Open-source network packet analyzer

learn more… | top users | synonyms

1
vote
1answer
303 views

Lightweight network packet capture solution for windows? [closed]

I'm looking for a lightweight packet capture solution for Windows. It needs to capture all packets on a physical network device and write them to a file (preferably .pcap, because that's easiest for ...
0
votes
0answers
250 views

DNS leak: Looking up own hostname with DNS queries

I was checking a proxied program for DNS leaks with tshark when I noticed this: 13.170066 10.0.2.15 -> 192.168.1.1 DNS 66 Standard query 0xd473 A [hostname] 13.753496 10.0.2.15 -> ...
0
votes
2answers
86 views

How to check the packets in wireshark while doing the internet

I am using Wireshark first time.Can we see the packet in wireshark while having the internet on the laptop(or PC). But I don't see any packet in wireshark.While I have internet connection. Please ...
0
votes
1answer
691 views

change Wireshark file (pcap file) via bittwiste (change ip)

i want to take pcap file and change all packet with specific ip to new ip and i know i can do it in this way: bittwiste.exe -I myFile.pcap -O newFile.pcap -T ip -s 192.0.16.50,61.68.133.207 ...
1
vote
2answers
1k views

Filter in Wireshark for TLS's Server Name Indication field

Does wireshark have a filter for TLS's Server Name Indication field?
0
votes
1answer
585 views

How do I capture 802.11 headers on an AP while not in monitor mode?

I am wondering if it is possible to extract 802.11 frames on a router running OpenWrt operating as an access point. I tried using tcpdump and loading the dumped packets in Wireshark, but I could only ...
0
votes
1answer
401 views

how to capture rsync traffic in wireshark

I want to analyse what raw-data rsync transfers across for a sample input file. So I am using rsync over rsh (As traffic captured in wireshark will be easy to interpret). I am using following rsync ...
-1
votes
2answers
627 views

Reconstructing web content through Wireshark

Suppose I have a Wireshark log of traffic from a web site. Can I reconstruct various elements like HTML file, picture files, java script files, etc? Ideally, it'd take the .pcap file and ...
1
vote
1answer
135 views

Capture internal ports

Is there any way to capture packets all through internal ports for ex: A packets from 192.168.2.79 4000 to 192.168.2.79 4001 In this case its a TCP connection and the packets will not flow out ...
1
vote
1answer
146 views

How to differentiate between three different flavours of pcap files?

There appears to be 3 different file formats associated with the ".pcap" extension -- libpcap /w microsecond timestamps, libpcap /w nanosecond timestamps, and pcapng. Is there an easy way to ...
0
votes
1answer
618 views

Orbit Download Manager massive send packets (no torrent)

recently I've noticed my internet connection speed is low even my modem console was opening very slow , after troubleshooting using Wireshark I've found massive packets send to "sg.ilovewebgame.co.kr" ...
2
votes
1answer
1k views

How to enable the TCP checksum validation in Tshark(Terminal WireShark)

When I run the command tshark -i 3 -c 100 -V less 1514 src 192.168.10.57 and dst 192.168.10.60 and tcp The output is: Transmission Control Protocol, Src Port: commplex-link (5001), Dst Port: ...
0
votes
1answer
1k views

DNS Queries Returning No Answer Section

I spent hours today trying to figure out why my own socket-level implementation of DIG in a browser is not working consistently. I would successfully send a DNS packet over UDP but would receive a ...
2
votes
3answers
3k views

Sniff traffic coming from one particular application?

Basically I'd like to sniff HTTP requests made by an .exe on Windows. I tried using wireshark, but it's somewhat unhandy since it sniffs all traffic on the interface. Are there any alternatives?
1
vote
1answer
357 views

IP checksum offload

I recently updated to Windows 8 and get alot of invalid packet transfers. It says "Ip checksum offload?" (Wireshark) and most of my packets get lost. The checksum is 0x00. I also updated my NIC ...
0
votes
2answers
3k views

Filter ICMP packets sent from my IP address in Wireshark with the Packet Filter

I want to filter the ICMP packets sent from my IP address in Wireshark. I tried the following expression: ip.src == xxx.xxx.xxx.xxx && icmp But the problem is that it shows packets with ...
5
votes
2answers
257 views

Remove/change private data (e.g. passwords)

Is it possible to remove/change packages captured with Wireshark? My Situation: I captured some packages and want to send them to somebody else. The problem is, that one of the packages contains ...
3
votes
2answers
9k views

How can I show only 127.0.0.1 traffic using Wireshark?

