Open-source network packet analyzer

learn more… | top users | synonyms

3
votes
1answer
973 views

Wireshark doesn't capture 802.11 data packets

Lately I have been trying to analyze wifi traffic over my own test router. I looked on the wireshark website on how to do this and setup my own testing network. my network: dd-wrt router with WPA2 ...
2
votes
1answer
2k views

Wireshark - How do i filter the TCP[RST] packet?

I am looking for filter out the TCP[RST] packets on wireshark. I have tried tcp.analysis.flag but it didn't help.
0
votes
1answer
191 views

Decrypting WPA with wireshark

Hi I want to decrypt my WPA packets which i gathered by sniffing with airodump-ng. The problem is that even after I have the 4-way handshake packets (they are correct) i don't know how to extract the ...
2
votes
1answer
456 views

Change TCP sequence numbers for packet replay?

First off, I'm using wireshark for capture and colasoft for replay. I'm attempting to replay a group of captured packets back, looped to be done several times over (the purpose of this is just to send ...
0
votes
1answer
844 views

Wireshark does not capture Packets dropped by Firewall

I'd try to find out if a device in my office tries to send packets under different circumstances. In one case I could see hundreds of packets sent by the specified client. In the other case (the ...
2
votes
2answers
564 views

usbmon (wireshark, tshark) for regular user

I have libpcap set up with the newest cvs version. Regular users can run Wireshark and tshark. Specifically, they have been added to the wireshark group and can capture from 1. eth0 2. br0 3. nflog ...
0
votes
1answer
367 views

Can't capture any telnet packets

I'm running a Telnet server and client on my Windows 7 computer. Meanwhile, I'm running Wireshark to try to sniff the telnet login. I have been unable to get Telnet to send any packets that can be ...
0
votes
1answer
716 views

Only shown problematic packets in WireShark

I am using WireShark to analyse millions of packets. Is there a filter which will only show those packets which have errors? By "error", I mean an IP error (e.g. incorrect IP header checksum), an TCP ...
0
votes
1answer
581 views

FTP server via SOCKS5 Proxy can only be LISTed with firefox, no ftp clients

I try to retrieve a folder from a FTP server which I connect to through a SOCKS5 proxy (ssh -D). When configuring Firefox (v20, v22) to use the SOCKS5 proxy I can without problems explore the ftp ...
1
vote
2answers
368 views

Why cocoa packet analyzer shows “capture packets to a trace file” menu?

I am trying to use 'cocoa packet analyzer'('C.P.A'). I uses mac OSX and I installed this from appstore. After installed this, when I launch this program a popup comes out. Others say that to get ...
1
vote
1answer
4k views

Wireshark on WPA2-PSK [AES] not decrypting

I am trying to capture all packets on my network from all devices connected to an SSID . I started up airmon-ng Started Monitoring on mon0 Changed Preferences in wireshark to 'enable decrytion' ...
0
votes
1answer
185 views

Why is ARP in Mac going crazy? How to disable it?

This is the first time I am observing the ARP request from my Mac is going crazy. It keeps sending the ARP request for last an hour. The requests are like following (using wireshark) 484975 ...
2
votes
1answer
93 views

LAN assembly 2 packets into 1 packets?

I have two computers A and B, there is a TCP connection between them. I use TCPdump to capture the packets. I notice that when A sends a lot of TCP packets to B, each IP packets are 1514 bytes. In ...
2
votes
1answer
2k views

How can I monitor traffic on my home network?

I have admin access to my D-Link DSL G604T router which controls one switch (and 2 computers) and three other computers. I want to monitor traffic on this router to find out who is downloading what / ...
1
vote
2answers
728 views

FTP disconnects after entering passive mode b/c packets are lost

For some reason, no matter how many times I try, after a client sends the PASV command (which is correctly received by the server), the server's reply (227 Entering Passive Mode) doesn't get back to ...
0
votes
2answers
17k views

Is it possible to track browsing history inside a wireless network

I'm using Internet, shared through wireless network. Now, is there any possibility to track me (i.e. my browsing history) from another computer of same network using "Wireshark" or other tracking ...
0
votes
1answer
221 views

How do I find the server program that a malware bot is trying to contact using wireshark?

