The network protocol analyzer developed and maintained by the Wireshark Foundation

learn more… | top users | synonyms

0
votes
0answers
39 views

Eliminating extraneous network traffic

If I wanted to get the best performance (high data rate, low latency) out of an isolated gigabit ethernet LAN (N.B. NOT connected to the internet) I would assume this would occur when there was no ...
0
votes
1answer
264 views

How do I get Wireshark to filter for a specific web host?

I'm using Wireshark on OSX, but I can't make any sense out of the filtering system. I have this filter set up: But when I hit that server, I don't see anything show up in the capture log. If I ...
1
vote
0answers
316 views

Capture network traffic between VM's Virtualbox using Wireshark

I'm trying to capture all network traffic between VMs (and in the VMs to themselves) running on a single host using Virtualbox for the VMs and Wireshark for the capturing. VMs are Ubuntu 14.04 and the ...
1
vote
1answer
84 views

Which HTTP Authentication used?

I need a way to find out which HTTP Auth mechanism is used for a particular website/web-server, which is responding to my HTTP request. I am open to use any browser, or any other tool (like ...
0
votes
0answers
250 views

UPnP Discover can't captured by Wireshark

According to the UPnP standard, the UPnP discover packet should send to 239.255.255.250:1900. However, when my program send to 239.255.255.250:1900, the wireshark can't captured the packet. When my ...
1
vote
0answers
24 views

Route network traffic back to the same wire

I would like to monitor outgoing traffic from my wi-fi connected phone using Wireshark on my Windows desktop. I changed default gateway on the phone to the IP of the desktop and Wireshark can now see ...
0
votes
1answer
165 views

Monitoring physical network traffic with a VM

How can I monitor the physical network's traffic through a virtual machine (VMWare or Virtual Box)? I'm running Wireshark in a Linux VM and I would like to monitor all the network traffic. However ...
1
vote
1answer
4k views

How can I get the actual TCP sequence number in Wireshark?

In Wireshark, TCP sequence numbers are displayed as relative sequence numbers by default. How can I get the actual TCP sequence number?
1
vote
1answer
113 views

Can Wireless Sniffers capture and read your data with and without being connected to the WLAN?

Can some neighbor with his laptop capture the wireless traffic packets which I send and receive from my router, if he is not connected to my WLAN? Can someone connected to my WLAN and without access ...
0
votes
1answer
970 views

http.host filter for tshark capturing

I would like to capture traffic to a specific domain name. I tried the following wireshark filter http.host == 'example.com' It works, but after a few hours the temp data gets very large, so I ...
1
vote
0answers
126 views

Can network sniffing in promisc mode on a network bridge produce “false” TCP retransmissions?

I have a Wireshark log from a computer that was running Ubuntu and tshark. The computer has two NICs and I've connected them to a bridge (using /etc/network/interfaces) and gave that bridge a static ...
1
vote
1answer
411 views

Kerberos failure emergency: need to filter a Wireshark capture to show only Kerberos and SPNEGO traffic

I am attempting to troubleshoot a serious Kerberos authentication problem on our SBS 2003 domain (none of our Windows 7 or XP workstations can authenticate). We have logged failed Kerberos ...
0
votes
1answer
138 views

Can anyone interpret the data in this UDP packet?

I have been receiving large amounts of traffic to my computer recently so I downloaded and ran wireshark to find out I have been receiving lots of UDP packets. All of the packets I have received are ...
1
vote
2answers
360 views

How do capture filters in Wireshark work internally?

I am wondering exactly what happens internally in TShark when I use a capture filter. Specifically, let's say I have the following filter to capture multicast data: host 224.0.26.3 && port ...
0
votes
1answer
415 views

Unable to build wireshark in the centOS 5.3

I downloaded the source code from the wireshar.org and tried to build it but I am facing the problem in compiling it. Following is the error I am getting during configure (./configure) checking for ...
0
votes
0answers
241 views

Wireshark does not pick up outbound traffic

I have a bit of 'n problem at a client. We are running a WCF Client/Server application, and for some reason when one of the users try to connect to the server, he gets a timeout, but the second time ...
0
votes
1answer
135 views

Need help understanding network interfaces on my machine

I do not understand why wireshark and the device list on my computer do not show the same set of network interfaces. Also, I am not even sure what some of the interfaces are. Here are the reports: ...
1
vote
1answer
759 views

Provide Session Master Key to Wireshark UI?

