The network protocol analyzer developed and maintained by the Wireshark Foundation

learn more… | top users | synonyms

1
vote
0answers
281 views

What happens when Capturing USB Packets using Wireshark

I am trying to capture the packets sent by a Mouse to a host PC using Wireshark. Operating System - Ubuntu 12.04 Wireshark - 1.8.2 Problem 1.) Before I plug in the USB Mouse, when I start the ...
1
vote
1answer
432 views

Browser communication to a webserver and the OSI model

If I use google chrome (on a windows 7 machine) to access https://www.google.com, can someone tell me where the involved pieces fit into the OSI model? I would also like to know If I use ...
0
votes
1answer
462 views

How can I capture packets belonging to a certain process

I need to capture packets belonging to a program or process. I know Winshark, but it just displays network traffic in a mess (in my view). If one wants to get the packets of a given process, you must ...
0
votes
1answer
395 views

dig OK but dig @192.168.1.1 NOT

why dig works OK, but dig my NetGear router directly doesn't (while first goes to it too, because it is my DNS, NetGear itself has 8.8.8.8 set as prim dns). My NetGear has IP 192.168.1.1 on LAN. Here ...
0
votes
1answer
721 views

Scapy: TCP Retransmission error

I've been using Scapy to send SCCP or Skinny packets to my Cisco Desk Phone. However I keep getting these TCP Retransmission errors, and I believe this is causing the Cisco Phone to not respond. I ...
0
votes
1answer
1k views

Why Wireshark is not showing high layer packets like ICMP/IP/UDP? (Only broadcast packets are shown)

I am using Wireshark for 802.11g sniffing. The AP is not using any encryption. These are my observations: The vast majority packets are beacons and the probe requests. If I filter out beacons using ...
0
votes
1answer
2k views

vlc part of desktop streaming to <host>:<port>

With VLC, I wish to stream a portion of the desktop and send it to another host on my local area network. The capture seems to work, I see a correct portion of the desktop into the VLC server, but ...
1
vote
0answers
27 views

How to identify which network interface is my application using [duplicate]

I hoped to capture network traffic -using Wireshark- via a port on which my application is running. However when I fired up Wireshark, it listed 4 network interfaces not just 1 as I expected. So I ...
2
votes
1answer
4k views

wireshark: how to capture traffic between guest and host OS?

I'm trying to set up a lab to demonstrate ipv6 attack and detection mechanism on my Macbook. This is my set up with virtualbox: Host OS: OS X 10.8.2 IPv6 automatically, wireless connection Geust OS: ...
0
votes
1answer
930 views

wireshark makes network working

Have a number of boards with ethernet on it. Some boards have hardware bug. When pinging such boards, not always got answers. But when running wireshark capture mode, have stable network exchange ...
0
votes
2answers
425 views

Tshark and proper filter

Using Tshark, I would like to apply filter on a wireless sniffer capture such that (both a & b are satisfied) a) 802.11 beacons are present b) Packets belonging to a certain wireless MAC address ...
4
votes
0answers
484 views

Capturing Internet Connection Sharing (ICS) traffic using Fiddler

Does anyone have any idea how to capture HTTP traffic that goes through my ICS connection? Full details: I have a PC connected to internet via Ethernet. PC has set up a Wifi Hotspot using Internet ...
2
votes
1answer
926 views

Record multicast stream on multi-homed Linux host

I have what sounds like the simplest possible use case, and yet nothing is satisfactory. I have a multi-homed host and I would like to listen to multicasts on eth1, and shove all the payload (NOT ...
1
vote
2answers
2k views

Wireshark - Help seeing all network traffic

I have a Ralink RT3290 802.11bgn Wi-Fi Adapter and am running Windows 8. Sadly although my new computer helps in the design and testing of my touch based applications, my Network Engineering abilities ...
0
votes
2answers
615 views

Sniffing network traffic these days

I've been always worrying about using HTTPS in all sites and using secure connections in Messenger, Email, etc, because I don't want people being able to read my private info or hacking my sessions on ...
2
votes
1answer
249 views

