Open-source network packet analyzer

learn more… | top users | synonyms

1
vote
3answers
2k views

Installing WinPcap on Windows 8

I know there has been lots of discussion already on installing WinPcap on Windows 8. I'm running the RTM version. I was able to install WinPcap without a hitch by using the Windows 7 compatibility ...
2
votes
0answers
275 views

Decode SSL packets in WireShark

I have cert.cer, base64 x509 and a Wireshark dump in .pcap format. The packets are encoded, so how do I decode them? Now: [site-ip],443,http,xe.cer but it's still not working.
4
votes
1answer
2k views

Why does a PING reply require an ARP request for the originating hosts MAC?

I have a scenario as depicted below. Here two host machines are connected via a hub: Ok, so host-1 wants to ping host-2 and i have setup wireshark on a 3rd host connected to the same hub. Now ...
0
votes
2answers
3k views

Monitor Mode on the Intel Centrino(R) Advanced-N 6205 (WEP Penetration) On Windows

Can anyone tell me a way to do WEP hacking (legal, of course) (on my own wireless connection, for the purposes of this question) with Wireshark or similar programs on an Intel Centrino Advanced-N ...
0
votes
2answers
293 views

How can I filter out a large number of addresses in Wireshark

I'm looking to create a "blacklist" of IP addresses that Wireshark will ignore. I'm monitoring traffic originating on an iPhone, and there's a lot of chatter from Apple, Google Services, etc. I never ...
4
votes
1answer
1k views

How to determine what program send the packet recorded in Wireshark?

I was taking some tutorials on Wireshark in order to analyze the packets sent and received when talking to a web server for purposes of learning. When I start listening/recording packets in ...
1
vote
2answers
513 views

Tracking Wireless Network Usage

How do you determine the overall bandwidth usage for each computer connected to a wireless network? I manage a small wireless network consisting of a couple of cheap Cisco/Linksys wifi routers. ...
2
votes
1answer
559 views

need display filter to display tcp packets of non zero payload in wireshark

i have a pcap which contains only tcp packets. now i want to see only those packets which have non zero payload length. can someone please let me know which display filter to use ? using data.len or ...
1
vote
1answer
187 views

Unknown Inbound UTP Packets

I need some help figuring out something. I was looking at my network traffic using Wireshark and I saw a bunch of inbound UTP (uTorrent Transport Protocol) packets to my IP. About 10 different IP's ...
0
votes
3answers
24k views

What's all this deploy.akamaitechnologies.com traffic?

I happened to do a tcpdump while leaving my Mac idle, and when I came back after a mere half-hour there were something like 5000 packets involving deploy.akamaitechnologies.com, in which my computer ...
0
votes
2answers
1k views

Wireshark: there are no interfaces on which a capture can be done

I've made all steps described in wiki.wireshark.org/CaptureSetup/CapturePrivileges, but I still get next error message There are no interfaces on which a capture can be done. Where I've made a ...
1
vote
3answers
467 views

Capture/Peek WiFi data traffic?

My goal: I want to analyze the network protocols of a wireless device on my net. I've successfully set my linux laptop into monitor and promiscuous mode for its wifi interface. I used airmon-ng to ...
2
votes
2answers
404 views

Program to record data transmission between two computers using a TCP port

I am looking for a way to view data being transmitted over a TCP port between two computers. Is there a software package that allows this? I suppose I could script something to re-route data coming ...
1
vote
1answer
245 views

How to enter pcap filter in Wireshark 1.8?

Previously in capture options window there was a very handy input field for pcap filter expression. But in 1.8.* this window looks different: So, how to set pcap filter expression before starting ...
0
votes
1answer
1k views

How to extract mpeg-1 stream from pcap in wireshark

I have a pcap network dump that has an MPEG-1 stream inside and I would like to play the mpeg stream. So far I've tried playing through the RTP analyzer but that plays without any sound. I've also ...
2
votes
2answers
613 views

Wireshark: Accessing USB Bus Interfaces without sudo

I am trying to monitor some USB traffic using Wireshark on Linux (Ubuntu). If I start Wireshark as my normal user without root privileges, the USB bus interfaces are not listed. If I sudo wireshark ...
1
vote
3answers
326 views

Why would my network slow down?

The network at my work has about 40 computers on it and a quite a few printers. When there are a lot of people working the network will be slow. I can test the ping between my computer and the router ...
0
votes
1answer
110 views

Why does Windows constantly ping wireless network bridge?