Every time I try to filter to just show a specific IP address, I get an error indicating that it is "not an interface or a field." I have no idea what that means. Furthermore, I don’t really see any ...
3
votes
1answer
395 views

How to properly use stunnel?

I'm trying to setup Wireshark ssl debugging, and to do this, I'm trying to follow instructions in this article. I'm currently at stunnel part, and I'm trying to execute sudo stunnel -p ps.pem -d ...
2
votes
1answer
413 views

How to protect Cisco router from getting hacked by Wireshark software? [closed]

I can see my user name and password of my router on my laptop with a second machine connected to my Cisco router, when I use Wireshark on the second machine. How do I protect myself from such ...
0
votes
1answer
235 views

Why do DNS queries use loopback interface?

Sniffing (using Wireshark), for didactical purpose, my loopback interface on Ubuntu 12.04, I noticed that a lot of DNS queries (maybe ALL of them) have 127.0.0.1 as source and destination address. ...
0
votes
2answers
1k views

launch wireshark in linux

I have wireshark-1.2.15-2.el6_2.1.x86_64.rpm installed on CentOS. I was hoping to see a command like "wireshark", but couldnt find it. How do i launch wireshark? After querying the rpm, following ...
0
votes
1answer
473 views

WireShark in Ubuntu 12.04

I'm new in UNIX. I've installed WireShark on Ubuntu 12.04 and there is no interface list in Capture section. There is only text "No interface can be used for capturing in this system with the current ...
2
votes
3answers
8k views

Wireshark Not Displaying Packets From Other Network Devices, Even in Promisc Mode

System Setup: MacBook Air running Mountain Lion and connected wirelessly to a router. Wireshark installed and capturing packets (I have "capture all in promiscuous mode" checked) I filter out all ...
1
vote
2answers
839 views

How to make wireshark show http protocol instead of 802.11?

I recorded the wlan traffic in my network and saved this as a pcap file. Now I'd like to see the recorded http traffic and filter for some parts of the http traffic. I can open the pcap file in ...
0
votes
1answer
149 views

Is there any software that uses SSDP protocol like iChat for windows 7

Is there any software that uses SSDP protocol like iChat for windows 7. The reason I want this so that I can communicate with other users on my same local area network. As I see a lot of SSDP ...
0
votes
1answer
373 views

How to get RSSI values in wireshark captures

I'm running Mountain Lion and have Wireshark 1.8.3. I want to display the RSSI of each packet but I seem unable to do so. I went to Edit->Preferences->User Interface->Columns and select RSSI to be ...
0
votes
0answers
410 views

Wireshark does not show any HTTP traffic

My PC is running windows XP. I have been trying to capture HTTP traffic but if I apply the following filters, the Wireshark gives results not required http result: it only show ssdp traffic http ...
4
votes
2answers
971 views

How can I get Wireshark with a GUI on my EC2?

I have an Amazon EC2 machine that I'd like to run Wireshark on, using X forwarding. Unfortunately, the only Wireshark packages found with $ yum search wireshark are: wireshark-devel.x86_64 ...
1
vote
1answer
440 views

Need advice on using Wireshark + aircrack-ng

I am making acquiantance with wireless security and attacks and was told to run some tests with aircrack-ng and wireshark. So I installed both of them and ran airmon to switch wi-fi card to monitor ...
0
votes
1answer
523 views

Can't display RSSI values in Wireshark

I am trying to analyze the up-link Wireless traffic generated by my Sony Ericsson phone and captured by my D-Link router, on which I installed the DD-WRT firmware. To do this, first I log in the ...
1
vote
4answers
3k views

Installing WinPcap on Windows 8

I know there has been lots of discussion already on installing WinPcap on Windows 8. I'm running the RTM version. I was able to install WinPcap without a hitch by using the Windows 7 compatibility ...
2
votes
0answers
351 views

Decode SSL packets in WireShark

I have cert.cer, base64 x509 and a Wireshark dump in .pcap format. The packets are encoded, so how do I decode them? Now: [site-ip],443,http,xe.cer but it's still not working.
4
votes
1answer
4k views

Why does a PING reply require an ARP request for the originating hosts MAC?