I'm working on an issue with HTTPS. I suspect its related to client certificates. I want to read some of the encrypted handshake messages that follows the ServerHelloDone message. (Once the ...
0
votes
1answer
120 views

Is there any way to determine if the router is forwarding WoL packet to the NIC card while the computer is turned off?

I am having hard time figuring out whether the problem is with the router not forwarding the packets to the NIC OR the problem is the NIC not waking the PC or other hidden settings that are preventing ...
2
votes
1answer
79 views

Explanation of port protocols in Wireshark?

When using Wireshark you can display the packets with just the plain number of the port, or with a "transport layer name resolution" (via the View/Name Resolution menu, for example). Unfortunately, ...
0
votes
2answers
1k views

How can I tell if Wireshark has sucessfully decrypted a capture

I have used Microsoft Network Monitor 3.4 in Windows 7 to create a capture file from my wireless g network by setting monitor mode. When loaded into Wireshark I can see the four way handshake and I ...
1
vote
1answer
2k views

Promiscuous mode implies Monitor Mode compatibility?

I mean, I just want to put my wireless card interface into promiscuous mode to scan my wireless network I'm connected to. Do I necessarily need a monitor mode wifi card compatible? Should I ...
0
votes
1answer
328 views

How to get packets for a specific access point

I have Wireshark and Aircrack-ng and whenever I capture packets I don't know how to capture packets for a specific network (the network is "2WIRE207"). I need to do this so I can use Aircrack-ng.
0
votes
1answer
375 views

cannot capture packets on wireshark without internet

I am using Wireshark on my Windows 8.1 Pro 32-bit pa and whenever I start Wireshark without internet, it can't capture ant packets. But when I am connected to the internet, it captures packets form ...
1
vote
1answer
2k views

Can't install wireshark on Debian Linux

I'm trying to install Wireshark on Debian (Debian 3.2.51-1) but i'm getting this error: apt-get install wireshark Reading package lists... Done Building dependency tree Reading state ...
0
votes
0answers
56 views

Drop network packages

I'm seeing a lot more protocols in the wireshark capture in my university network than in my home network and the connection is incredibly bad at the university (> 2 Min. to get an IP address from ...
0
votes
0answers
48 views

cannot listen to interfaces without root privilege

for certain reason, I wanted to capture traffic without being root. Setup: Host: Ubuntu 3.11.0 Guest Ubuntu 3.13.0 Wireshark in Guest:1.10.8 I have done this trying to enable capturing without ...
0
votes
1answer
72 views

Filtering for IPs that send a packets of a certain length

I'm trying to find all the IP addresses that netflix uses to deliver content, as the lists I've found online do not include many of the servers that I've observed sending content. Is there any way in ...
0
votes
1answer
602 views

Remote Packet Capture using Wireshark

Well The scenario is that I have a Windows machine(at home) and a Linux box running headless Ubuntu server(without GUI) on a remote location. I got Wireshark installed on my windows machine, and ...
0
votes
1answer
1k views

Websocket handshake response not forwarded from TCP to client

I am trying to create a websocket server. I can see the websocket client's opening handhshake. My response to it is received by the client laptop (I can see this on wireshark). So the TCP connection ...
-2
votes
3answers
337 views

Is there a free program that can detect which device on my network is causing lag? [closed]

I'm on a small business network, and rarely we experience really extreme latency. I have no idea what device might be causing the lag, and wanted to know if there was a piece of software that could ...
1
vote
0answers
489 views

how to sniff from a TP-Link ADSL modem?

I have a PC and a tablet that connected to a TP-Link ADSL modem. PROBLEM: I want to see the packets that send and receive from my modem not my PC( to see both wire and wireless packets) I search ...
0
votes
0answers
2k views

WinPcap/Wireshark install: where is packet.dll?

