Open-source network packet analyzer

learn more… | top users | synonyms

1
vote
2answers
2k views

Wireshark - Help seeing all network traffic

I have a Ralink RT3290 802.11bgn Wi-Fi Adapter and am running Windows 8. Sadly although my new computer helps in the design and testing of my touch based applications, my Network Engineering abilities ...
0
votes
2answers
585 views

Sniffing network traffic these days

I've been always worrying about using HTTPS in all sites and using secure connections in Messenger, Email, etc, because I don't want people being able to read my private info or hacking my sessions on ...
2
votes
1answer
239 views

Follow a .pcap file in wireshark like tail -f

I have a .pcap file on my android device, that I can access from my PC with wireshark via smb and wondering if it possible to get a 'Live view' of that file in wireshark. Is there any solution?
2
votes
0answers
1k views

tcp port numbers reused on wireshark

I used raw socket to build a tcp client program on machine A to reproduce tcp 3-way handshake with a simple regular tcp server on machine B I captured packets on the client host and server host, and ...
0
votes
1answer
866 views

display and save only packet captured by filter

how can I let wireshark display only packets that are captured by a filter I don't want to have all packets, this takes a large memory space ?
0
votes
0answers
415 views

Analyzing home network traffic using wireshark

I am using wireshark to analyize my home netowrk traffic since it has become painfully slow (Slow download speeds) recently (restarting modem and MediaLink router didn't help, also upgraded the ...
1
vote
3answers
1k views

RS232 / Ethernet Port Servers - Protocols Involved?

Firstly, I'm not responsible for the equipment, so don't panic that I'm asking such basic questions :) At work we have multiple RS232 / Ethernet port servers (Say the 16 port version of this ...
0
votes
0answers
184 views

Traffic of virtual machine capture in ubuntu 12

I have ubuntu 12 running on my PC . On this Ubuntu, I have another linux distribution running on a virtual machine (virtual box). When I launch a ping from ubuntu to the virtual machine, the ping ...
0
votes
1answer
212 views

why does Wireshark on Mac OS X runs on X11?

I know little bit about X11 and i have used it for remotely interacting with my applications on my Linux machine. But I don't understand why running Wireshark locally will start an X11 process?
1
vote
3answers
5k views

Why does Wireshark show MAC addresses in the source\destination?

Every device on the my LAN should have IP's along with MAC addresses, and for most of the traffic Wireshark gets on me device, the source and destination columns shows IP addresses, but sometimes it ...
1
vote
0answers
609 views

Synergy choppiness: Is my wireless router delaying packets after silent period?

I am sharing keyboard and mouse between my Linux desktop and MacBook Air using Synergy. There is a very noticeable lag every time I begin moving my mouse (or start typing), but everything becomes ...
1
vote
1answer
311 views

Lightweight network packet capture solution for windows? [closed]

I'm looking for a lightweight packet capture solution for Windows. It needs to capture all packets on a physical network device and write them to a file (preferably .pcap, because that's easiest for ...
0
votes
0answers
253 views

DNS leak: Looking up own hostname with DNS queries

I was checking a proxied program for DNS leaks with tshark when I noticed this: 13.170066 10.0.2.15 -> 192.168.1.1 DNS 66 Standard query 0xd473 A [hostname] 13.753496 10.0.2.15 -> ...
0
votes
2answers
86 views

How to check the packets in wireshark while doing the internet

I am using Wireshark first time.Can we see the packet in wireshark while having the internet on the laptop(or PC). But I don't see any packet in wireshark.While I have internet connection. Please ...
0
votes
1answer
714 views

change Wireshark file (pcap file) via bittwiste (change ip)

i want to take pcap file and change all packet with specific ip to new ip and i know i can do it in this way: bittwiste.exe -I myFile.pcap -O newFile.pcap -T ip -s 192.0.16.50,61.68.133.207 ...
1
vote
2answers
1k views

Filter in Wireshark for TLS's Server Name Indication field

Does wireshark have a filter for TLS's Server Name Indication field?
0
votes
1answer
593 views

How do I capture 802.11 headers on an AP while not in monitor mode?

