The network protocol analyzer developed and maintained by the Wireshark Foundation

learn more… | top users | synonyms

2
votes
1answer
86 views

Explanation of port protocols in Wireshark?

When using Wireshark you can display the packets with just the plain number of the port, or with a "transport layer name resolution" (via the View/Name Resolution menu, for example). Unfortunately, ...
0
votes
2answers
1k views

How can I tell if Wireshark has sucessfully decrypted a capture

I have used Microsoft Network Monitor 3.4 in Windows 7 to create a capture file from my wireless g network by setting monitor mode. When loaded into Wireshark I can see the four way handshake and I ...
1
vote
1answer
3k views

Promiscuous mode implies Monitor Mode compatibility?

I mean, I just want to put my wireless card interface into promiscuous mode to scan my wireless network I'm connected to. Do I necessarily need a monitor mode wifi card compatible? Should I ...
0
votes
1answer
511 views

How to get packets for a specific access point

I have Wireshark and Aircrack-ng and whenever I capture packets I don't know how to capture packets for a specific network (the network is "2WIRE207"). I need to do this so I can use Aircrack-ng.
0
votes
1answer
434 views

cannot capture packets on wireshark without internet

I am using Wireshark on my Windows 8.1 Pro 32-bit pa and whenever I start Wireshark without internet, it can't capture ant packets. But when I am connected to the internet, it captures packets form ...
1
vote
1answer
2k views

Can't install wireshark on Debian Linux

I'm trying to install Wireshark on Debian (Debian 3.2.51-1) but i'm getting this error: apt-get install wireshark Reading package lists... Done Building dependency tree Reading state ...
0
votes
0answers
65 views

Drop network packages

I'm seeing a lot more protocols in the wireshark capture in my university network than in my home network and the connection is incredibly bad at the university (> 2 Min. to get an IP address from ...
0
votes
0answers
48 views

cannot listen to interfaces without root privilege

for certain reason, I wanted to capture traffic without being root. Setup: Host: Ubuntu 3.11.0 Guest Ubuntu 3.13.0 Wireshark in Guest:1.10.8 I have done this trying to enable capturing without ...
0
votes
1answer
81 views

Filtering for IPs that send a packets of a certain length

I'm trying to find all the IP addresses that netflix uses to deliver content, as the lists I've found online do not include many of the servers that I've observed sending content. Is there any way in ...
0
votes
1answer
767 views

Remote Packet Capture using Wireshark

Well The scenario is that I have a Windows machine(at home) and a Linux box running headless Ubuntu server(without GUI) on a remote location. I got Wireshark installed on my windows machine, and ...
0
votes
1answer
1k views

Websocket handshake response not forwarded from TCP to client

I am trying to create a websocket server. I can see the websocket client's opening handhshake. My response to it is received by the client laptop (I can see this on wireshark). So the TCP connection ...
-2
votes
3answers
447 views

Is there a free program that can detect which device on my network is causing lag? [closed]

I'm on a small business network, and rarely we experience really extreme latency. I have no idea what device might be causing the lag, and wanted to know if there was a piece of software that could ...
1
vote
0answers
581 views

how to sniff from a TP-Link ADSL modem?

I have a PC and a tablet that connected to a TP-Link ADSL modem. PROBLEM: I want to see the packets that send and receive from my modem not my PC( to see both wire and wireless packets) I search ...
0
votes
0answers
3k views

WinPcap/Wireshark install: where is packet.dll?

I have Wireshark installed, and I'm getting this error: The NPF driver isn't running. You may have trouble capturing or listing interfaces. I realize this is something to do with WinPcap. It's ...
0
votes
2answers
446 views

Tshark is displaying “florence” and “eforward” rather than source/destination port numbers

I am running rawcap on windows7 loopback adapter. I have run telnet localhost 2181 15 Packets were generated. In order to view the output I ran wireshark\tshark -r \shared\pcap.pcap And here ...
3
votes
2answers
179 views

One arp request for two different pings

I pinged google and yahoo and captured the packets using wireshark and found that there was only one arp request for both of them. Can anyone explain why there is only one arp request for the two ...
0
votes
0answers
49 views

Multiple Packets info are clumping together in a single line while taking wireshark traces

I am facing a problem with Wireshark traces wherein the info from multiple packets is clumped in a single line (i.e. in single line multiple packets are displaying instead of each single packet being ...
1
vote
2answers
2k views

Using Wireshark to track traffic on a Windows Virtual WiFi Miniport

I have a Microsoft Virtual WiFi Miniport set up on my laptop with an Android phone connected to it. The laptop is then connected to the outside world through a wired connection. I would like to ...
0
votes
2answers
1k views

How to capture 802.1X EAPOL packets in windows 7?

