Open-source network packet analyzer

learn more… | top users | synonyms

10
votes
4answers
9k views

Wireshark WPA 4-way handshake

From this wiki page: WPA and WPA2 use keys derived from an EAPOL handshake to encrypt traffic. Unless all four handshake packets are present for the session you're trying to decrypt, Wireshark ...
1
vote
1answer
426 views

Replace sensitive IP addresses in Wireshark with XXX.XXX.XXX.XXX

What would be an easy way to replace a sensitive IP address in a Wireshark packet capture with XXX.XXX.XXX.XXX? When I export the pcap in txt or csv I can no longer import it into Wireshark.
0
votes
1answer
337 views

Wireshark: Byte order changes when data exported

I am looking at a packet capture in Wireshark and try to export the data from a packet. In Wireshark, it looks like this: 46 a5 e2 fb bd 69 ... Then, after downloading, hexdump shows: a5 46 fb e2 ...
2
votes
1answer
2k views

Cannot connect to website - SSL handshaking fails

So I cannot connect to certain websites. Just a few, most are OK. The one I really care about is paypal.com. I have done the usual things. Let's see: Cleared browsing history Tried different ...
12
votes
2answers
14k views

How do I decrypt WPA2 encrypted packets using Wireshark?

I am trying to decrypt my WLAN data with Wireshark. I have already read and tried eveything on this page but without any success (well, I tried the example dump on that page and succeeded, but I fail ...
1
vote
2answers
465 views

how to find tcp streams without final ack/fin sequence in a huge packet capture file

I have a huge pcap file which contains a large number of individual tcp streams.But out of these , there are some invalid streams which dont have the final fin/ack sequence. Is there any way i can ...
0
votes
1answer
626 views

Do the “follow TCP stream” option in wireshark include duplicate packets?

When I tried to follow a TCP stream in wireshark, I found some duplicate packets. I wanted to know whether wireshark excludes duplicate(or retransmission) TCP packets from the "follow TCP stream" ...
-1
votes
1answer
246 views

I can not see ipv4 and http, I can just see ipv6 and SSDP [closed]

I have a real huge problem, when I am connected through the wireless of my university, I can just see adresses like this : 1823731 14856.287768 fe80::74b6:2d79:4343:41e1 ff02::c SSDP ...
1
vote
1answer
2k views

Why can't Wireshark read packets from ping?

I have Wireshark started, then I ping an IP address. But Wireshark is not picking up any packet sending to or receiving (echoing) from the destination address. Why? Is ping "protected" from being ...
3
votes
1answer
393 views

Wireshark and promiscous mode

I am using Wireshark for class. Does Wireshark put your card in promiscuous mode automatically, or must you manually do it? I've searched everywhere I can, and cannot find the answer. I have it ...
1
vote
2answers
5k views

Decrypting SSL traffic in Wireshark. Only headers get decrypted

I'm trying to decrypt SSL traffic in Wireshark, and it partially works because I'm able to view the decrypted headers. The problem is that I don't see any of the packet contents, only their headers. ...
2
votes
5answers
15k views

How do I limit packet capturing in Wireshark to only a specific protocol?

I would like to listen to HTTP traffic on port 8080. When I start capturing packets in Wireshark, it's flooded by packets using the SSDP protocol on port 1900. I would like to limit the packet ...
0
votes
1answer
999 views

How to set Wireshark to log ONLY DNS requests?

This works: tethereal -i eth0 -w /root/mycapture.pcap but it captures every packet. I only need to capture DNS requests. Is this possible? The server is Linux. Other thing is: is it possible to ...
3
votes
5answers
3k views

Wireshark (Linux) captures only packet from and to my PC when in promiscuous mode

I've installed Wireshark and configured it to let my user run it with all needed privileges (I enabled dumpcap and added my user to wireshark group, then restarted). Devices are shown and capture ...
1
vote
1answer
698 views

Filtering sniffed logs using Wireshark

I'm experimenting with packet sniffing and log examination using Wireshark, and I'm quickly realizing that I'm not nearly as safe as I should be when using public hot spots. In efforts to better ...
0
votes
1answer
174 views

What is fjappmgrbulk?