Follow a .pcap file in wireshark like tail -f

I have a .pcap file on my android device, that I can access from my PC with wireshark via smb and wondering if it possible to get a 'Live view' of that file in wireshark. Is there any solution?
2
votes
0answers
1k views

tcp port numbers reused on wireshark

I used raw socket to build a tcp client program on machine A to reproduce tcp 3-way handshake with a simple regular tcp server on machine B I captured packets on the client host and server host, and ...
0
votes
1answer
917 views

display and save only packet captured by filter

how can I let wireshark display only packets that are captured by a filter I don't want to have all packets, this takes a large memory space ?
0
votes
0answers
431 views

Analyzing home network traffic using wireshark

I am using wireshark to analyize my home netowrk traffic since it has become painfully slow (Slow download speeds) recently (restarting modem and MediaLink router didn't help, also upgraded the ...
1
vote
3answers
1k views

RS232 / Ethernet Port Servers - Protocols Involved?

Firstly, I'm not responsible for the equipment, so don't panic that I'm asking such basic questions :) At work we have multiple RS232 / Ethernet port servers (Say the 16 port version of this ...
0
votes
0answers
186 views

Traffic of virtual machine capture in ubuntu 12

I have ubuntu 12 running on my PC . On this Ubuntu, I have another linux distribution running on a virtual machine (virtual box). When I launch a ping from ubuntu to the virtual machine, the ping ...
0
votes
1answer
217 views

why does Wireshark on Mac OS X runs on X11?

I know little bit about X11 and i have used it for remotely interacting with my applications on my Linux machine. But I don't understand why running Wireshark locally will start an X11 process?
1
vote
3answers
5k views

Why does Wireshark show MAC addresses in the source\destination?

Every device on the my LAN should have IP's along with MAC addresses, and for most of the traffic Wireshark gets on me device, the source and destination columns shows IP addresses, but sometimes it ...
1
vote
0answers
664 views

Synergy choppiness: Is my wireless router delaying packets after silent period?

I am sharing keyboard and mouse between my Linux desktop and MacBook Air using Synergy. There is a very noticeable lag every time I begin moving my mouse (or start typing), but everything becomes ...
1
vote
1answer
327 views

Lightweight network packet capture solution for windows? [closed]

I'm looking for a lightweight packet capture solution for Windows. It needs to capture all packets on a physical network device and write them to a file (preferably .pcap, because that's easiest for ...
0
votes
0answers
254 views

DNS leak: Looking up own hostname with DNS queries

I was checking a proxied program for DNS leaks with tshark when I noticed this: 13.170066 10.0.2.15 -> 192.168.1.1 DNS 66 Standard query 0xd473 A [hostname] 13.753496 10.0.2.15 -> ...
0
votes
2answers
86 views

How to check the packets in wireshark while doing the internet

I am using Wireshark first time.Can we see the packet in wireshark while having the internet on the laptop(or PC). But I don't see any packet in wireshark.While I have internet connection. Please ...
0
votes
1answer
745 views

change Wireshark file (pcap file) via bittwiste (change ip)

i want to take pcap file and change all packet with specific ip to new ip and i know i can do it in this way: bittwiste.exe -I myFile.pcap -O newFile.pcap -T ip -s 192.0.16.50,61.68.133.207 ...
1
vote
2answers
1k views

Filter in Wireshark for TLS's Server Name Indication field

Does wireshark have a filter for TLS's Server Name Indication field?
0
votes
1answer
615 views

How do I capture 802.11 headers on an AP while not in monitor mode?

I am wondering if it is possible to extract 802.11 frames on a router running OpenWrt operating as an access point. I tried using tcpdump and loading the dumped packets in Wireshark, but I could only ...
0
votes
1answer
435 views

how to capture rsync traffic in wireshark

I want to analyse what raw-data rsync transfers across for a sample input file. So I am using rsync over rsh (As traffic captured in wireshark will be easy to interpret). I am using following rsync ...
-1
votes
2answers
686 views

Reconstructing web content through Wireshark

Suppose I have a Wireshark log of traffic from a web site. Can I reconstruct various elements like HTML file, picture files, java script files, etc? Ideally, it'd take the .pcap file and ...
1
vote
1answer
138 views

Capture internal ports

Is there any way to capture packets all through internal ports for ex: A packets from 192.168.2.79 4000 to 192.168.2.79 4001 In this case its a TCP connection and the packets will not flow out ...
1
vote
1answer
153 views

How to differentiate between three different flavours of pcap files?

