The network protocol analyzer developed and maintained by the Wireshark Foundation

learn more… | top users | synonyms

2
votes
1answer
436 views

Forwarding wifi traffic to wired pc

I'm trying to play around with Wireshark on my home network, and was wondering if there is a way to create a new connection on my PC that receives all wifi packets on the network. The PC is a wired ...
2
votes
1answer
849 views

Excessive “name query” and “standard query” activity on Wireshark?

I started using Wireshark on some class at university and decided to look at my home wireless network with it, just out of curiosity. But now I'm noticing excessive activity to what it looks like a ...
2
votes
1answer
2k views

How do I un-gzip data captured by Wireshark?

I have a Wireshark capture file with a HTTP request, however, the request is gzipped. My question is how can I ungzip it so see what data was transfered in cleartext? The capture file is here if ...
2
votes
1answer
56 views

router automatically disables wifi and enables after 2-3min

Router: Netgear DGN2200v2 Problem: THe router disables the wifi network automatically(with no human interference what so ever), thus all pc's disconnect and have no network access(as if the router ...
2
votes
1answer
358 views

Why does a radio stream not appear on a packet monitoring tool?

I am currently trying to find the URL to the audio stream for a webradio that only provides a flash player, that I would like to use with MusicBee's radio player. After using Wireshark to monitor my ...
2
votes
1answer
2k views

How to use Charles as proxy to decrypt HTTPS messages in Wireshark?

I know I can view decrypted HTTPS data directly in Charles. But I want to view lower level SSL messages in Wireshark. So I setup Charles as the SSL proxy, using my own certificate, and I setup SSL ...
2
votes
1answer
86 views

Explanation of port protocols in Wireshark?

When using Wireshark you can display the packets with just the plain number of the port, or with a "transport layer name resolution" (via the View/Name Resolution menu, for example). Unfortunately, ...
2
votes
2answers
5k views

Wireshark only capturing beacon frames

I am trying to sniff my own network to capture http traffic. On airodump my network security show "WPA - TKIP - PSK", so I went to Wireshark > Edit > Preferences > Protocols > IEEE 802.11 > Enabled ...
2
votes
1answer
5k views

Sniffing the Router for Packets

I have used WireShark software to sniff my Network Interface. What if i wanted to sniff the router that what other computers on the network are doing? Is there any way to do that? Computers are ...
2
votes
1answer
3k views

How can I monitor traffic on my home network?

I have admin access to my D-Link DSL G604T router which controls one switch (and 2 computers) and three other computers. I want to monitor traffic on this router to find out who is downloading what / ...
2
votes
1answer
273 views

How can I filter incoming packets to my application?

I have only little experience with Wireshark. The problem is that when my server (3rd party app) receives a faulty packets, it crashes. I would need to filter the incoming packets and filter out such ...
2
votes
1answer
1k views

Synergy choppiness: Is my wireless router delaying packets after silent period?

I am sharing keyboard and mouse between my Linux desktop and MacBook Air using Synergy. There is a very noticeable lag every time I begin moving my mouse (or start typing), but everything becomes ...
2
votes
1answer
2k views

How to enable the TCP checksum validation in Tshark(Terminal WireShark)

When I run the command tshark -i 3 -c 100 -V less 1514 src 192.168.10.57 and dst 192.168.10.60 and tcp The output is: Transmission Control Protocol, Src Port: commplex-link (5001), Dst Port: ...
2
votes
1answer
578 views

What do these fields mean in Wireshark?

What does the following mean in the info section of wireshark? Source Client Destination Server Protocol HTTP Length 522 Info 522 GET /intl/en/images/logo.gif HTTP/1.1 More ...
2
votes
1answer
3k views

Cannot connect to website - SSL handshaking fails

So I cannot connect to certain websites. Just a few, most are OK. The one I really care about is paypal.com. I have done the usual things. Let's see: Cleared browsing history Tried different ...
2
votes
1answer
3k views

Why do I keep seeing “Wireshark Cookie Dump Ok Cancel” in my input forms within Firefox?

I've recently installed Wireshark on my Macbook Pro. Since doing so, whenever I head over to http://jsfiddle.net, all of the input fields are pre-populated with Wireshark Cookie Dump: ...
2
votes
1answer
51 views

Tshark. List all traffic between two IP's?

