Tagged Questions

Open-source network packet analyzer

learn more… | top users | synonyms

1
vote
2answers
190 views

How to view other lan users packets via wireshark

It seems that I can only view my own packets, how to view other lan users packets via wireshark?
0
votes
0answers
231 views

dnsmasq doesn't provide IP address to udhcpc

We have an embedded Linux device using udhcpc to get a DHCP IP address and a Wifi access point that provides it. Originally the WAP used udhcpc as well and this worked fine, but in order to add DNS ...
0
votes
0answers
107 views

How can cfosspeed udp broadcast or multicast?

I tried to figure how cfosspeed uses broadcast and multicast. I use wireshark with a couple of rules like udp.dstport == 889 and (eth.dst[0]&1) to no avail. In the incomming packets I don't see ...
1
vote
1answer
253 views

Wireshark on OS X: I can configure my Airport channel, but how about bandwidth?

This is what I currently do to capture 802.11 packets with Wireshark on my Macbook Pro From my AP, I set the channel to 40 and channel bandwidth to 20MHz. From Terminal, I set the Airport channel ...
2
votes
2answers
597 views

What's the difference between wlan.sa, wlan.ra, wlan.ta and wlan.da?

Tshark/wireshark (CLI) has several fields to display for WLAN, including these four (+ description from manual): wlan.sa: Source address wlan.ra: Receiver address wlan.ta: Transmitter address ...
0
votes
1answer
677 views

Which Wireshark settings to see connections from phone

I am trying to find out which URLs my phone is accessing when on a local WIFI network. My trials so far have been running an Ad-hoc network on my Laptop and sharing Internet through it (this works). ...
0
votes
1answer
235 views

What is the RSA SecurID packet format?

I am testing a client application that authenticates using RSA SecurID hardware tokens. The authentication is failing and I am not finding any useful information in the log files. I am using ...
0
votes
0answers
14 views

Monitoring traffice from an internet enabled printer [duplicate]

I have a WiFi internet enabled printer that can grab content from the web. I want to use something like Fiddler or Wireshark to view the traffic it's sending and receiving. Is possible? How would I go ...
7
votes
3answers
14k views

X11/XQuartz won't auto-launch after upgrading to OS X Mavericks?

I can't use Wireshark on latest OS X 10.9 Mavericks. Previously, I was using XQuartz to run X11 applications like Wireshark. But, yesterday, after I upgraded my iMac operating system to OS X 10.9, ...
0
votes
1answer
370 views

Firewall and Blocking [More] Traffic

I have a MacBook Pro with the firewall on. I'm trying to run a Wireshark trace and the noise bleeding through Apple's firewall is very distracting. According to the image below, most of this noise is ...
0
votes
0answers
188 views

Wireshark on CentOS does not start

I'm using CentOS 6.4 64bit. When I run wireshark i get the following error: No protocol specified (wireshark:3620): Gtk-WARNING **: cannot open display: :0.0 It has come to my attention ...
0
votes
1answer
344 views

Why doesn't Wireshark capture management frames in promiscuous mode?

I am working with Wireshark in promiscuous mode, which is normally used to allow Wireshark to capture all the frames in the connected network. The problem is that Wireshark in this mode doesn't ...
1
vote
1answer
3k views

Sniffing the Router for Packets

I have used WireShark software to sniff my Network Interface. What if i wanted to sniff the router that what other computers on the network are doing? Is there any way to do that? Computers are ...
3
votes
2answers
336 views

Filter packets sent via HTTP to a port other then 80?

I have a database communicating on port 7474 via HTTP (sigh), and I want to debug the queries sent to / from it. However, a filter such as http.request.method == "POST" Filters out every post ...
1
vote
1answer
1k views

Unable to capture wifi traffic with wireshark

Even a few days ago everything was fine, but now simply I can't capture and see tcp, http, etc. wifi traffic but only the traffic for the protocols 802.11 and LLC. I used different wifi spots ...
0
votes
2answers
290 views

Why am I getting arp requests from local machine?