There appears to be 3 different file formats associated with the ".pcap" extension -- libpcap /w microsecond timestamps, libpcap /w nanosecond timestamps, and pcapng. Is there an easy way to ...
0
votes
1answer
643 views

Orbit Download Manager massive send packets (no torrent)

recently I've noticed my internet connection speed is low even my modem console was opening very slow , after troubleshooting using Wireshark I've found massive packets send to "sg.ilovewebgame.co.kr" ...
2
votes
1answer
1k views

How to enable the TCP checksum validation in Tshark(Terminal WireShark)

When I run the command tshark -i 3 -c 100 -V less 1514 src 192.168.10.57 and dst 192.168.10.60 and tcp The output is: Transmission Control Protocol, Src Port: commplex-link (5001), Dst Port: ...
0
votes
1answer
1k views

DNS Queries Returning No Answer Section

I spent hours today trying to figure out why my own socket-level implementation of DIG in a browser is not working consistently. I would successfully send a DNS packet over UDP but would receive a ...
2
votes
3answers
3k views

Sniff traffic coming from one particular application?

Basically I'd like to sniff HTTP requests made by an .exe on Windows. I tried using wireshark, but it's somewhat unhandy since it sniffs all traffic on the interface. Are there any alternatives?
1
vote
1answer
373 views

IP checksum offload

I recently updated to Windows 8 and get alot of invalid packet transfers. It says "Ip checksum offload?" (Wireshark) and most of my packets get lost. The checksum is 0x00. I also updated my NIC ...
0
votes
2answers
3k views

Filter ICMP packets sent from my IP address in Wireshark with the Packet Filter

I want to filter the ICMP packets sent from my IP address in Wireshark. I tried the following expression: ip.src == xxx.xxx.xxx.xxx && icmp But the problem is that it shows packets with ...
5
votes
2answers
297 views

Remove/change private data (e.g. passwords)

Is it possible to remove/change packages captured with Wireshark? My Situation: I captured some packages and want to send them to somebody else. The problem is, that one of the packages contains ...
3
votes
2answers
9k views

How can I show only 127.0.0.1 traffic using Wireshark?

Every time I try to filter to just show a specific IP address, I get an error indicating that it is "not an interface or a field." I have no idea what that means. Furthermore, I don’t really see any ...
3
votes
1answer
421 views

How to properly use stunnel?

I'm trying to setup Wireshark ssl debugging, and to do this, I'm trying to follow instructions in this article. I'm currently at stunnel part, and I'm trying to execute sudo stunnel -p ps.pem -d ...
2
votes
1answer
426 views

How to protect Cisco router from getting hacked by Wireshark software? [closed]

I can see my user name and password of my router on my laptop with a second machine connected to my Cisco router, when I use Wireshark on the second machine. How do I protect myself from such ...
0
votes
1answer
255 views

Why do DNS queries use loopback interface?

Sniffing (using Wireshark), for didactical purpose, my loopback interface on Ubuntu 12.04, I noticed that a lot of DNS queries (maybe ALL of them) have 127.0.0.1 as source and destination address. ...
0
votes
2answers
1k views

launch wireshark in linux

I have wireshark-1.2.15-2.el6_2.1.x86_64.rpm installed on CentOS. I was hoping to see a command like "wireshark", but couldnt find it. How do i launch wireshark? After querying the rpm, following ...
0
votes
1answer
478 views

WireShark in Ubuntu 12.04

I'm new in UNIX. I've installed WireShark on Ubuntu 12.04 and there is no interface list in Capture section. There is only text "No interface can be used for capturing in this system with the current ...
2
votes
3answers
9k views

Wireshark Not Displaying Packets From Other Network Devices, Even in Promisc Mode

System Setup: MacBook Air running Mountain Lion and connected wirelessly to a router. Wireshark installed and capturing packets (I have "capture all in promiscuous mode" checked) I filter out all ...
1
vote
2answers
892 views

How to make wireshark show http protocol instead of 802.11?

I recorded the wlan traffic in my network and saved this as a pcap file. Now I'd like to see the recorded http traffic and filter for some parts of the http traffic. I can open the pcap file in ...
0
votes
1answer
153 views

Is there any software that uses SSDP protocol like iChat for windows 7

Is there any software that uses SSDP protocol like iChat for windows 7. The reason I want this so that I can communicate with other users on my same local area network. As I see a lot of SSDP ...