see what is being requested. I started off trying to use Charles proxy like this https://www.youtube.com/watch?v=MP4ZcwSHxbw. ...
1
vote
0answers
47 views

Long SMB session setup delay

I have a Windows machine connecting to an SMB share on a local Debian server. Everything works flawlessly, when it's connected, but the first connection (either after a boot / reboot, or after ...
0
votes
0answers
73 views

Reading packets with Wireshark

How do I read packets captured with Wireshark. I was finally able to capture incoming and outgoing data in hopes of developing something along the lines of an IDS. Thanks in advance for the help. A ...
0
votes
2answers
274 views

Duplicate IP address Telnet and ARP

I have 3 hosts (PC1, PC2, and PC3). I set the IP addresses for PC2 and PC3 to be 10.0.0.2 and PC3 to be 10.0.0.1. I telnet from PC1 to 10.0.0.2. I then am logged in to PC3. I can see in Wireshark that ...
0
votes
1answer
88 views

How to find 802.11 protocol variant, and decipher packet_payload_info in PcapNG files?

I'm building a (Python) parser of PcapNG files created by Wireshark. After reading https://www.winpcap.org/ntar/draft/PCAP-DumpFileFormat.html, I'm having the following problems: I'd like to ...
0
votes
1answer
25 views

Does connecting to one's computer via local router automatically uses the loopback?

I have a TCP application that doesn't show up on Wireshark. I read it was because Wireshark is not able to sniff Loopback communication on Windows. So, instead of connecting to 127.0.0.1, I connected ...
2
votes
1answer
322 views

Why does a radio stream not appear on a packet monitoring tool?

I am currently trying to find the URL to the audio stream for a webradio that only provides a flash player, that I would like to use with MusicBee's radio player. After using Wireshark to monitor my ...
0
votes
1answer
211 views

How is the FID generated for a SMB “Create AndX Request?”

I see in the traces while accessing a network share, there are multiple CreateAndX requests (which opens the folders) with an FID associated with them. However, some of them don’t and they get a ...
1
vote
2answers
1k views

Wireshark only captures packets to or from this device

I use wireshark on ubuntu 14.04 and I am trying to sniff wifi traffic of other devices in my network. I run wireshark or tshark on wlan0, start capturing packets and send some pings or open some pages ...
-1
votes
1answer
46 views

Wireshark - Browser software

I just touched wireshark yesterday from my class. I was told to run wireshark while browsing www.kompas.com, and there is this question that is quite ambiguous. "What browser software shown in ...
0
votes
2answers
4k views

TCP Dup ACK/Retransmission, bad configuration?

I'm currently investigating network issues of a friends LAN (again). The Internet connectivity is very slow and unreliable and sometimes services simply don't work. I've monitored the traffic for ...
0
votes
3answers
2k views

How to find IP address of a DNS server

I'm a CS student and currently taking a (basic) course in information security. I was given an assignment which required me to analyse a given .pcap file using Wireshark and obtain information on the ...
0
votes
0answers
99 views

Wireshark capture SSL only

I would like to capture SSL or HTTPS traffic only in Wireshark, this is not something that can be filtered after due to the length of the time I would be recording the data after and the size of the ....
0
votes
1answer
422 views

wireshark monitor mode, decrypting capture

I have a network, which has 2 nodes (a phone, a MacBook) both are connected to same wireless network, I know the SSID and password for the wireless network password: mypassword ssid: myssid security: ...
0
votes
0answers
499 views

init-p01md.apple.com/bag - iMessage?

I have a question about Apple network traffic. In my network program I can see these three domains (GET) http://init-01md.apple.com/bag http://init.ess.apple.com/WebObjects/VCInit.woa/wa/getBag?ix=1 ...