I want to capture 802.11 EAPOL packets on windows 7,however,i fail to capture any EAPOL packet use wireshark.What tools can i use to capture the EAPOL packet? my environment is windows 7,wireshark 1....
0
votes
2answers
399 views

tcp retransmission on lan, wifi is fine

I have a Dell XPS 17 laptop (about 5 years old) running Windows 7 and a Synology RS412 NAS. I also have various other networked devices (servers, routers, laptops, pcs). Some are in my domain, some ...
2
votes
2answers
2k views

Real-time loopback interface packet capture on Windows with RawCap, Wireshark, and some pipe utility

After stumbling across another Super User post about loopback packet capture on Windows, I was directed to RawCap, a utility that provides pseudo-capture of loopback packets. RawCap writes to libpcap ...
0
votes
1answer
872 views

Problems using tshark sniffing TLS encrypted traffic with .pem key

I am having problems decrypting TLS encrypted syslog-ng packets in a honeynet using tshark (command line Wireshark). The goal is to be able to intercept the packets going from the honeypots to a ...
5
votes
2answers
13k views

Show only HTTP traffic in Wireshark

How can I filter out traffic that is not HTTP in Wireshark, so that it shows me only HTTP traffic, but not, TCP, DNS, SSDP, etc.
2
votes
1answer
2k views

.exe file (specifically Wireshark) will not launch anymore on Windows 8.1

I use Wireshark x64 daily in my work. Suddenly today, it refuses to open. When I doubleclick a pcap (or pcapng) file, Windows tells me the file I tried to click was not found. When I try to start ...
2
votes
2answers
5k views

Wireshark only capturing beacon frames

I am trying to sniff my own network to capture http traffic. On airodump my network security show "WPA - TKIP - PSK", so I went to Wireshark > Edit > Preferences > Protocols > IEEE 802.11 > Enabled ...
0
votes
0answers
66 views

Unable to intercept data intended for gateway by using ARP

I am having trouble with what seems to be a very simple problem. I manage to be able to successfully spoof the ARP table of one computer on my network (as reported by arp -a). But even enabling a ...
1
vote
0answers
324 views

RST, ACK from 216.98.48.133 without any SYN from me? For real? How? Why?

I am trying to figure out why I always get "The Ubisoft server is not available at the time. Please try again later." Apparently, the server is actually up and running, so it seems the problem is on ...
-1
votes
1answer
80 views

How to sniff download information of different pc's on a network(router) [closed]

I am making a Log Analyzer for downloads on a network by different users. So I want to know who downloaded what in the same network (WLAN). How can I sniff this information from other users of the ...
1
vote
2answers
1k views

Simple http traffic monitor (capture by process) [closed]

I know, questions like this have been asked a lot before. I have a big problem using Wireshark because of the following reasons: It is not able to trace down which process sent/received a packet ...
0
votes
0answers
252 views

Wireshark Capture Filter

I am new to wireshark and I am trying to capture an ICMP packet over 802.11g, I am using windows and pingplotter. The issue is that on wireshark capture I am not getting any ICMP packets no matter how ...
0
votes
1answer
366 views

Intercept HTTPS traffic of a IP energy consumption monitor device

I have this device connected to my home network, and I'm curious about what it's sending to the Internet. It seems to generate a lot of traffic. I've connected it to my laptop and I've shared the ...
1
vote
2answers
719 views

Wireshark filtering for one network

How do i make Wireshark filter results so it just shows results from one wifi net work. I have had a look on Google but found nothing. Can any one help.
1
vote
3answers
195 views

Bandwidth monitoring grouped by domain/process

Under Windows platform, what is the simplest way to achieve bandwidth monitoring with the following grouping use cases: monitor all incoming/outgoing bandwidth grouped by domain/ip (http requests ...
0
votes
1answer
833 views

Wireshark merging pcap files

I'm trying to merge 15 pcap files using wireshark. The merging is successful. I'm using the appending function so that the second file is just added to the bottom of the first file. But when this is ...
1
vote
1answer
204 views

How does a packet of RDP mouse/keyboard click look?