I'm connecting wireless network (provided by apartment, so possibly quite a lot of machines connect to it) and I noticed that ARP requests from local machines send to my machine instead broadcast ...
1
vote
1answer
456 views

Wireshark traffice capture- one subnet to another subnet

My setup is a computer with wireshark connected to switch on LAN network. The subnet IP that the wireshark is on is .0.# . I would like to capture traffic between subnet IP of .0.# and .2.#. However ...
1
vote
1answer
568 views

Error in installing compiled wireshark 1.10.2 on Kali 1.0

I've downloaded source code of Wireshark 1.10.2 from it offical website and compile it by following commands: ./configure make make install It was compiled and installed successfully, but when I've ...
1
vote
1answer
155 views

How can I find the modulation schemes used for the packet transmission using wireshark?

I am using wireshark to find the modulation schemes and the type of packets captured for 802.11ac. How can I find the modulation schemes used for the packet transmission? Preferably using wireshark? ...
1
vote
1answer
170 views

Find out what programs are heavily using the network

Currently, I have a process on my Windows 7 system which is saturating the incoming broadband internet connection (75Mbit/s) and almost completely saturating the 100Mbit network controller. I cannot ...
0
votes
1answer
611 views

See file size on wireshark when downloading

Is there a way to see the filesize of a file when starting a download through wireshark? I want to see the size of http downloads on wireshark when i start them but i cant find that information.
0
votes
1answer
74 views

SSTP VPN not encrypt packets?

I had installed SSTP VPN server (windows server 2012) and then tryied to check whether my traffic is encrypted or not. I had used wireshark and got strange result: packets to all servers, but my ...
1
vote
0answers
416 views

How to troubleshoot a VPN connection drop

I have a Windows 8 machine that won't connect to a work VPN (other machines configured the same* way work fine). The IT dept at work says the attempt never shows up in the logs. On my computer, it ...
1
vote
1answer
1k views

How to select all the “TCP segment of a reassembled PDU” frame in Wireshark?

Is there a filter in Wireshark to select all the "TCP segment of a reassembled PDU" packet?
0
votes
2answers
94 views

Is it possible to find which ip is going to a website? [closed]

We have someone that keeps trying to connect to our email host and after a few attempts of trying to log in (incorrectly) we are then blocked. We then have to call and unblock. Less then having ...
0
votes
1answer
152 views

WireShark: Only buffer the last 10 000 packets

I am using WireShark to keep an eye on the traffic on two 10G ports, in real time. The problem is that there is so much traffic coming through the two ports that WireShark crashes within a minute. Is ...
0
votes
2answers
411 views

Capture raw internet traffic

I am sure that this has been asked before, but I can't find exactly what I am looking for. I am looking for a free *standalone* program that allows one to record all traffic between a computer (my ...
3
votes
1answer
1k views

Wireshark doesn't capture 802.11 data packets

Lately I have been trying to analyze wifi traffic over my own test router. I looked on the wireshark website on how to do this and setup my own testing network. my network: dd-wrt router with WPA2 ...
2
votes
1answer
3k views

Wireshark - How do i filter the TCP[RST] packet?

I am looking for filter out the TCP[RST] packets on wireshark. I have tried tcp.analysis.flag but it didn't help.
0
votes
1answer
226 views

Decrypting WPA with wireshark

Hi I want to decrypt my WPA packets which i gathered by sniffing with airodump-ng. The problem is that even after I have the 4-way handshake packets (they are correct) i don't know how to extract the ...
2
votes
1answer
624 views

Change TCP sequence numbers for packet replay?

First off, I'm using wireshark for capture and colasoft for replay. I'm attempting to replay a group of captured packets back, looped to be done several times over (the purpose of this is just to send ...
0
votes
1answer
1k views

Wireshark does not capture Packets dropped by Firewall

I'd try to find out if a device in my office tries to send packets under different circumstances. In one case I could see hundreds of packets sent by the specified client. In the other case (the ...
3
votes
2answers
833 views

usbmon (wireshark, tshark) for regular user

I have libpcap set up with the newest cvs version. Regular users can run Wireshark and tshark. Specifically, they have been added to the wireshark group and can capture from 1. eth0 2. br0 3. nflog ...
0
votes
1answer
528 views

Can't capture any telnet packets

I'm running a Telnet server and client on my Windows 7 computer. Meanwhile, I'm running Wireshark to try to sniff the telnet login. I have been unable to get Telnet to send any packets that can be ...
0
votes
1answer
1k views

