The network protocol analyzer developed and maintained by the Wireshark Foundation

learn more… | top users | synonyms

2
votes
1answer
3k views

Sniffing the Router for Packets

I have used WireShark software to sniff my Network Interface. What if i wanted to sniff the router that what other computers on the network are doing? Is there any way to do that? Computers are ...
1
vote
1answer
186 views

Find out what programs are heavily using the network

Currently, I have a process on my Windows 7 system which is saturating the incoming broadband internet connection (75Mbit/s) and almost completely saturating the 100Mbit network controller. I cannot ...
1
vote
2answers
498 views

Is it possible to know which process opened a connection in Windows?

With netstat -a I can see all connections from my machine to the MySQL Server. There is any way too see which process or executable is responsible for each connection? The only solution I found so ...
1
vote
3answers
2k views

Wireshark can see outside of the virtual machine?

I'm running Windows in a VM inside of OSX. If I start Wireshark inside Windows, then a message from OSX pops up saying that Wireshark is trying to monitor all network traffic. If I accept, then ...
1
vote
2answers
1k views

Do machines connected to the same switch belong to the same subnet?

When we talk about a subnet - do we mean all the systems connected to the same switch? If I have an assigned IP address of 10.0.2.1, am I in the same subnet as that of 10.0.1.39? When we talk about ...
1
vote
2answers
6k views

What is the protocol 'ftp-data' identified by wireshark?

Just implementing a FTP server and use wireshark to analize the protocol. I find there is a protocol identified by wireshark FTP-DATA. What is that? Any document or RFC can be referred? Thanks and ...
1
vote
3answers
6k views

Decrypting SSL traffic in Wireshark. Only headers get decrypted

I'm trying to decrypt SSL traffic in Wireshark, and it partially works because I'm able to view the decrypted headers. The problem is that I don't see any of the packet contents, only their headers. ...
1
vote
2answers
1k views

Networking packet sniffer for Linux that captures the application names?

I tried Wireshark. It shows the source and destination IP address, port number, and packet contents, but nothing about which application is using the packets. Apparently tcpdump is similar; network ...
1
vote
3answers
397 views

Why would my network slow down?

The network at my work has about 40 computers on it and a quite a few printers. When there are a lot of people working the network will be slow. I can test the ping between my computer and the router ...
1
vote
3answers
3k views

Finding the external (PPPoE, WAN) MAC address of an ADSL router

My ISP is Orange Internet, I have recently ditched my crummy "livebox" and moved to a more stable BT Business Hub with the firmware flashed back to the original SingTel ROM. The thing works great ...
1
vote
1answer
1k views

How can I get the actual TCP sequence number in Wireshark?

In Wireshark, TCP sequence numbers are displayed as relative sequence numbers by default. How can I get the actual TCP sequence number?
1
vote
2answers
2k views

Show only HTTP traffic in Wireshark

How can I filter out traffic that is not HTTP in Wireshark, so that it shows me only HTTP traffic, but not, TCP, DNS, SSDP, etc.
1
vote
1answer
948 views

Using (embedding?) wireshark in a C application for sniffing [closed]

I'm writing a C/C++ application which needs (among other things) to sniff packets and save the output in a file. This file will be read and processed by wireshark after a few days, using a LUA script ...
1
vote
1answer
76 views

Why am I not seeing ARP requests from my own machine in wireshark?

I am using Windows 7. I open up Wireshark and start a live capture with the filter: ip.src == THIS.IS.MY.IP I then go to a command line and do an arp -d * and ping a bunch of stuff. I see my ICMP ...
1
vote
2answers
186 views

Wireshark filtering for one network

How do i make Wireshark filter results so it just shows results from one wifi net work. I have had a look on Google but found nothing. Can any one help.
1
vote
1answer
912 views

Record multicast stream on multi-homed Linux host

I have what sounds like the simplest possible use case, and yet nothing is satisfactory. I have a multi-homed host and I would like to listen to multicasts on eth1, and shove all the payload (NOT ...
1
vote
3answers
1k views

RS232 / Ethernet Port Servers - Protocols Involved?

