Open-source network packet analyzer

learn more… | top users | synonyms

2
votes
3answers
3k views

Sniff traffic coming from one particular application?

Basically I'd like to sniff HTTP requests made by an .exe on Windows. I tried using wireshark, but it's somewhat unhandy since it sniffs all traffic on the interface. Are there any alternatives?
1
vote
1answer
355 views

IP checksum offload

I recently updated to Windows 8 and get alot of invalid packet transfers. It says "Ip checksum offload?" (Wireshark) and most of my packets get lost. The checksum is 0x00. I also updated my NIC ...
0
votes
2answers
2k views

Filter ICMP packets sent from my IP address in Wireshark with the Packet Filter

I want to filter the ICMP packets sent from my IP address in Wireshark. I tried the following expression: ip.src == xxx.xxx.xxx.xxx && icmp But the problem is that it shows packets with ...
5
votes
2answers
240 views

Remove/change private data (e.g. passwords)

Is it possible to remove/change packages captured with Wireshark? My Situation: I captured some packages and want to send them to somebody else. The problem is, that one of the packages contains ...
3
votes
2answers
8k views

How can I show only 127.0.0.1 traffic using Wireshark?

Every time I try to filter to just show a specific IP address, I get an error indicating that it is "not an interface or a field." I have no idea what that means. Furthermore, I don’t really see any ...
3
votes
1answer
375 views

How to properly use stunnel?

I'm trying to setup Wireshark ssl debugging, and to do this, I'm trying to follow instructions in this article. I'm currently at stunnel part, and I'm trying to execute sudo stunnel -p ps.pem -d ...
2
votes
1answer
403 views

How to protect Cisco router from getting hacked by Wireshark software? [closed]

I can see my user name and password of my router on my laptop with a second machine connected to my Cisco router, when I use Wireshark on the second machine. How do I protect myself from such ...
0
votes
1answer
223 views

Why do DNS queries use loopback interface?

Sniffing (using Wireshark), for didactical purpose, my loopback interface on Ubuntu 12.04, I noticed that a lot of DNS queries (maybe ALL of them) have 127.0.0.1 as source and destination address. ...
0
votes
2answers
1k views

launch wireshark in linux

I have wireshark-1.2.15-2.el6_2.1.x86_64.rpm installed on CentOS. I was hoping to see a command like "wireshark", but couldnt find it. How do i launch wireshark? After querying the rpm, following ...
0
votes
1answer
466 views

WireShark in Ubuntu 12.04

I'm new in UNIX. I've installed WireShark on Ubuntu 12.04 and there is no interface list in Capture section. There is only text "No interface can be used for capturing in this system with the current ...
2
votes
3answers
8k views

Wireshark Not Displaying Packets From Other Network Devices, Even in Promisc Mode

System Setup: MacBook Air running Mountain Lion and connected wirelessly to a router. Wireshark installed and capturing packets (I have "capture all in promiscuous mode" checked) I filter out all ...
1
vote
2answers
819 views

How to make wireshark show http protocol instead of 802.11?

I recorded the wlan traffic in my network and saved this as a pcap file. Now I'd like to see the recorded http traffic and filter for some parts of the http traffic. I can open the pcap file in ...
0
votes
1answer
143 views

Is there any software that uses SSDP protocol like iChat for windows 7

Is there any software that uses SSDP protocol like iChat for windows 7. The reason I want this so that I can communicate with other users on my same local area network. As I see a lot of SSDP ...
0
votes
1answer
358 views

How to get RSSI values in wireshark captures

I'm running Mountain Lion and have Wireshark 1.8.3. I want to display the RSSI of each packet but I seem unable to do so. I went to Edit->Preferences->User Interface->Columns and select RSSI to be ...
0
votes
0answers
400 views

Wireshark does not show any HTTP traffic

My PC is running windows XP. I have been trying to capture HTTP traffic but if I apply the following filters, the Wireshark gives results not required http result: it only show ssdp traffic http ...
4
votes
2answers
938 views

How can I get Wireshark with a GUI on my EC2?