I just cant find it on wireshark when sniffing the RDP connection.. Can anyone show me how they look and how can I distinguish between them? Of course it would be encrypted but the main question is ...
0
votes
1answer
72 views

Store handshake to use later

I successfully captured my client's 4WHS with airodump-ng and Wireshark is decrypting everthing corectly. I decided to store the 4WHS in a cap file, the idea is that when I do a new capture I don't ...
0
votes
1answer
472 views

How I can start to capture packets and saving it by command line using Wireshark

Could you tell me how I can start to capture packets with specific interface by command line and saving it by command line using Wireshark? I would like to save it on my Desktop. OS X 10.9.2 ...
0
votes
1answer
58 views

Get external email from action “mailto”-form

Is it possible to pick out the email adress that a "mailto"-form will send an external email to? example from this (swedish "ebay" - ad) http://www2.blocket.se/ar/form/0?id=52142799&ca=1_8&l=...
2
votes
1answer
420 views

Eavesdropping on a WPA2 (PSK) network

I’m trying to capture frames sent and / or received by other clients on my wireless (WPA2-PSK) network. I installed Wireshark, activated the promiscuous mode and set the decryption key, but I’m unable ...
1
vote
2answers
889 views

Wireshark, Find Protocol Layers

I'm using Wireshark to analyze network traffic. I'm a bit confused by what's displayed under the "Protocol" column. If I'm not mistaken, DNS and HTTP are Application layer protocols while TCP is ...
1
vote
1answer
94 views

Looking for a tool to inspect HTTP data between a mobile phone and AV receiver [closed]

I am trying to dissect the protocol used by my AV receiver and its mobile app on my phone. Basically, I'd like to see all the GET/POST requests from the app on the phone and the responses from the ...
0
votes
1answer
195 views

Wireshark with lua

I have installed wireshark on my Centos Machine. I want an auto script for it and i am planning to script it using LUA. However, my wireshark is without LUA. How to enable wireshark which allows LUA ...
0
votes
1answer
478 views

Mismatch between libpcap configured snap length and actual capture length

I have a couple of pcap files where the capture length reported by Wireshark is larger than the actual capture length. The difference is 10 bytes, and I don't understand why it reports this higher ...
1
vote
1answer
81 views

Combining two linux commands

Im trying to use mergecap to merge 15 old pcap files in a folder. I tried to use FILES=($(find /mnt/md0/capture/DCN/ -maxdepth 1 -type f -name "*.pcap" -print0 | xargs -0 ls -lt | tail -15 | awk '{...
1
vote
0answers
174 views

mergecap fails to create output file when run from crontab

I have created a script to merge pcap files using 'mergecap -w '. The script doesn't work as the output file is not already present. So I tried to use 'touch outputfile.pcap' before the mergecap ...
1
vote
3answers
4k views

SSL (imap) doesn't work from some machines - ssl handshake failure - how to narrow down further?

A few days ago our IMAP SSL (port 993) connections stopped working from our home network two Windows 7 PCs in our home network. Two other PCs, one with Windows XP, one also with Win7 professional ...
0
votes
0answers
25 views

Configure Fiddler to capture from bridged network or specific network adapter [duplicate]

Is it possible to configure Fiddler to capture from a bridged network or specific network adapter? I have a TV plugged into my PC network card. Wireshark sees all packets to and from the TV but ...
1
vote
0answers
30 views

Utility service that logs total network usage

I would like to know the total bandwidth our internet provider essentially provides to the many competing devices in our home. Is there a simple windows service that uses a wireshark like trick to log ...
2
votes
1answer
107 views

Simple way of demonstrating that a VPN is working, that is easy for novices to understand/comprehend?

I am developing a Linux-based security appliance. One of its functions is to cloak a user's traffic within a VPN, and I need a simple way of demonstrating that this function is working properly, and ...
0
votes
0answers
137 views

How to send packet on tor network to get back to my computer?

Can anyone tell me how to configure system (I think Linux is the best option for this) to be able to send packet by Tor Network back to my own computer? I have to conduct research on how it behaves (I ...