Open-source network packet analyzer

learn more… | top users | synonyms

1
vote
2answers
590 views

Tracking Wireless Network Usage

How do you determine the overall bandwidth usage for each computer connected to a wireless network? I manage a small wireless network consisting of a couple of cheap Cisco/Linksys wifi routers. ...
1
vote
3answers
426 views

Why do I have so many HTTP packets in Wireshark when I'm not doing anything?

Is it normal that I have huge amount of HTTP packets every second in Wireshark, even if I am not doing anything? I would like to analyse some packets related to one website in particular, but how can ...
1
vote
2answers
571 views

404 error - Finding what wasn't found with wireshark

I am using Wireshark to view my HTTP activity. When there is a 404 Not Found error returned, I can't find an easy way to determine what request could not found. Can anyone explain how to do this?
1
vote
2answers
2k views

How can I monitor the traffic on a single port?

I am developing a python messenger client but I feel this is more targeted to superuser than StackOverflow. My server application seems not to get the data sent from time to time, so I want to see ...
1
vote
2answers
121 views

Simple http traffic monitor (capture by process) [closed]

I know, questions like this have been asked a lot before. I have a big problem using Wireshark because of the following reasons: It is not able to trace down which process sent/received a packet ...
1
vote
3answers
1k views

SSL (imap) doesn't work from some machines - ssl handshake failure - how to narrow down further?

A few days ago our IMAP SSL (port 993) connections stopped working from our home network two Windows 7 PCs in our home network. Two other PCs, one with Windows XP, one also with Win7 professional ...
1
vote
1answer
350 views

wireshark cannot capture VM traffic

Here is my setup: A windows 7 laptop running as a host running VirtualBox Inside Virtualbox, I have a debian VM. The eth0 of the VM is created as a bridged device from the physical ethernet port on ...
1
vote
1answer
726 views

Unable to capture wifi traffic with wireshark

Even a few days ago everything was fine, but now simply I can't capture and see tcp, http, etc. wifi traffic but only the traffic for the protocols 802.11 and LLC. I used different wifi spots ...
1
vote
1answer
280 views

Wireshark traffice capture- one subnet to another subnet

My setup is a computer with wireshark connected to switch on LAN network. The subnet IP that the wireshark is on is .0.# . I would like to capture traffic between subnet IP of .0.# and .2.#. However ...
1
vote
1answer
557 views

Record multicast stream on multi-homed Linux host

I have what sounds like the simplest possible use case, and yet nothing is satisfactory. I have a multi-homed host and I would like to listen to multicasts on eth1, and shove all the payload (NOT ...
1
vote
3answers
2k views

Why does Wireshark show MAC addresses in the source\destination?

Every device on the my LAN should have IP's along with MAC addresses, and for most of the traffic Wireshark gets on me device, the source and destination columns shows IP addresses, but sometimes it ...
1
vote
1answer
224 views

Lightweight network packet capture solution for windows? [closed]

I'm looking for a lightweight packet capture solution for Windows. It needs to capture all packets on a physical network device and write them to a file (preferably .pcap, because that's easiest for ...
1
vote
3answers
6k views

Wireshark Not Displaying Packets From Other Network Devices, Even in Promisc Mode

System Setup: MacBook Air running Mountain Lion and connected wirelessly to a router. Wireshark installed and capturing packets (I have "capture all in promiscuous mode" checked) I filter out all ...
1
vote
1answer
4k views

How to set intel centrino advanced-n 6205 in “monitor mode” in Windows 7 (32bit) and Wireshark

I've just installed Wireshark on my laptop and can't see it's working in "monitor mode". Logically I'm not connected with my home network, do I have to be able to monitor my ipads traffic? WinPCAP ...
1
vote
1answer
2k views

Why can't Wireshark read packets from ping?