I am learning to use Tshark. I am trying to retrieve a list of all conversations between two IP addresses using Tshark. The two IP's are: 192.168.1.158|64.12.24.50 In Wireshark I am able to see the ...
2
votes
0answers
128 views

How to use wireshark to decode SSL stream from remote API server?

I'm trying to troubleshoot some issues with what my code is sending to a remote API (over https). I've seen a ton of articles on Wireshark and decoding SSL, but they all make up their own test server ...
2
votes
0answers
930 views

How to troubleshoot a VPN connection drop

I have a Windows 8 machine that won't connect to a work VPN (other machines configured the same* way work fine). The IT dept at work says the attempt never shows up in the logs. On my computer, it ...
2
votes
0answers
444 views

What happens when Capturing USB Packets using Wireshark

I am trying to capture the packets sent by a Mouse to a host PC using Wireshark. Operating System - Ubuntu 12.04 Wireshark - 1.8.2 Problem 1.) Before I plug in the USB Mouse, when I start the ...
2
votes
1answer
468 views

Follow a .pcap file in wireshark like tail -f

I have a .pcap file on my android device, that I can access from my PC with wireshark via smb and wondering if it possible to get a 'Live view' of that file in wireshark. Is there any solution?
2
votes
0answers
2k views

tcp port numbers reused on wireshark

I used raw socket to build a tcp client program on machine A to reproduce tcp 3-way handshake with a simple regular tcp server on machine B I captured packets on the client host and server host, and ...
2
votes
0answers
429 views

Decode SSL packets in WireShark

I have cert.cer, base64 x509 and a Wireshark dump in .pcap format. The packets are encoded, so how do I decode them? Now: [site-ip],443,http,xe.cer but it's still not working.
2
votes
1answer
575 views

Linux alternative to Fiddler2 (different use! Not same question!)

I am aware that this question has been asked before; but my use for fiddler is completely different; Fiddler2 is my example. In Fiddler2 I can download streams from websites; for example if I stream ...
2
votes
0answers
466 views

Wireshark vs Netmon for precise time tagging

I'm using Wireshark to time tag and get some statistics on multicast traffic. When there is not much traffic, the stats looks good, but as soon as there is a bunch of packets arriving at the same time,...
2
votes
1answer
290 views

What is wag-service?

Does anyone know what wag-service is? I'm seeing it a lot in Wireshark
1
vote
1answer
369 views

Find out what programs are heavily using the network

Currently, I have a process on my Windows 7 system which is saturating the incoming broadband internet connection (75Mbit/s) and almost completely saturating the 100Mbit network controller. I cannot ...
1
vote
2answers
702 views

Is it possible to know which process opened a connection in Windows?

With netstat -a I can see all connections from my machine to the MySQL Server. There is any way too see which process or executable is responsible for each connection? The only solution I found so ...
1
vote
3answers
3k views

Wireshark can see outside of the virtual machine?

I'm running Windows in a VM inside of OSX. If I start Wireshark inside Windows, then a message from OSX pops up saying that Wireshark is trying to monitor all network traffic. If I accept, then ...
1
vote
2answers
2k views

Do machines connected to the same switch belong to the same subnet?

When we talk about a subnet - do we mean all the systems connected to the same switch? If I have an assigned IP address of 10.0.2.1, am I in the same subnet as that of 10.0.1.39? When we talk about ...
1
vote
2answers
9k views

What is the protocol 'ftp-data' identified by wireshark?

Just implementing a FTP server and use wireshark to analize the protocol. I find there is a protocol identified by wireshark FTP-DATA. What is that? Any document or RFC can be referred? Thanks and ...
1
vote
2answers
1k views

Networking packet sniffer for Linux that captures the application names?

I tried Wireshark. It shows the source and destination IP address, port number, and packet contents, but nothing about which application is using the packets. Apparently tcpdump is similar; network ...
1
vote
3answers
3k views

Finding the external (PPPoE, WAN) MAC address of an ADSL router

My ISP is Orange Internet, I have recently ditched my crummy "livebox" and moved to a more stable BT Business Hub with the firmware flashed back to the original SingTel ROM. The thing works great ...
1
vote
3answers
470 views

Why would my network slow down?