I am wondering if it is possible to extract 802.11 frames on a router running OpenWrt operating as an access point. I tried using tcpdump and loading the dumped packets in Wireshark, but I could only ...
0
votes
1answer
415 views

how to capture rsync traffic in wireshark

I want to analyse what raw-data rsync transfers across for a sample input file. So I am using rsync over rsh (As traffic captured in wireshark will be easy to interpret). I am using following rsync ...
-1
votes
2answers
640 views

Reconstructing web content through Wireshark

Suppose I have a Wireshark log of traffic from a web site. Can I reconstruct various elements like HTML file, picture files, java script files, etc? Ideally, it'd take the .pcap file and ...
1
vote
1answer
136 views

Capture internal ports

Is there any way to capture packets all through internal ports for ex: A packets from 192.168.2.79 4000 to 192.168.2.79 4001 In this case its a TCP connection and the packets will not flow out ...
1
vote
1answer
147 views

How to differentiate between three different flavours of pcap files?

There appears to be 3 different file formats associated with the ".pcap" extension -- libpcap /w microsecond timestamps, libpcap /w nanosecond timestamps, and pcapng. Is there an easy way to ...
0
votes
1answer
631 views

Orbit Download Manager massive send packets (no torrent)

recently I've noticed my internet connection speed is low even my modem console was opening very slow , after troubleshooting using Wireshark I've found massive packets send to "sg.ilovewebgame.co.kr" ...
2
votes
1answer
1k views

How to enable the TCP checksum validation in Tshark(Terminal WireShark)

When I run the command tshark -i 3 -c 100 -V less 1514 src 192.168.10.57 and dst 192.168.10.60 and tcp The output is: Transmission Control Protocol, Src Port: commplex-link (5001), Dst Port: ...
0
votes
1answer
1k views

DNS Queries Returning No Answer Section

I spent hours today trying to figure out why my own socket-level implementation of DIG in a browser is not working consistently. I would successfully send a DNS packet over UDP but would receive a ...
2
votes
3answers
3k views

Sniff traffic coming from one particular application?

Basically I'd like to sniff HTTP requests made by an .exe on Windows. I tried using wireshark, but it's somewhat unhandy since it sniffs all traffic on the interface. Are there any alternatives?
1
vote
1answer
364 views

IP checksum offload

I recently updated to Windows 8 and get alot of invalid packet transfers. It says "Ip checksum offload?" (Wireshark) and most of my packets get lost. The checksum is 0x00. I also updated my NIC ...
0
votes
2answers
3k views

Filter ICMP packets sent from my IP address in Wireshark with the Packet Filter

I want to filter the ICMP packets sent from my IP address in Wireshark. I tried the following expression: ip.src == xxx.xxx.xxx.xxx && icmp But the problem is that it shows packets with ...
5
votes
2answers
273 views

Remove/change private data (e.g. passwords)

Is it possible to remove/change packages captured with Wireshark? My Situation: I captured some packages and want to send them to somebody else. The problem is, that one of the packages contains ...
3
votes
2answers
9k views

How can I show only 127.0.0.1 traffic using Wireshark?

Every time I try to filter to just show a specific IP address, I get an error indicating that it is "not an interface or a field." I have no idea what that means. Furthermore, I don’t really see any ...
3
votes
1answer
405 views

How to properly use stunnel?

I'm trying to setup Wireshark ssl debugging, and to do this, I'm trying to follow instructions in this article. I'm currently at stunnel part, and I'm trying to execute sudo stunnel -p ps.pem -d ...
2
votes
1answer
422 views

How to protect Cisco router from getting hacked by Wireshark software? [closed]

I can see my user name and password of my router on my laptop with a second machine connected to my Cisco router, when I use Wireshark on the second machine. How do I protect myself from such ...
0
votes
1answer
245 views

Why do DNS queries use loopback interface?

Sniffing (using Wireshark), for didactical purpose, my loopback interface on Ubuntu 12.04, I noticed that a lot of DNS queries (maybe ALL of them) have 127.0.0.1 as source and destination address. ...
0
votes
2answers
1k views

launch wireshark in linux

I have wireshark-1.2.15-2.el6_2.1.x86_64.rpm installed on CentOS. I was hoping to see a command like "wireshark", but couldnt find it. How do i launch wireshark? After querying the rpm, following ...
0
votes
1answer
476 views

WireShark in Ubuntu 12.04

I'm new in UNIX. I've installed WireShark on Ubuntu 12.04 and there is no interface list in Capture section. There is only text "No interface can be used for capturing in this system with the current ...
2
votes
3answers
8k views

Wireshark Not Displaying Packets From Other Network Devices, Even in Promisc Mode

System Setup: MacBook Air running Mountain Lion and connected wirelessly to a router. Wireshark installed and capturing packets (I have "capture all in promiscuous mode" checked) I filter out all ...
1
vote
2answers
857 views

How to make wireshark show http protocol instead of 802.11?

