Open-source network packet analyzer

learn more… | top users | synonyms

1
vote
3answers
377 views

Why would my network slow down?

The network at my work has about 40 computers on it and a quite a few printers. When there are a lot of people working the network will be slow. I can test the ping between my computer and the router ...
1
vote
3answers
3k views

Finding the external (PPPoE, WAN) MAC address of an ADSL router

My ISP is Orange Internet, I have recently ditched my crummy "livebox" and moved to a more stable BT Business Hub with the firmware flashed back to the original SingTel ROM. The thing works great ...
1
vote
1answer
268 views

How can I get the actual TCP sequence number in Wireshark?

In Wireshark, TCP sequence numbers are displayed as relative sequence numbers by default. How can I get the actual TCP sequence number?
1
vote
1answer
889 views

Using (embedding?) wireshark in a C application for sniffing [closed]

I'm writing a C/C++ application which needs (among other things) to sniff packets and save the output in a file. This file will be read and processed by wireshark after a few days, using a LUA script ...
1
vote
2answers
119 views

Wireshark filtering for one network

How do i make Wireshark filter results so it just shows results from one wifi net work. I have had a look on Google but found nothing. Can any one help.
1
vote
1answer
6k views

Wireshark on WPA2-PSK [AES] not decrypting

I am trying to capture all packets on my network from all devices connected to an SSID . I started up airmon-ng Started Monitoring on mon0 Changed Preferences in wireshark to 'enable decrytion' ...
1
vote
3answers
990 views

RS232 / Ethernet Port Servers - Protocols Involved?

Firstly, I'm not responsible for the equipment, so don't panic that I'm asking such basic questions :) At work we have multiple RS232 / Ethernet port servers (Say the 16 port version of this ...
1
vote
2answers
755 views

Tracking Wireless Network Usage

How do you determine the overall bandwidth usage for each computer connected to a wireless network? I manage a small wireless network consisting of a couple of cheap Cisco/Linksys wifi routers. ...
1
vote
3answers
456 views

Why do I have so many HTTP packets in Wireshark when I'm not doing anything?

Is it normal that I have huge amount of HTTP packets every second in Wireshark, even if I am not doing anything? I would like to analyse some packets related to one website in particular, but how can ...
1
vote
2answers
643 views

404 error - Finding what wasn't found with wireshark

I am using Wireshark to view my HTTP activity. When there is a 404 Not Found error returned, I can't find an easy way to determine what request could not found. Can anyone explain how to do this?
1
vote
2answers
2k views

How can I monitor the traffic on a single port?

I am developing a python messenger client but I feel this is more targeted to superuser than StackOverflow. My server application seems not to get the data sent from time to time, so I want to see ...
1
vote
3answers
54 views

Wireshark and Playstation 3

I'm looking to capture all network traffic when playing my ps3 and find the external IP addresses of other players in my servers or game. I'm wondering if this is possible? If so how?
1
vote
1answer
22 views

Which HTTP Authentication used?

I need a way to find out which HTTP Auth mechanism is used for a particular website/web-server, which is responding to my HTTP request. I am open to use any browser, or any other tool (like ...
1
vote
1answer
52 views

Can Wireless Sniffers capture and read your data with and without being connected to the WLAN?

Can some neighbor with his laptop capture the wireless traffic packets which I send and receive from my router, if he is not connected to my WLAN? Can someone connected to my WLAN and without access ...
1
vote
2answers
98 views

How do capture filters in Wireshark work internally?

I am wondering exactly what happens internally in TShark when I use a capture filter. Specifically, let's say I have the following filter to capture multicast data: host 224.0.26.3 && port ...
1
vote
2answers
387 views

Simple http traffic monitor (capture by process) [closed]

I know, questions like this have been asked a lot before. I have a big problem using Wireshark because of the following reasons: It is not able to trace down which process sent/received a packet ...
1
vote
3answers
2k views

SSL (imap) doesn't work from some machines - ssl handshake failure - how to narrow down further?