The network at my work has about 40 computers on it and a quite a few printers. When there are a lot of people working the network will be slow. I can test the ping between my computer and the router ...
1
vote
1answer
192 views

How does Wireshark sniff the packets? [closed]

When I have Wireshark running on, say, 192.168.1.100, how is it able to capture the packets that 192.1.123 sends to the router or to another computer/device in the LAN? My theory is that when a ...
1
vote
3answers
554 views

How does Wireshark resolve DNS names?

Could you explain how Wireshark makes a DNS query in order to resolve the name of an IP address? My issue is about the mismatch between the domain name resolved by Wireshark and that returned by ...
1
vote
1answer
1k views

Why am I not seeing ARP requests from my own machine in wireshark?

I am using Windows 7. I open up Wireshark and start a live capture with the filter: ip.src == THIS.IS.MY.IP I then go to a command line and do an arp -d * and ping a bunch of stuff. I see my ICMP ...
1
vote
2answers
6k views

How can I get the actual TCP sequence number in Wireshark?

In Wireshark, TCP sequence numbers are displayed as relative sequence numbers by default. How can I get the actual TCP sequence number?
1
vote
1answer
1k views

Using (embedding?) wireshark in a C application for sniffing [closed]

I'm writing a C/C++ application which needs (among other things) to sniff packets and save the output in a file. This file will be read and processed by wireshark after a few days, using a LUA script ...
1
vote
2answers
721 views

Wireshark filtering for one network

How do i make Wireshark filter results so it just shows results from one wifi net work. I have had a look on Google but found nothing. Can any one help.
1
vote
3answers
2k views

RS232 / Ethernet Port Servers - Protocols Involved?

Firstly, I'm not responsible for the equipment, so don't panic that I'm asking such basic questions :) At work we have multiple RS232 / Ethernet port servers (Say the 16 port version of this http://...
1
vote
4answers
4k views

Installing WinPcap on Windows 8

I know there has been lots of discussion already on installing WinPcap on Windows 8. I'm running the RTM version. I was able to install WinPcap without a hitch by using the Windows 7 compatibility ...
1
vote
2answers
1k views

Tracking Wireless Network Usage

How do you determine the overall bandwidth usage for each computer connected to a wireless network? I manage a small wireless network consisting of a couple of cheap Cisco/Linksys wifi routers. ...
1
vote
3answers
635 views

Why do I have so many HTTP packets in Wireshark when I'm not doing anything?

Is it normal that I have huge amount of HTTP packets every second in Wireshark, even if I am not doing anything? I would like to analyse some packets related to one website in particular, but how can ...
1
vote
2answers
978 views

404 error - Finding what wasn't found with wireshark

I am using Wireshark to view my HTTP activity. When there is a 404 Not Found error returned, I can't find an easy way to determine what request could not found. Can anyone explain how to do this?
1
vote
1answer
20 views

How do I capture device specific USB packets with tshark?

I have a USB instrument, and I want to capture packets on it. I ran .\tshark.exe -D and the USB interface is number 6. then I ran the command: .\tshark.exe -c 100 -i 6 it seemed to capture the USB ...
1
vote
1answer
40 views

Why am I seeing packets intended for other recipients while behind a router?

I'm using a wired internet connection. The ISP provides an ethernet cable, a static private IP, and a dynamic public IP. I bought a router and gave the router the static private IP. I'm using ...
1
vote
1answer
1k views

What does a sequence of retransmissions with PSH,ACK flags mean (and a spurious retransmission back)?

I am on server 192.168.0.2 and want to make a HTTP call to 192.168.0.1(both servers are RPis and run Linux (raspbian)). curl -XGET http://192.168.0.1:8081/api The API on 192.168.0.1 (which I am ...
1
vote
2answers
701 views

What causes dropping of ARP response packets in a wireless network?

I have a network of wireless access points (APs) in my local area network (LAN). Some PCs in the network can get ping responses from some other PCs/devices in the network but not some others. I have ...
1
vote
1answer
892 views

tcpdump not displaying RSSI

I am monitoring Wi-Fi probe requests via tcpdump on Debian and am trying to capture the RSSI (signal strength) of each probe request element. Currently, the output from tcpdump for each probe request ...