Firstly, I'm not responsible for the equipment, so don't panic that I'm asking such basic questions :) At work we have multiple RS232 / Ethernet port servers (Say the 16 port version of this ...
1
vote
2answers
865 views

Tracking Wireless Network Usage

How do you determine the overall bandwidth usage for each computer connected to a wireless network? I manage a small wireless network consisting of a couple of cheap Cisco/Linksys wifi routers. ...
1
vote
3answers
487 views

Why do I have so many HTTP packets in Wireshark when I'm not doing anything?

Is it normal that I have huge amount of HTTP packets every second in Wireshark, even if I am not doing anything? I would like to analyse some packets related to one website in particular, but how can ...
1
vote
2answers
2k views

tcpdump - just packet data

When using tcpdump, how can I print just the packet data? For example (anonymized): sudo tcpdump -X 'tcp port 80 and (((ip[2:2] - ((ip[0]&0xf)<<2)) - ((tcp[12]&0xf0)>>2)) != 0)' ...
1
vote
2answers
718 views

404 error - Finding what wasn't found with wireshark

I am using Wireshark to view my HTTP activity. When there is a 404 Not Found error returned, I can't find an easy way to determine what request could not found. Can anyone explain how to do this?
1
vote
2answers
3k views

How can I monitor the traffic on a single port?

I am developing a python messenger client but I feel this is more targeted to superuser than StackOverflow. My server application seems not to get the data sent from time to time, so I want to see ...
1
vote
3answers
248 views

Wireshark and Playstation 3

I'm looking to capture all network traffic when playing my ps3 and find the external IP addresses of other players in my servers or game. I'm wondering if this is possible? If so how?
1
vote
1answer
39 views

Which HTTP Authentication used?

I need a way to find out which HTTP Auth mechanism is used for a particular website/web-server, which is responding to my HTTP request. I am open to use any browser, or any other tool (like ...
1
vote
1answer
72 views

Can Wireless Sniffers capture and read your data with and without being connected to the WLAN?

Can some neighbor with his laptop capture the wireless traffic packets which I send and receive from my router, if he is not connected to my WLAN? Can someone connected to my WLAN and without access ...
1
vote
2answers
169 views

How do capture filters in Wireshark work internally?

I am wondering exactly what happens internally in TShark when I use a capture filter. Specifically, let's say I have the following filter to capture multicast data: host 224.0.26.3 && port ...
1
vote
1answer
1k views

.exe file (specifically Wireshark) will not launch anymore on Windows 8.1

I use Wireshark x64 daily in my work. Suddenly today, it refuses to open. When I doubleclick a pcap (or pcapng) file, Windows tells me the file I tried to click was not found. When I try to start ...
1
vote
2answers
540 views

Simple http traffic monitor (capture by process) [closed]

I know, questions like this have been asked a lot before. I have a big problem using Wireshark because of the following reasons: It is not able to trace down which process sent/received a packet ...
1
vote
2answers
387 views

Wireshark, Find Protocol Layers

I'm using Wireshark to analyze network traffic. I'm a bit confused by what's displayed under the "Protocol" column. If I'm not mistaken, DNS and HTTP are Application layer protocols while TCP is ...
1
vote
3answers
3k views

SSL (imap) doesn't work from some machines - ssl handshake failure - how to narrow down further?

A few days ago our IMAP SSL (port 993) connections stopped working from our home network two Windows 7 PCs in our home network. Two other PCs, one with Windows XP, one also with Win7 professional ...
1
vote
1answer
1k views

wireshark cannot capture VM traffic

Here is my setup: A windows 7 laptop running as a host running VirtualBox Inside Virtualbox, I have a debian VM. The eth0 of the VM is created as a bridged device from the physical ethernet port on ...
1
vote
1answer
2k views

Unable to capture wifi traffic with wireshark

Even a few days ago everything was fine, but now simply I can't capture and see tcp, http, etc. wifi traffic but only the traffic for the protocols 802.11 and LLC. I used different wifi spots ...
1
vote
1answer
591 views

Wireshark traffice capture- one subnet to another subnet

My setup is a computer with wireshark connected to switch on LAN network. The subnet IP that the wireshark is on is .0.# . I would like to capture traffic between subnet IP of .0.# and .2.#. However ...
1
vote
3answers
2k views

FTP disconnects after entering passive mode b/c packets are lost

For some reason, no matter how many times I try, after a client sends the PASV command (which is correctly received by the server), the server's reply (227 Entering Passive Mode) doesn't get back to ...
1
vote
3answers
5k views

Why does Wireshark show MAC addresses in the source\destination?