I have an Amazon EC2 machine that I'd like to run Wireshark on, using X forwarding. Unfortunately, the only Wireshark packages found with $ yum search wireshark are: wireshark-devel.x86_64 ...
1
vote
1answer
436 views

Need advice on using Wireshark + aircrack-ng

I am making acquiantance with wireless security and attacks and was told to run some tests with aircrack-ng and wireshark. So I installed both of them and ran airmon to switch wi-fi card to monitor ...
0
votes
1answer
499 views

Can't display RSSI values in Wireshark

I am trying to analyze the up-link Wireless traffic generated by my Sony Ericsson phone and captured by my D-Link router, on which I installed the DD-WRT firmware. To do this, first I log in the ...
1
vote
4answers
2k views

Installing WinPcap on Windows 8

I know there has been lots of discussion already on installing WinPcap on Windows 8. I'm running the RTM version. I was able to install WinPcap without a hitch by using the Windows 7 compatibility ...
2
votes
0answers
351 views

Decode SSL packets in WireShark

I have cert.cer, base64 x509 and a Wireshark dump in .pcap format. The packets are encoded, so how do I decode them? Now: [site-ip],443,http,xe.cer but it's still not working.
4
votes
1answer
4k views

Why does a PING reply require an ARP request for the originating hosts MAC?

I have a scenario as depicted below. Here two host machines are connected via a hub: Ok, so host-1 wants to ping host-2 and i have setup wireshark on a 3rd host connected to the same hub. Now ...
0
votes
2answers
5k views

Monitor Mode on the Intel Centrino(R) Advanced-N 6205 (WEP Penetration) On Windows

Can anyone tell me a way to do WEP hacking (legal, of course) (on my own wireless connection, for the purposes of this question) with Wireshark or similar programs on an Intel Centrino Advanced-N ...
0
votes
2answers
523 views

How can I filter out a large number of addresses in Wireshark

I'm looking to create a "blacklist" of IP addresses that Wireshark will ignore. I'm monitoring traffic originating on an iPhone, and there's a lot of chatter from Apple, Google Services, etc. I never ...
4
votes
1answer
2k views

How to determine what program send the packet recorded in Wireshark?

I was taking some tutorials on Wireshark in order to analyze the packets sent and received when talking to a web server for purposes of learning. When I start listening/recording packets in ...
1
vote
2answers
779 views

Tracking Wireless Network Usage

How do you determine the overall bandwidth usage for each computer connected to a wireless network? I manage a small wireless network consisting of a couple of cheap Cisco/Linksys wifi routers. ...
2
votes
1answer
1k views

need display filter to display tcp packets of non zero payload in wireshark

i have a pcap which contains only tcp packets. now i want to see only those packets which have non zero payload length. can someone please let me know which display filter to use ? using data.len or ...
1
vote
1answer
224 views

Unknown Inbound UTP Packets

I need some help figuring out something. I was looking at my network traffic using Wireshark and I saw a bunch of inbound UTP (uTorrent Transport Protocol) packets to my IP. About 10 different IP's ...
5
votes
4answers
47k views

What's all this deploy.akamaitechnologies.com traffic?

I happened to do a tcpdump while leaving my Mac idle, and when I came back after a mere half-hour there were something like 5000 packets involving deploy.akamaitechnologies.com, in which my computer ...
0
votes
2answers
1k views

Wireshark: there are no interfaces on which a capture can be done

I've made all steps described in wiki.wireshark.org/CaptureSetup/CapturePrivileges, but I still get next error message There are no interfaces on which a capture can be done. Where I've made a ...
1
vote
3answers
748 views

Capture/Peek WiFi data traffic?

My goal: I want to analyze the network protocols of a wireless device on my net. I've successfully set my linux laptop into monitor and promiscuous mode for its wifi interface. I used airmon-ng to ...
2
votes
2answers
471 views

Program to record data transmission between two computers using a TCP port

I am looking for a way to view data being transmitted over a TCP port between two computers. Is there a software package that allows this? I suppose I could script something to re-route data coming ...
1
vote
1answer
287 views

How to enter pcap filter in Wireshark 1.8?

Previously in capture options window there was a very handy input field for pcap filter expression. But in 1.8.* this window looks different: So, how to set pcap filter expression before starting ...
0
votes
1answer
2k views

How to extract mpeg-1 stream from pcap in wireshark

I have a pcap network dump that has an MPEG-1 stream inside and I would like to play the mpeg stream. So far I've tried playing through the RTP analyzer but that plays without any sound. I've also ...
2
votes
2answers
1k views

Wireshark: Accessing USB Bus Interfaces without sudo

I am trying to monitor some USB traffic using Wireshark on Linux (Ubuntu). If I start Wireshark as my normal user without root privileges, the USB bus interfaces are not listed. If I sudo wireshark ...
1
vote
3answers
387 views

Why would my network slow down?