I was looking at a Wireshark capture off my Windows XP box, and I noticed a rather curious behavior. Every 1-2 seconds, the machine sends a ping request to my Linksys WET610N wireless network bridge, ...
3
votes
0answers
2k views

Having trouble Getting “RTSP over HTTP”

There is an axis camera that is connected to our site (camba.tv) through axis one click connection component (which acts as proxy). We can communicate with this camera only through http by setting the ...
1
vote
1answer
266 views

Wireshark RPC packet capture with localhost

I want to capture RPC-XML packets on locahost using wireshark. As RPC-XML is at the top of tcp/udp, I enabled all protocols still I am not able to capture the traffic. Is there other way to do so? I ...
2
votes
1answer
313 views

What do these fields mean in Wireshark?

What does the following mean in the info section of wireshark? Source Client Destination Server Protocol HTTP Length 522 Info 522 GET /intl/en/images/logo.gif HTTP/1.1 More ...
0
votes
1answer
346 views

HDI: Capture specific content types in wireshark?

I've been tasked to audit in/outbound traffic at our site, but I don't know much about Wireshark. I understand how to set up a capture filter for broad protocols (IP only or tcp, udp, icmp, etc), but ...
1
vote
1answer
583 views

Sniffing SSL Traffic with Wireshark Locally

I ahve an application that is submitting and recieving information via HTTPS. If I place wireshark on the same box and the client. Will I be able to decrypt all of the data within the communication ...
1
vote
1answer
3k views

How to set intel centrino advanced-n 6205 in “monitor mode” in Windows 7 (32bit) and Wireshark

I've just installed Wireshark on my laptop and can't see it's working in "monitor mode". Logically I'm not connected with my home network, do I have to be able to monitor my ipads traffic? WinPCAP ...
0
votes
2answers
240 views

One VoIP conversation but two RTP streams?

I'm testing a VoIP system based on OpenSIPS. It has no RTPproxy, so calls do not pass through OpenSIPS. I tried to make a call between two smartphones, and it succeeded. I also turned on Wireshark, ...
1
vote
2answers
955 views

Do machines connected to the same switch belong to the same subnet?

When we talk about a subnet - do we mean all the systems connected to the same switch? If I have an assigned IP address of 10.0.2.1, am I in the same subnet as that of 10.0.1.39? When we talk about ...
2
votes
3answers
848 views

Wireshark on home-network

So basically I want to make WireShark ( Windows ) capture packets of the home network. As you know, home-networks are usually set by local IPs ( 192.168 or 10.0 range ) instead of the WAN IP so if we ...
0
votes
0answers
150 views

Saving traffic on a port to pcap format using an active intermediary

I have a service which listens on host1:5000. My intention is to redirect my client to localhost:5000. What I desire is a service running on localhost:5000 that redirects all traffic to host1:5000 ...
0
votes
2answers
3k views

What is the protocol 'ftp-data' identified by wireshark?

Just implementing a FTP server and use wireshark to analize the protocol. I find there is a protocol identified by wireshark FTP-DATA. What is that? Any document or RFC can be referred? Thanks and ...
1
vote
1answer
2k views

Windows 7 PC sends a lot of NetBIOS Name Queries for non-existent computer names

I have a Windows 7 PC, and have been monitoring network traffic using Wireshark, and I'm seeing this PC send out a lot of NetBIOS Name Queries for non-existent computer names. These are some of the ...
2
votes
1answer
3k views

How can I stop my computer from doing arp poisoning attacks?

I have a small LAN in my home about 4 - 5 computers. The problem is that when there are usually 3 or more pc's online we keep losing the Internet access randomly about every 2 minutes. So we took a ...
0
votes
1answer
761 views

running tshark command in windows batch file

I have written a batch file that runs a tshark command to filter fields from a wireshark pcap file and write them to a csv file. When i ran on the windows cmd CLI, i had to change the current working ...
0
votes
1answer
1k views

Can I use Wireshark to see what URL's my computer is invoking?