Every device on the my LAN should have IP's along with MAC addresses, and for most of the traffic Wireshark gets on me device, the source and destination columns shows IP addresses, but sometimes it ...
1
vote
1answer
325 views

Lightweight network packet capture solution for windows? [closed]

I'm looking for a lightweight packet capture solution for Windows. It needs to capture all packets on a physical network device and write them to a file (preferably .pcap, because that's easiest for ...
1
vote
4answers
3k views

Installing WinPcap on Windows 8

I know there has been lots of discussion already on installing WinPcap on Windows 8. I'm running the RTM version. I was able to install WinPcap without a hitch by using the Windows 7 compatibility ...
1
vote
1answer
5k views

How to set intel centrino advanced-n 6205 in “monitor mode” in Windows 7 (32bit) and Wireshark

I've just installed Wireshark on my laptop and can't see it's working in "monitor mode". Logically I'm not connected with my home network, do I have to be able to monitor my ipads traffic? WinPCAP ...
1
vote
1answer
3k views

Why can't Wireshark read packets from ping?

I have Wireshark started, then I ping an IP address. But Wireshark is not picking up any packet sending to or receiving (echoing) from the destination address. Why? Is ping "protected" from being ...
1
vote
2answers
331 views

WireShark: How do i use “Apply as filter”?

i'm seeing some packets in WireShark that i don't want to see: No problem, right-click on SSDP and click Apply as Filter ...and not Selected Except i've never been able to get the Appy as ...
1
vote
1answer
4k views

How to find HTTP GETs in Wireshark

How can I use the filter in Wireshark to find only those lines that have HTTP GET in them?
1
vote
2answers
818 views

How to measure network traffic on a port

I am using fiddler to monitor what is going on. Though I cant see total traffic over time for a session. Any tools that can do that easily (If I could export the statistics to a spreadsheet from ...
1
vote
1answer
2k views

Multi language support in wireshark

Do we have multiple language support with Wireshark. We are using Windows Xp SP2 and Ubuntu Linux environment. Actually we have a plugin which is UDP based and we have a requirement to Analyse the ...
1
vote
2answers
73 views

Wireshark only captures packets to or from this device

I use wireshark on ubuntu 14.04 and I am trying to sniff wifi traffic of other devices in my network. I run wireshark or tshark on wlan0, start capturing packets and send some pings or open some pages ...
1
vote
1answer
29 views

Filter all packages that not use a specific port

I use wireshark to watch a captured pcap file. I see a lot of communication on a specific port, that I am not interessted in, so i want to filter it to see only the rest of the communication. I used ...
1
vote
1answer
440 views

Provide Session Master Key to Wireshark UI?

I'm working on an issue with HTTPS. I suspect its related to client certificates. I want to read some of the encrypted handshake messages that follows the ServerHelloDone message. (Once the ...
1
vote
1answer
764 views

Promiscuous mode implies Monitor Mode compatibility?

I mean, I just want to put my wireless card interface into promiscuous mode to scan my wireless network I'm connected to. Do I necessarily need a monitor mode wifi card compatible? Should I ...
1
vote
2answers
2k views

Wireshark only capturing beacon frames

I am trying to sniff my own network to capture http traffic. On airodump my network security show "WPA - TKIP - PSK", so I went to Wireshark > Edit > Preferences > Protocols > IEEE 802.11 > Enabled ...
1
vote
1answer
74 views

Looking for a tool to inspect HTTP data between a mobile phone and AV receiver [closed]

I am trying to dissect the protocol used by my AV receiver and its mobile app on my phone. Basically, I'd like to see all the GET/POST requests from the app on the phone and the responses from the ...
1
vote
1answer
5k views

Using Wireshark to decrypt tls encrypted file with private key

I have a packet encrypted with TLS in a .pcap file. I also have the private key in a .priv file. How can I decrypt the .pcap file using Wireshark? I tried going to edit -> preferences -> protocols -> ...