A few days ago our IMAP SSL (port 993) connections stopped working from our home network two Windows 7 PCs in our home network. Two other PCs, one with Windows XP, one also with Win7 professional ...
1
vote
1answer
879 views

wireshark cannot capture VM traffic

Here is my setup: A windows 7 laptop running as a host running VirtualBox Inside Virtualbox, I have a debian VM. The eth0 of the VM is created as a bridged device from the physical ethernet port on ...
1
vote
1answer
1k views

Unable to capture wifi traffic with wireshark

Even a few days ago everything was fine, but now simply I can't capture and see tcp, http, etc. wifi traffic but only the traffic for the protocols 802.11 and LLC. I used different wifi spots ...
1
vote
1answer
477 views

Wireshark traffice capture- one subnet to another subnet

My setup is a computer with wireshark connected to switch on LAN network. The subnet IP that the wireshark is on is .0.# . I would like to capture traffic between subnet IP of .0.# and .2.#. However ...
1
vote
3answers
1k views

FTP disconnects after entering passive mode b/c packets are lost

For some reason, no matter how many times I try, after a client sends the PASV command (which is correctly received by the server), the server's reply (227 Entering Passive Mode) doesn't get back to ...
1
vote
1answer
749 views

Record multicast stream on multi-homed Linux host

I have what sounds like the simplest possible use case, and yet nothing is satisfactory. I have a multi-homed host and I would like to listen to multicasts on eth1, and shove all the payload (NOT ...
1
vote
3answers
4k views

Why does Wireshark show MAC addresses in the source\destination?

Every device on the my LAN should have IP's along with MAC addresses, and for most of the traffic Wireshark gets on me device, the source and destination columns shows IP addresses, but sometimes it ...
1
vote
1answer
287 views

Lightweight network packet capture solution for windows? [closed]

I'm looking for a lightweight packet capture solution for Windows. It needs to capture all packets on a physical network device and write them to a file (preferably .pcap, because that's easiest for ...
1
vote
1answer
4k views

How to set intel centrino advanced-n 6205 in “monitor mode” in Windows 7 (32bit) and Wireshark

I've just installed Wireshark on my laptop and can't see it's working in "monitor mode". Logically I'm not connected with my home network, do I have to be able to monitor my ipads traffic? WinPCAP ...
1
vote
1answer
3k views

Why can't Wireshark read packets from ping?

I have Wireshark started, then I ping an IP address. But Wireshark is not picking up any packet sending to or receiving (echoing) from the destination address. Why? Is ping "protected" from being ...
1
vote
2answers
295 views

WireShark: How do i use “Apply as filter”?

i'm seeing some packets in WireShark that i don't want to see: No problem, right-click on SSDP and click Apply as Filter ...and not Selected Except i've never been able to get the Appy as ...
1
vote
1answer
3k views

How to find HTTP GETs in Wireshark

How can I use the filter in Wireshark to find only those lines that have HTTP GET in them?
1
vote
2answers
782 views

How to measure network traffic on a port

I am using fiddler to monitor what is going on. Though I cant see total traffic over time for a session. Any tools that can do that easily (If I could export the statistics to a spreadsheet from ...
1
vote
1answer
1k views

Multi language support in wireshark

Do we have multiple language support with Wireshark. We are using Windows Xp SP2 and Ubuntu Linux environment. Actually we have a plugin which is UDP based and we have a requirement to Analyse the ...
1
vote
1answer
196 views

Provide Session Master Key to Wireshark UI?

I'm working on an issue with HTTPS. I suspect its related to client certificates. I want to read some of the encrypted handshake messages that follows the ServerHelloDone message. (Once the ...
1
vote
1answer
1k views

.exe file (specifically Wireshark) will not launch anymore on Windows 8.1

I use Wireshark x64 daily in my work. Suddenly today, it refuses to open. When I doubleclick a pcap (or pcapng) file, Windows tells me the file I tried to click was not found. When I try to start ...
1
vote
1answer
154 views

Eavesdropping on a WPA2 (PSK) network

I’m trying to capture frames sent and / or received by other clients on my wireless (WPA2-PSK) network. I installed Wireshark, activated the promiscuous mode and set the decryption key, but I’m unable ...
1
vote
1answer
61 views

Looking for a tool to inspect HTTP data between a mobile phone and AV receiver

I am trying to dissect the protocol used by my AV receiver and its mobile app on my phone. Basically, I'd like to see all the GET/POST requests from the app on the phone and the responses from the ...
1
vote
1answer
4k views

Using Wireshark to decrypt tls encrypted file with private key

I have a packet encrypted with TLS in a .pcap file. I also have the private key in a .priv file. How can I decrypt the .pcap file using Wireshark? I tried going to edit -> preferences -> protocols -> ...
1
vote
1answer
269 views

Wireshark on OS X: I can configure my Airport channel, but how about bandwidth?