Is it possible to use Wireshark to see what URL and what params are being requested by my computer? Something like: www.foobar.com/someendpoint/bazboo Does Wireshark offer this information in ...
9
votes
4answers
8k views

Wireshark WPA 4-way handshake

From this wiki page: WPA and WPA2 use keys derived from an EAPOL handshake to encrypt traffic. Unless all four handshake packets are present for the session you're trying to decrypt, Wireshark ...
1
vote
1answer
391 views

Replace sensitive IP addresses in Wireshark with XXX.XXX.XXX.XXX

What would be an easy way to replace a sensitive IP address in a Wireshark packet capture with XXX.XXX.XXX.XXX? When I export the pcap in txt or csv I can no longer import it into Wireshark.
0
votes
1answer
281 views

Wireshark: Byte order changes when data exported

I am looking at a packet capture in Wireshark and try to export the data from a packet. In Wireshark, it looks like this: 46 a5 e2 fb bd 69 ... Then, after downloading, hexdump shows: a5 46 fb e2 ...
2
votes
1answer
2k views

Cannot connect to website - SSL handshaking fails

So I cannot connect to certain websites. Just a few, most are OK. The one I really care about is paypal.com. I have done the usual things. Let's see: Cleared browsing history Tried different ...
12
votes
2answers
12k views

How do I decrypt WPA2 encrypted packets using Wireshark?

I am trying to decrypt my WLAN data with Wireshark. I have already read and tried eveything on this page but without any success (well, I tried the example dump on that page and succeeded, but I fail ...
1
vote
2answers
363 views

how to find tcp streams without final ack/fin sequence in a huge packet capture file

I have a huge pcap file which contains a large number of individual tcp streams.But out of these , there are some invalid streams which dont have the final fin/ack sequence. Is there any way i can ...
0
votes
1answer
590 views

Do the “follow TCP stream” option in wireshark include duplicate packets?

When I tried to follow a TCP stream in wireshark, I found some duplicate packets. I wanted to know whether wireshark excludes duplicate(or retransmission) TCP packets from the "follow TCP stream" ...
-1
votes
1answer
239 views

I can not see ipv4 and http, I can just see ipv6 and SSDP [closed]

I have a real huge problem, when I am connected through the wireless of my university, I can just see adresses like this : 1823731 14856.287768 fe80::74b6:2d79:4343:41e1 ff02::c SSDP ...
1
vote
1answer
2k views

Why can't Wireshark read packets from ping?

I have Wireshark started, then I ping an IP address. But Wireshark is not picking up any packet sending to or receiving (echoing) from the destination address. Why? Is ping "protected" from being ...
3
votes
1answer
333 views

Wireshark and promiscous mode

I am using Wireshark for class. Does Wireshark put your card in promiscuous mode automatically, or must you manually do it? I've searched everywhere I can, and cannot find the answer. I have it ...
1
vote
2answers
5k views

Decrypting SSL traffic in Wireshark. Only headers get decrypted

I'm trying to decrypt SSL traffic in Wireshark, and it partially works because I'm able to view the decrypted headers. The problem is that I don't see any of the packet contents, only their headers. ...
1
vote
4answers
13k views

How do I limit packet capturing in Wireshark to only a specific protocol?

I would like to listen to HTTP traffic on port 8080. When I start capturing packets in Wireshark, it's flooded by packets using the SSDP protocol on port 1900. I would like to limit the packet ...
0
votes
1answer
919 views

How to set Wireshark to log ONLY DNS requests?

This works: tethereal -i eth0 -w /root/mycapture.pcap but it captures every packet. I only need to capture DNS requests. Is this possible? The server is Linux. Other thing is: is it possible to ...
3
votes
5answers
3k views

Wireshark (Linux) captures only packet from and to my PC when in promiscuous mode

I've installed Wireshark and configured it to let my user run it with all needed privileges (I enabled dumpcap and added my user to wireshark group, then restarted). Devices are shown and capture ...
1
vote
1answer
650 views

Filtering sniffed logs using Wireshark

I'm experimenting with packet sniffing and log examination using Wireshark, and I'm quickly realizing that I'm not nearly as safe as I should be when using public hot spots. In efforts to better ...
0
votes
1answer
165 views

What is fjappmgrbulk?

I captured a udp packet from wireshark which ones port is 2510 and destination ip is 81.64.155.202. What is that port for? I found this post) mentioning: "it's for fjappmgrbulk, fjappmgrbulk ...
1
vote
1answer
1k views

Trying convert webserver certificate to PEM file for wireshark to monitor ssl traffic in HTTP format

I am trying to monitor https traffic as readable HTML. I have downloaded the certificate from the server. "In Internet Explorer, I selected the certificate and copy to file, DER encoded binary X.509 ...