I have Wireshark started, then I ping an IP address. But Wireshark is not picking up any packet sending to or receiving (echoing) from the destination address. Why? Is ping "protected" from being ...
1
vote
2answers
253 views

WireShark: How do i use “Apply as filter”?

i'm seeing some packets in WireShark that i don't want to see: No problem, right-click on SSDP and click Apply as Filter ...and not Selected Except i've never been able to get the Appy as ...
1
vote
2answers
743 views

How to measure network traffic on a port

I am using fiddler to monitor what is going on. Though I cant see total traffic over time for a session. Any tools that can do that easily (If I could export the statistics to a spreadsheet from ...
1
vote
1answer
1k views

Multi language support in wireshark

Do we have multiple language support with Wireshark. We are using Windows Xp SP2 and Ubuntu Linux environment. Actually we have a plugin which is UDP based and we have a requirement to Analyse the ...
1
vote
1answer
101 views

Eavesdropping on a WPA2 (PSK) network

I’m trying to capture frames sent and / or received by other clients on my wireless (WPA2-PSK) network. I installed Wireshark, activated the promiscuous mode and set the decryption key, but I’m unable ...
1
vote
1answer
47 views

Looking for a tool to inspect HTTP data between a mobile phone and AV receiver

I am trying to dissect the protocol used by my AV receiver and its mobile app on my phone. Basically, I'd like to see all the GET/POST requests from the app on the phone and the responses from the ...
1
vote
1answer
1k views

Using Wireshark to decrypt tls encrypted file with private key

I have a packet encrypted with TLS in a .pcap file. I also have the private key in a .priv file. How can I decrypt the .pcap file using Wireshark? I tried going to edit -> preferences -> protocols -> ...
1
vote
1answer
145 views

Wireshark on OS X: I can configure my Airport channel, but how about bandwidth?

This is what I currently do to capture 802.11 packets with Wireshark on my Macbook Pro From my AP, I set the channel to 40 and channel bandwidth to 20MHz. From Terminal, I set the Airport channel ...
1
vote
1answer
464 views

Error in installing compiled wireshark 1.10.2 on Kali 1.0

I've downloaded source code of Wireshark 1.10.2 from it offical website and compile it by following commands: ./configure make make install It was compiled and installed successfully, but when I've ...
1
vote
1answer
113 views

How can I find the modulation schemes used for the packet transmission using wireshark?

I am using wireshark to find the modulation schemes and the type of packets captured for 802.11ac. How can I find the modulation schemes used for the packet transmission? Preferably using wireshark? ...
1
vote
2answers
728 views

FTP disconnects after entering passive mode b/c packets are lost

For some reason, no matter how many times I try, after a client sends the PASV command (which is correctly received by the server), the server's reply (227 Entering Passive Mode) doesn't get back to ...
1
vote
1answer
125 views

How can I filter incoming packets to my application?

I have only little experience with Wireshark. The problem is that when my server (3rd party app) receives a faulty packets, it crashes. I would need to filter the incoming packets and filter out such ...
1
vote
1answer
146 views

Browser communication to a webserver and the OSI model

If I use google chrome (on a windows 7 machine) to access https://www.google.com, can someone tell me where the involved pieces fit into the OSI model? I would also like to know If I use ...
1
vote
2answers
1k views

Wireshark - Help seeing all network traffic

I have a Ralink RT3290 802.11bgn Wi-Fi Adapter and am running Windows 8. Sadly although my new computer helps in the design and testing of my touch based applications, my Network Engineering abilities ...
1
vote
1answer
108 views

Capture internal ports

Is there any way to capture packets all through internal ports for ex: A packets from 192.168.2.79 4000 to 192.168.2.79 4001 In this case its a TCP connection and the packets will not flow out ...
1
vote
1answer
102 views

How to differentiate between three different flavours of pcap files?

There appears to be 3 different file formats associated with the ".pcap" extension -- libpcap /w microsecond timestamps, libpcap /w nanosecond timestamps, and pcapng. Is there an easy way to ...
1
vote
1answer
678 views

How to enable the TCP checksum validation in Tshark(Terminal WireShark)

When I run the command tshark -i 3 -c 100 -V less 1514 src 192.168.10.57 and dst 192.168.10.60 and tcp The output is: Transmission Control Protocol, Src Port: commplex-link (5001), Dst Port: ...
1
vote
3answers
2k views

Installing WinPcap on Windows 8

I know there has been lots of discussion already on installing WinPcap on Windows 8. I'm running the RTM version. I was able to install WinPcap without a hitch by using the Windows 7 compatibility ...
1
vote
3answers
572 views

Capture/Peek WiFi data traffic?

My goal: I want to analyze the network protocols of a wireless device on my net. I've successfully set my linux laptop into monitor and promiscuous mode for its wifi interface. I used airmon-ng to ...
1
vote
1answer
267 views

How to enter pcap filter in Wireshark 1.8?