Only shown problematic packets in WireShark

I am using WireShark to analyse millions of packets. Is there a filter which will only show those packets which have errors? By "error", I mean an IP error (e.g. incorrect IP header checksum), an TCP ...
0
votes
1answer
917 views

FTP server via SOCKS5 Proxy can only be LISTed with firefox, no ftp clients

I try to retrieve a folder from a FTP server which I connect to through a SOCKS5 proxy (ssh -D). When configuring Firefox (v20, v22) to use the SOCKS5 proxy I can without problems explore the ftp ...
1
vote
2answers
513 views

Why cocoa packet analyzer shows “capture packets to a trace file” menu?

I am trying to use 'cocoa packet analyzer'('C.P.A'). I uses mac OSX and I installed this from appstore. After installed this, when I launch this program a popup comes out. Others say that to get ...
1
vote
1answer
5k views

Wireshark on WPA2-PSK [AES] not decrypting

I am trying to capture all packets on my network from all devices connected to an SSID . I started up airmon-ng Started Monitoring on mon0 Changed Preferences in wireshark to 'enable decrytion' ...
0
votes
1answer
235 views

Why is ARP in Mac going crazy? How to disable it?

This is the first time I am observing the ARP request from my Mac is going crazy. It keeps sending the ARP request for last an hour. The requests are like following (using wireshark) 484975 ...
2
votes
1answer
105 views

LAN assembly 2 packets into 1 packets?

I have two computers A and B, there is a TCP connection between them. I use TCPdump to capture the packets. I notice that when A sends a lot of TCP packets to B, each IP packets are 1514 bytes. In ...
2
votes
1answer
3k views

How can I monitor traffic on my home network?

I have admin access to my D-Link DSL G604T router which controls one switch (and 2 computers) and three other computers. I want to monitor traffic on this router to find out who is downloading what / ...
1
vote
3answers
1k views

FTP disconnects after entering passive mode b/c packets are lost

For some reason, no matter how many times I try, after a client sends the PASV command (which is correctly received by the server), the server's reply (227 Entering Passive Mode) doesn't get back to ...
0
votes
2answers
27k views

Is it possible to track browsing history inside a wireless network

I'm using Internet, shared through wireless network. Now, is there any possibility to track me (i.e. my browsing history) from another computer of same network using "Wireshark" or other tracking ...
0
votes
1answer
293 views

How do I find the server program that a malware bot is trying to contact using wireshark?

I'm looking at a packet capture of some traffic of a malware infected computer, where do I begin to look in trying to find the server program that the malware bot is trying to contact?
0
votes
1answer
131 views

Hexadecimal Values Are Seemingly Backwards When Analyzing Packets Using Wireshark

Using Wireshark I am trying to debug an error that I am experiencing with one of my applications. I am having difficulty understanding how the packet contents are being formatted and displayed in ...
0
votes
2answers
1k views

Capture TCP communication on a specific port using wireshark

Hi i have build a simple TCP server which listens on port 9999 and has an IP address 202.168.66.1 i have a TCP client which has the same ip address and connects to the server on the said port. Now ...
1
vote
1answer
140 views

How can I filter incoming packets to my application?

I have only little experience with Wireshark. The problem is that when my server (3rd party app) receives a faulty packets, it crashes. I would need to filter the incoming packets and filter out such ...
1
vote
0answers
211 views

What happens when Capturing USB Packets using Wireshark

I am trying to capture the packets sent by a Mouse to a host PC using Wireshark. Operating System - Ubuntu 12.04 Wireshark - 1.8.2 Problem 1.) Before I plug in the USB Mouse, when I start the ...
1
vote
1answer
264 views

Browser communication to a webserver and the OSI model

If I use google chrome (on a windows 7 machine) to access https://www.google.com, can someone tell me where the involved pieces fit into the OSI model? I would also like to know If I use ...
0
votes
1answer
377 views

How can I capture packets belonging to a certain process

I need to capture packets belonging to a program or process. I know Winshark, but it just displays network traffic in a mess (in my view). If one wants to get the packets of a given process, you must ...