I'm looking at a packet capture of some traffic of a malware infected computer, where do I begin to look in trying to find the server program that the malware bot is trying to contact?
0
votes
1answer
113 views

Hexadecimal Values Are Seemingly Backwards When Analyzing Packets Using Wireshark

Using Wireshark I am trying to debug an error that I am experiencing with one of my applications. I am having difficulty understanding how the packet contents are being formatted and displayed in ...
0
votes
2answers
803 views

Capture TCP communication on a specific port using wireshark

Hi i have build a simple TCP server which listens on port 9999 and has an IP address 202.168.66.1 i have a TCP client which has the same ip address and connects to the server on the said port. Now ...
1
vote
1answer
125 views

How can I filter incoming packets to my application?

I have only little experience with Wireshark. The problem is that when my server (3rd party app) receives a faulty packets, it crashes. I would need to filter the incoming packets and filter out such ...
1
vote
0answers
164 views

What happens when Capturing USB Packets using Wireshark

I am trying to capture the packets sent by a Mouse to a host PC using Wireshark. Operating System - Ubuntu 12.04 Wireshark - 1.8.2 Problem 1.) Before I plug in the USB Mouse, when I start the ...
1
vote
1answer
145 views

Browser communication to a webserver and the OSI model

If I use google chrome (on a windows 7 machine) to access https://www.google.com, can someone tell me where the involved pieces fit into the OSI model? I would also like to know If I use ...
0
votes
1answer
295 views

How can I capture packets belonging to a certain process

I need to capture packets belonging to a program or process. I know Winshark, but it just displays network traffic in a mess (in my view). If one wants to get the packets of a given process, you must ...
0
votes
1answer
316 views

dig OK but dig @192.168.1.1 NOT

why dig works OK, but dig my NetGear router directly doesn't (while first goes to it too, because it is my DNS, NetGear itself has 8.8.8.8 set as prim dns). My NetGear has IP 192.168.1.1 on LAN. Here ...
0
votes
1answer
531 views

Scapy: TCP Retransmission error

I've been using Scapy to send SCCP or Skinny packets to my Cisco Desk Phone. However I keep getting these TCP Retransmission errors, and I believe this is causing the Cisco Phone to not respond. I ...
0
votes
1answer
758 views

Why Wireshark is not showing high layer packets like ICMP/IP/UDP? (Only broadcast packets are shown)

I am using Wireshark for 802.11g sniffing. The AP is not using any encryption. These are my observations: The vast majority packets are beacons and the probe requests. If I filter out beacons using ...
0
votes
1answer
1k views

vlc part of desktop streaming to <host>:<port>

With VLC, I wish to stream a portion of the desktop and send it to another host on my local area network. The capture seems to work, I see a correct portion of the desktop into the VLC server, but ...
1
vote
0answers
27 views

How to identify which network interface is my application using [duplicate]

I hoped to capture network traffic -using Wireshark- via a port on which my application is running. However when I fired up Wireshark, it listed 4 network interfaces not just 1 as I expected. So I ...
2
votes
1answer
2k views

wireshark: how to capture traffic between guest and host OS?

I'm trying to set up a lab to demonstrate ipv6 attack and detection mechanism on my Macbook. This is my set up with virtualbox: Host OS: OS X 10.8.2 IPv6 automatically, wireless connection Geust OS: ...
0
votes
1answer
289 views

wireshark makes network working

Have a number of boards with ethernet on it. Some boards have hardware bug. When pinging such boards, not always got answers. But when running wireshark capture mode, have stable network exchange ...
0
votes
2answers
267 views

Tshark and proper filter

Using Tshark, I would like to apply filter on a wireless sniffer capture such that (both a & b are satisfied) a) 802.11 beacons are present b) Packets belonging to a certain wireless MAC address ...
3
votes
0answers
343 views

Capturing Internet Connection Sharing (ICS) traffic using Fiddler

Does anyone have any idea how to capture HTTP traffic that goes through my ICS connection? Full details: I have a PC connected to internet via Ethernet. PC has set up a Wifi Hotspot using Internet ...
1
vote
1answer
556 views

Record multicast stream on multi-homed Linux host

I have what sounds like the simplest possible use case, and yet nothing is satisfactory. I have a multi-homed host and I would like to listen to multicasts on eth1, and shove all the payload (NOT ...
1
vote
2answers
1k views