I have Wireshark installed, and I'm getting this error: The NPF driver isn't running. You may have trouble capturing or listing interfaces. I realize this is something to do with WinPcap. It's ...
0
votes
2answers
393 views

Tshark is displaying “florence” and “eforward” rather than source/destination port numbers

I am running rawcap on windows7 loopback adapter. I have run telnet localhost 2181 15 Packets were generated. In order to view the output I ran wireshark\tshark -r \shared\pcap.pcap And here ...
3
votes
2answers
168 views

One arp request for two different pings

I pinged google and yahoo and captured the packets using wireshark and found that there was only one arp request for both of them. Can anyone explain why there is only one arp request for the two ...
0
votes
0answers
31 views

Multiple Packets info are clumping together in a single line while taking wireshark traces

I am facing a problem with Wireshark traces wherein the info from multiple packets is clumped in a single line (i.e. in single line multiple packets are displaying instead of each single packet being ...
1
vote
2answers
1k views

Using Wireshark to track traffic on a Windows Virtual WiFi Miniport

I have a Microsoft Virtual WiFi Miniport set up on my laptop with an Android phone connected to it. The laptop is then connected to the outside world through a wired connection. I would like to ...
0
votes
2answers
976 views

How to capture 802.1X EAPOL packets in windows 7?

I want to capture 802.11 EAPOL packets on windows 7,however,i fail to capture any EAPOL packet use wireshark.What tools can i use to capture the EAPOL packet? my environment is windows 7,wireshark ...
0
votes
2answers
351 views

tcp retransmission on lan, wifi is fine

I have a Dell XPS 17 laptop (about 5 years old) running Windows 7 and a Synology RS412 NAS. I also have various other networked devices (servers, routers, laptops, pcs). Some are in my domain, some ...
2
votes
2answers
2k views

Real-time loopback interface packet capture on Windows with RawCap, Wireshark, and some pipe utility

After stumbling across another Super User post about loopback packet capture on Windows, I was directed to RawCap, a utility that provides pseudo-capture of loopback packets. RawCap writes to libpcap ...
0
votes
1answer
750 views

Problems using tshark sniffing TLS encrypted traffic with .pem key

I am having problems decrypting TLS encrypted syslog-ng packets in a honeynet using tshark (command line Wireshark). The goal is to be able to intercept the packets going from the honeypots to a ...
4
votes
2answers
8k views

Show only HTTP traffic in Wireshark

How can I filter out traffic that is not HTTP in Wireshark, so that it shows me only HTTP traffic, but not, TCP, DNS, SSDP, etc.
2
votes
1answer
2k views

.exe file (specifically Wireshark) will not launch anymore on Windows 8.1

I use Wireshark x64 daily in my work. Suddenly today, it refuses to open. When I doubleclick a pcap (or pcapng) file, Windows tells me the file I tried to click was not found. When I try to start ...
1
vote
2answers
4k views

Wireshark only capturing beacon frames

I am trying to sniff my own network to capture http traffic. On airodump my network security show "WPA - TKIP - PSK", so I went to Wireshark > Edit > Preferences > Protocols > IEEE 802.11 > Enabled ...
0
votes
0answers
61 views

Unable to intercept data intended for gateway by using ARP

I am having trouble with what seems to be a very simple problem. I manage to be able to successfully spoof the ARP table of one computer on my network (as reported by arp -a). But even enabling a ...
1
vote
0answers
247 views

RST, ACK from 216.98.48.133 without any SYN from me? For real? How? Why?

I am trying to figure out why I always get "The Ubisoft server is not available at the time. Please try again later." Apparently, the server is actually up and running, so it seems the problem is on ...
-1
votes
1answer
77 views

How to sniff download information of different pc's on a network(router) [closed]

I am making a Log Analyzer for downloads on a network by different users. So I want to know who downloaded what in the same network (WLAN). How can I sniff this information from other users of the ...
1
vote
2answers
969 views

Simple http traffic monitor (capture by process) [closed]

I know, questions like this have been asked a lot before. I have a big problem using Wireshark because of the following reasons: It is not able to trace down which process sent/received a packet ...
0
votes
0answers
245 views

Wireshark Capture Filter

I am new to wireshark and I am trying to capture an ICMP packet over 802.11g, I am using windows and pingplotter. The issue is that on wireshark capture I am not getting any ICMP packets no matter how ...
0
votes
1answer
334 views

Intercept HTTPS traffic of a IP energy consumption monitor device

I have this device connected to my home network, and I'm curious about what it's sending to the Internet. It seems to generate a lot of traffic. I've connected it to my laptop and I've shared the ...