This is what I currently do to capture 802.11 packets with Wireshark on my Macbook Pro From my AP, I set the channel to 40 and channel bandwidth to 20MHz. From Terminal, I set the Airport channel ...
1
vote
1answer
587 views

Error in installing compiled wireshark 1.10.2 on Kali 1.0

I've downloaded source code of Wireshark 1.10.2 from it offical website and compile it by following commands: ./configure make make install It was compiled and installed successfully, but when I've ...
1
vote
1answer
169 views

How can I find the modulation schemes used for the packet transmission using wireshark?

I am using wireshark to find the modulation schemes and the type of packets captured for 802.11ac. How can I find the modulation schemes used for the packet transmission? Preferably using wireshark? ...
1
vote
1answer
149 views

How can I filter incoming packets to my application?

I have only little experience with Wireshark. The problem is that when my server (3rd party app) receives a faulty packets, it crashes. I would need to filter the incoming packets and filter out such ...
1
vote
1answer
290 views

Browser communication to a webserver and the OSI model

If I use google chrome (on a windows 7 machine) to access https://www.google.com, can someone tell me where the involved pieces fit into the OSI model? I would also like to know If I use ...
1
vote
2answers
1k views

Wireshark - Help seeing all network traffic

I have a Ralink RT3290 802.11bgn Wi-Fi Adapter and am running Windows 8. Sadly although my new computer helps in the design and testing of my touch based applications, my Network Engineering abilities ...
1
vote
1answer
126 views

Capture internal ports

Is there any way to capture packets all through internal ports for ex: A packets from 192.168.2.79 4000 to 192.168.2.79 4001 In this case its a TCP connection and the packets will not flow out ...
1
vote
1answer
131 views

How to differentiate between three different flavours of pcap files?

There appears to be 3 different file formats associated with the ".pcap" extension -- libpcap /w microsecond timestamps, libpcap /w nanosecond timestamps, and pcapng. Is there an easy way to ...
1
vote
1answer
981 views

How to enable the TCP checksum validation in Tshark(Terminal WireShark)

When I run the command tshark -i 3 -c 100 -V less 1514 src 192.168.10.57 and dst 192.168.10.60 and tcp The output is: Transmission Control Protocol, Src Port: commplex-link (5001), Dst Port: ...
1
vote
3answers
2k views

Installing WinPcap on Windows 8

I know there has been lots of discussion already on installing WinPcap on Windows 8. I'm running the RTM version. I was able to install WinPcap without a hitch by using the Windows 7 compatibility ...
1
vote
3answers
728 views

Capture/Peek WiFi data traffic?

My goal: I want to analyze the network protocols of a wireless device on my net. I've successfully set my linux laptop into monitor and promiscuous mode for its wifi interface. I used airmon-ng to ...
1
vote
1answer
284 views

How to enter pcap filter in Wireshark 1.8?

Previously in capture options window there was a very handy input field for pcap filter expression. But in 1.8.* this window looks different: So, how to set pcap filter expression before starting ...
1
vote
1answer
3k views

Windows 7 PC sends a lot of NetBIOS Name Queries for non-existent computer names

I have a Windows 7 PC, and have been monitoring network traffic using Wireshark, and I'm seeing this PC send out a lot of NetBIOS Name Queries for non-existent computer names. These are some of the ...
1
vote
1answer
1k views

Trying convert webserver certificate to PEM file for wireshark to monitor ssl traffic in HTTP format

I am trying to monitor https traffic as readable HTML. I have downloaded the certificate from the server. "In Internet Explorer, I selected the certificate and copy to file, DER encoded binary X.509 ...
1
vote
3answers
264 views

Malware - Technical anlaysis

Note: Please do not mod down or close. Im not a stupid PC user asking to fix my pc problem. I am intrigued and am having a deep technical look at whats going on. I have come across a Windows XP ...