Previously in capture options window there was a very handy input field for pcap filter expression. But in 1.8.* this window looks different: So, how to set pcap filter expression before starting ...
1
vote
1answer
2k views

Windows 7 PC sends a lot of NetBIOS Name Queries for non-existent computer names

I have a Windows 7 PC, and have been monitoring network traffic using Wireshark, and I'm seeing this PC send out a lot of NetBIOS Name Queries for non-existent computer names. These are some of the ...
1
vote
1answer
1k views

Trying convert webserver certificate to PEM file for wireshark to monitor ssl traffic in HTTP format

I am trying to monitor https traffic as readable HTML. I have downloaded the certificate from the server. "In Internet Explorer, I selected the certificate and copy to file, DER encoded binary X.509 ...
1
vote
3answers
262 views

Malware - Technical anlaysis

Note: Please do not mod down or close. Im not a stupid PC user asking to fix my pc problem. I am intrigued and am having a deep technical look at whats going on. I have come across a Windows XP ...
1
vote
2answers
43 views

Can't install wireshark on Debian Linux

I'm trying to install Wireshark on Debian (Debian 3.2.51-1) but i'm getting this error: apt-get install wireshark Reading package lists... Done Building dependency tree Reading state ...
1
vote
2answers
228 views

Using Wireshark to track traffic on a Windows Virtual WiFi Miniport

I have a Microsoft Virtual WiFi Miniport set up on my laptop with an Android phone connected to it. The laptop is then connected to the outside world through a wired connection. I would like to ...
1
vote
2answers
272 views

Wireshark only capturing beacon frames

I am trying to sniff my own network to capture http traffic. On airodump my network security show "WPA - TKIP - PSK", so I went to Wireshark > Edit > Preferences > Protocols > IEEE 802.11 > Enabled ...
1
vote
3answers
51 views

Bandwidth monitoring grouped by domain/process

Under Windows platform, what is the simplest way to achieve bandwidth monitoring with the following grouping use cases: monitor all incoming/outgoing bandwidth grouped by domain/ip (http requests ...
1
vote
1answer
49 views

Combining two linux commands

Im trying to use mergecap to merge 15 old pcap files in a folder. I tried to use FILES=($(find /mnt/md0/capture/DCN/ -maxdepth 1 -type f -name "*.pcap" -print0 | xargs -0 ls -lt | tail -15 | awk ...
1
vote
0answers
65 views

mergecap fails to create output file when run from crontab

I have created a script to merge pcap files using 'mergecap -w '. The script doesn't work as the output file is not already present. So I tried to use 'touch outputfile.pcap' before the mergecap ...
1
vote
0answers
20 views

Utility service that logs total network usage

I would like to know the total bandwidth our internet provider essentially provides to the many competing devices in our home. Is there a simple windows service that uses a wireshark like trick to log ...
1
vote
1answer
141 views

What are “Difference” and “Delta” in Wireshark RTP Analysis?

I tried to find this in the documentation, but had no luck. I would love to dig the sources to find out, but I honestly don't have the time. I tried to google this, but either people do not get any ...
1
vote
1answer
111 views

Wireshark TLS communication shows green HTTP packets when using CCProxy proxy server?

Client <--> CCProxy <--> Server I have IE configured to use a proxy server for HTTP and Secure connections. I also have a proxy server is set up with CCProxy. It is my understanding that ...
1
vote
2answers
126 views

How to view other lan users packets via wireshark

It seems that I can only view my own packets, how to view other lan users packets via wireshark?
1
vote
1answer
1k views

Sniffing the Router for Packets

I have used WireShark software to sniff my Network Interface. What if i wanted to sniff the router that what other computers on the network are doing? Is there any way to do that? Computers are ...
1
vote
0answers
218 views

How to troubleshoot a VPN connection drop

I have a Windows 8 machine that won't connect to a work VPN (other machines configured the same* way work fine). The IT dept at work says the attempt never shows up in the logs. On my computer, it ...
1
vote
1answer
778 views

How to select all the “TCP segment of a reassembled PDU” frame in Wireshark?

Is there a filter in Wireshark to select all the "TCP segment of a reassembled PDU" packet?