I have a scenario as depicted below. Here two host machines are connected via a hub: Ok, so host-1 wants to ping host-2 and i have setup wireshark on a 3rd host connected to the same hub. Now ...
0
votes
2answers
5k views

Monitor Mode on the Intel Centrino(R) Advanced-N 6205 (WEP Penetration) On Windows

Can anyone tell me a way to do WEP hacking (legal, of course) (on my own wireless connection, for the purposes of this question) with Wireshark or similar programs on an Intel Centrino Advanced-N ...
0
votes
2answers
550 views

How can I filter out a large number of addresses in Wireshark

I'm looking to create a "blacklist" of IP addresses that Wireshark will ignore. I'm monitoring traffic originating on an iPhone, and there's a lot of chatter from Apple, Google Services, etc. I never ...
4
votes
1answer
2k views

How to determine what program send the packet recorded in Wireshark?

I was taking some tutorials on Wireshark in order to analyze the packets sent and received when talking to a web server for purposes of learning. When I start listening/recording packets in ...
1
vote
2answers
798 views

Tracking Wireless Network Usage

How do you determine the overall bandwidth usage for each computer connected to a wireless network? I manage a small wireless network consisting of a couple of cheap Cisco/Linksys wifi routers. ...
2
votes
1answer
1k views

need display filter to display tcp packets of non zero payload in wireshark

i have a pcap which contains only tcp packets. now i want to see only those packets which have non zero payload length. can someone please let me know which display filter to use ? using data.len or ...
1
vote
1answer
228 views

Unknown Inbound UTP Packets

I need some help figuring out something. I was looking at my network traffic using Wireshark and I saw a bunch of inbound UTP (uTorrent Transport Protocol) packets to my IP. About 10 different IP's ...
5
votes
3answers
50k views

What's all this deploy.akamaitechnologies.com traffic?

I happened to do a tcpdump while leaving my Mac idle, and when I came back after a mere half-hour there were something like 5000 packets involving deploy.akamaitechnologies.com, in which my computer ...
0
votes
2answers
1k views

Wireshark: there are no interfaces on which a capture can be done

I've made all steps described in wiki.wireshark.org/CaptureSetup/CapturePrivileges, but I still get next error message There are no interfaces on which a capture can be done. Where I've made a ...
1
vote
3answers
774 views

Capture/Peek WiFi data traffic?

My goal: I want to analyze the network protocols of a wireless device on my net. I've successfully set my linux laptop into monitor and promiscuous mode for its wifi interface. I used airmon-ng to ...
2
votes
2answers
480 views

Program to record data transmission between two computers using a TCP port

I am looking for a way to view data being transmitted over a TCP port between two computers. Is there a software package that allows this? I suppose I could script something to re-route data coming ...
1
vote
1answer
291 views

How to enter pcap filter in Wireshark 1.8?

Previously in capture options window there was a very handy input field for pcap filter expression. But in 1.8.* this window looks different: So, how to set pcap filter expression before starting ...
0
votes
1answer
2k views

How to extract mpeg-1 stream from pcap in wireshark

I have a pcap network dump that has an MPEG-1 stream inside and I would like to play the mpeg stream. So far I've tried playing through the RTP analyzer but that plays without any sound. I've also ...
2
votes
2answers
1k views

Wireshark: Accessing USB Bus Interfaces without sudo

I am trying to monitor some USB traffic using Wireshark on Linux (Ubuntu). If I start Wireshark as my normal user without root privileges, the USB bus interfaces are not listed. If I sudo wireshark ...
1
vote
3answers
390 views

Why would my network slow down?

The network at my work has about 40 computers on it and a quite a few printers. When there are a lot of people working the network will be slow. I can test the ping between my computer and the router ...
0
votes
1answer
116 views

Why does Windows constantly ping wireless network bridge?

I was looking at a Wireshark capture off my Windows XP box, and I noticed a rather curious behavior. Every 1-2 seconds, the machine sends a ping request to my Linksys WET610N wireless network bridge, ...
3
votes
0answers
2k views

Having trouble Getting “RTSP over HTTP”

There is an axis camera that is connected to our site (camba.tv) through axis one click connection component (which acts as proxy). We can communicate with this camera only through http by setting the ...