I recorded the wlan traffic in my network and saved this as a pcap file. Now I'd like to see the recorded http traffic and filter for some parts of the http traffic. I can open the pcap file in ...
0
votes
1answer
149 views

Is there any software that uses SSDP protocol like iChat for windows 7

Is there any software that uses SSDP protocol like iChat for windows 7. The reason I want this so that I can communicate with other users on my same local area network. As I see a lot of SSDP ...
0
votes
1answer
382 views

How to get RSSI values in wireshark captures

I'm running Mountain Lion and have Wireshark 1.8.3. I want to display the RSSI of each packet but I seem unable to do so. I went to Edit->Preferences->User Interface->Columns and select RSSI to be ...
0
votes
0answers
421 views

Wireshark does not show any HTTP traffic

My PC is running windows XP. I have been trying to capture HTTP traffic but if I apply the following filters, the Wireshark gives results not required http result: it only show ssdp traffic http ...
4
votes
2answers
1k views

How can I get Wireshark with a GUI on my EC2?

I have an Amazon EC2 machine that I'd like to run Wireshark on, using X forwarding. Unfortunately, the only Wireshark packages found with $ yum search wireshark are: wireshark-devel.x86_64 ...
1
vote
1answer
444 views

Need advice on using Wireshark + aircrack-ng

I am making acquiantance with wireless security and attacks and was told to run some tests with aircrack-ng and wireshark. So I installed both of them and ran airmon to switch wi-fi card to monitor ...
0
votes
1answer
535 views

Can't display RSSI values in Wireshark

I am trying to analyze the up-link Wireless traffic generated by my Sony Ericsson phone and captured by my D-Link router, on which I installed the DD-WRT firmware. To do this, first I log in the ...
1
vote
4answers
3k views

Installing WinPcap on Windows 8

I know there has been lots of discussion already on installing WinPcap on Windows 8. I'm running the RTM version. I was able to install WinPcap without a hitch by using the Windows 7 compatibility ...
2
votes
0answers
358 views

Decode SSL packets in WireShark

I have cert.cer, base64 x509 and a Wireshark dump in .pcap format. The packets are encoded, so how do I decode them? Now: [site-ip],443,http,xe.cer but it's still not working.
4
votes
1answer
4k views

Why does a PING reply require an ARP request for the originating hosts MAC?

I have a scenario as depicted below. Here two host machines are connected via a hub: Ok, so host-1 wants to ping host-2 and i have setup wireshark on a 3rd host connected to the same hub. Now ...
0
votes
2answers
5k views

Monitor Mode on the Intel Centrino(R) Advanced-N 6205 (WEP Penetration) On Windows

Can anyone tell me a way to do WEP hacking (legal, of course) (on my own wireless connection, for the purposes of this question) with Wireshark or similar programs on an Intel Centrino Advanced-N ...
0
votes
2answers
563 views

How can I filter out a large number of addresses in Wireshark

I'm looking to create a "blacklist" of IP addresses that Wireshark will ignore. I'm monitoring traffic originating on an iPhone, and there's a lot of chatter from Apple, Google Services, etc. I never ...
4
votes
1answer
2k views

How to determine what program send the packet recorded in Wireshark?

I was taking some tutorials on Wireshark in order to analyze the packets sent and received when talking to a web server for purposes of learning. When I start listening/recording packets in ...
1
vote
2answers
819 views

Tracking Wireless Network Usage

How do you determine the overall bandwidth usage for each computer connected to a wireless network? I manage a small wireless network consisting of a couple of cheap Cisco/Linksys wifi routers. ...
2
votes
1answer
1k views

need display filter to display tcp packets of non zero payload in wireshark

i have a pcap which contains only tcp packets. now i want to see only those packets which have non zero payload length. can someone please let me know which display filter to use ? using data.len or ...