The network at my work has about 40 computers on it and a quite a few printers. When there are a lot of people working the network will be slow. I can test the ping between my computer and the router ...
0
votes
1answer
116 views

Why does Windows constantly ping wireless network bridge?

I was looking at a Wireshark capture off my Windows XP box, and I noticed a rather curious behavior. Every 1-2 seconds, the machine sends a ping request to my Linksys WET610N wireless network bridge, ...
3
votes
0answers
2k views

Having trouble Getting “RTSP over HTTP”

There is an axis camera that is connected to our site (camba.tv) through axis one click connection component (which acts as proxy). We can communicate with this camera only through http by setting the ...
1
vote
1answer
376 views

Wireshark RPC packet capture with localhost

I want to capture RPC-XML packets on locahost using wireshark. As RPC-XML is at the top of tcp/udp, I enabled all protocols still I am not able to capture the traffic. Is there other way to do so? I ...
2
votes
1answer
448 views

What do these fields mean in Wireshark?

What does the following mean in the info section of wireshark? Source Client Destination Server Protocol HTTP Length 522 Info 522 GET /intl/en/images/logo.gif HTTP/1.1 More ...
0
votes
1answer
429 views

HDI: Capture specific content types in wireshark?

I've been tasked to audit in/outbound traffic at our site, but I don't know much about Wireshark. I understand how to set up a capture filter for broad protocols (IP only or tcp, udp, icmp, etc), but ...
2
votes
1answer
778 views

Sniffing SSL Traffic with Wireshark Locally

I ahve an application that is submitting and recieving information via HTTPS. If I place wireshark on the same box and the client. Will I be able to decrypt all of the data within the communication ...
1
vote
1answer
4k views

How to set intel centrino advanced-n 6205 in “monitor mode” in Windows 7 (32bit) and Wireshark

I've just installed Wireshark on my laptop and can't see it's working in "monitor mode". Logically I'm not connected with my home network, do I have to be able to monitor my ipads traffic? WinPCAP ...
0
votes
2answers
329 views

One VoIP conversation but two RTP streams?

I'm testing a VoIP system based on OpenSIPS. It has no RTPproxy, so calls do not pass through OpenSIPS. I tried to make a call between two smartphones, and it succeeded. I also turned on Wireshark, ...
1
vote
2answers
1k views

Do machines connected to the same switch belong to the same subnet?

When we talk about a subnet - do we mean all the systems connected to the same switch? If I have an assigned IP address of 10.0.2.1, am I in the same subnet as that of 10.0.1.39? When we talk about ...
2
votes
3answers
1k views

Wireshark on home-network

So basically I want to make WireShark ( Windows ) capture packets of the home network. As you know, home-networks are usually set by local IPs ( 192.168 or 10.0 range ) instead of the WAN IP so if we ...
0
votes
0answers
160 views

Saving traffic on a port to pcap format using an active intermediary

I have a service which listens on host1:5000. My intention is to redirect my client to localhost:5000. What I desire is a service running on localhost:5000 that redirects all traffic to host1:5000 ...
1
vote
2answers
5k views

What is the protocol 'ftp-data' identified by wireshark?

Just implementing a FTP server and use wireshark to analize the protocol. I find there is a protocol identified by wireshark FTP-DATA. What is that? Any document or RFC can be referred? Thanks and ...
1
vote
1answer
3k views

Windows 7 PC sends a lot of NetBIOS Name Queries for non-existent computer names

I have a Windows 7 PC, and have been monitoring network traffic using Wireshark, and I'm seeing this PC send out a lot of NetBIOS Name Queries for non-existent computer names. These are some of the ...
2
votes
1answer
4k views

How can I stop my computer from doing arp poisoning attacks?

I have a small LAN in my home about 4 - 5 computers. The problem is that when there are usually 3 or more pc's online we keep losing the Internet access randomly about every 2 minutes. So we took a ...
0
votes
1answer
993 views

running tshark command in windows batch file

I have written a batch file that runs a tshark command to filter fields from a wireshark pcap file and write them to a csv file. When i ran on the windows cmd CLI, i had to change the current working ...