Wireshark - Help seeing all network traffic

I have a Ralink RT3290 802.11bgn Wi-Fi Adapter and am running Windows 8. Sadly although my new computer helps in the design and testing of my touch based applications, my Network Engineering abilities ...
0
votes
2answers
424 views

Sniffing network traffic these days

I've been always worrying about using HTTPS in all sites and using secure connections in Messenger, Email, etc, because I don't want people being able to read my private info or hacking my sessions on ...
2
votes
1answer
143 views

Follow a .pcap file in wireshark like tail -f

I have a .pcap file on my android device, that I can access from my PC with wireshark via smb and wondering if it possible to get a 'Live view' of that file in wireshark. Is there any solution?
2
votes
0answers
785 views

tcp port numbers reused on wireshark

I used raw socket to build a tcp client program on machine A to reproduce tcp 3-way handshake with a simple regular tcp server on machine B I captured packets on the client host and server host, and ...
0
votes
1answer
528 views

display and save only packet captured by filter

how can I let wireshark display only packets that are captured by a filter I don't want to have all packets, this takes a large memory space ?
0
votes
0answers
270 views

Analyzing home network traffic using wireshark

I am using wireshark to analyize my home netowrk traffic since it has become painfully slow (Slow download speeds) recently (restarting modem and MediaLink router didn't help, also upgraded the ...
1
vote
3answers
757 views

RS232 / Ethernet Port Servers - Protocols Involved?

Firstly, I'm not responsible for the equipment, so don't panic that I'm asking such basic questions :) At work we have multiple RS232 / Ethernet port servers (Say the 16 port version of this ...
0
votes
0answers
140 views

Traffic of virtual machine capture in ubuntu 12

I have ubuntu 12 running on my PC . On this Ubuntu, I have another linux distribution running on a virtual machine (virtual box). When I launch a ping from ubuntu to the virtual machine, the ping ...
0
votes
1answer
153 views

why does Wireshark on Mac OS X runs on X11?

I know little bit about X11 and i have used it for remotely interacting with my applications on my Linux machine. But I don't understand why running Wireshark locally will start an X11 process?
1
vote
3answers
2k views

Why does Wireshark show MAC addresses in the source\destination?

Every device on the my LAN should have IP's along with MAC addresses, and for most of the traffic Wireshark gets on me device, the source and destination columns shows IP addresses, but sometimes it ...
0
votes
0answers
332 views

Synergy choppiness: Is my wireless router delaying packets after silent period?

I am sharing keyboard and mouse between my Linux desktop and MacBook Air using Synergy. There is a very noticeable lag every time I begin moving my mouse (or start typing), but everything becomes ...
1
vote
1answer
224 views

Lightweight network packet capture solution for windows? [closed]

I'm looking for a lightweight packet capture solution for Windows. It needs to capture all packets on a physical network device and write them to a file (preferably .pcap, because that's easiest for ...
0
votes
0answers
221 views

DNS leak: Looking up own hostname with DNS queries

I was checking a proxied program for DNS leaks with tshark when I noticed this: 13.170066 10.0.2.15 -> 192.168.1.1 DNS 66 Standard query 0xd473 A [hostname] 13.753496 10.0.2.15 -> ...
0
votes
2answers
83 views

How to check the packets in wireshark while doing the internet

I am using Wireshark first time.Can we see the packet in wireshark while having the internet on the laptop(or PC). But I don't see any packet in wireshark.While I have internet connection. Please ...
0
votes
1answer
442 views

change Wireshark file (pcap file) via bittwiste (change ip)

i want to take pcap file and change all packet with specific ip to new ip and i know i can do it in this way: bittwiste.exe -I myFile.pcap -O newFile.pcap -T ip -s 192.0.16.50,61.68.133.207 ...
0
votes
2answers
560 views

Filter in Wireshark for TLS's Server Name Indication field

Does wireshark have a filter for TLS's Server Name Indication field?
0
votes
1answer
414 views

How do I capture 802.11 headers on an AP while not in monitor mode?

I am wondering if it is possible to extract 802.11 frames on a router running OpenWrt operating as an access point. I tried using tcpdump and loading the dumped packets in Wireshark, but I could only ...