I captured a udp packet from wireshark which ones port is 2510 and destination ip is 81.64.155.202. What is that port for? I found this post) mentioning: "it's for fjappmgrbulk, fjappmgrbulk ...
1
vote
1answer
1k views

Trying convert webserver certificate to PEM file for wireshark to monitor ssl traffic in HTTP format

I am trying to monitor https traffic as readable HTML. I have downloaded the certificate from the server. "In Internet Explorer, I selected the certificate and copy to file, DER encoded binary X.509 ...
4
votes
1answer
741 views

Vista DPI Scaling: Cannot disable DPI Scaling for Wireshark

I'm trying to disable dpi scaling for Wireshark, except Windows won't let me: Yet i pick any other random executable in the folder, uninstall.exe for instance, i can do it fine: What gives? i ...
1
vote
2answers
250 views

WireShark: How do i use “Apply as filter”?

i'm seeing some packets in WireShark that i don't want to see: No problem, right-click on SSDP and click Apply as Filter ...and not Selected Except i've never been able to get the Appy as ...
0
votes
1answer
2k views

Wireshark sniffing “microsoft-ds [syn] seq=0..”

I'm new to wireshark. (installed it today) I'm just looking at the traffic and noticed this kind of packages: 60261 microsoft-ds [syn] seq=0 Win=8192 Len=0 MSS=1460 SACK_PERM=1 its sent to ip: ...
4
votes
4answers
3k views

MTU is 1500, why the first fragment length is 1496 in IPv6?

ping6 ipv6Address -s 1500 This command will result a fragment. Observed by wireshark, the 1st fragment packet's length is 1496 (from layer 3). Since the MTU is 1500, I am confused by this 1496 ...
2
votes
1answer
2k views

Why do I keep seeing “Wireshark Cookie Dump Ok Cancel” in my input forms within Firefox?

I've recently installed Wireshark on my Macbook Pro. Since doing so, whenever I head over to http://jsfiddle.net, all of the input fields are pre-populated with Wireshark Cookie Dump: ...
1
vote
3answers
418 views

Why do I have so many HTTP packets in Wireshark when I'm not doing anything?

Is it normal that I have huge amount of HTTP packets every second in Wireshark, even if I am not doing anything? I would like to analyse some packets related to one website in particular, but how can ...
3
votes
2answers
674 views

My Mac trying to connect to a possible intruder's machine, that is not in the network anymore

I just asked a question I think someone else has access to my wireless network. What next?. I have changed wireless security to WPA2, changed the password, disabled file sharing etc as =suggested in ...
0
votes
2answers
523 views

Watching http in wireshark

Wireshark reassembles TCP Segments. For teaching purposes, I'd like to see the actual packets (not the reassembled TCP Segments) that flow on a network when you access a webpage. Can I do that with ...
4
votes
4answers
3k views

How to test Bit Error Rates on Ethernet Networks?

I need a tool software or otherwise (preferably software) that will allow me to test Bit Error Rates on an Ethernet Network. I am using a software tool that I did not write and do not have access to ...
2
votes
3answers
513 views

Wireshark filter for different interface

I know that before capturing packets, I can select specific interface. I wonder is there any filter to distinguish different interfaces after I capture packets? That is, at the beginning, I capture ...
12
votes
2answers
10k views

How to set up wireshark to run without root on Debian?

I'm trying to use wireshark on a Debian machine, but when I run it with my non-root user account, it doesn't detect any network interface. I also tried running wireshark as root, but wireshark tells ...
4
votes
1answer
2k views

tcpdump filter for given bytes on given position

I'm searching for a way to filter traffic for specific bytes. What I have is a stream that I capture with wireshark or tcpdump. Now it logs way too much, so I want to drop every packet that has 0x23 ...
4
votes
2answers
922 views

Unable to capture outgoing traffic with Wireshark on wi-fi network

I'm trying to use Wireshark on Backtrack 5 to capture packets that are transmitted through my home wi-fi network. I'm perfectly able to capture outgoing traffic from localhost and, it seems, incoming ...
10
votes
2answers
11k views

Why do I see “The NPF driver isn't running. You may have trouble capturing or listing interfaces.” when starting Wireshark?

When I start up Wireshark, why do I see this message? "The NPF driver isn't running. You may have trouble capturing or listing interfaces."
0
votes
2answers
2k views

tcpdump - just packet data

When using tcpdump, how can I print just the packet data? For example (anonymized): sudo tcpdump -X 'tcp port 80 and (((ip[2:2] - ((ip[0]&0xf)<<2)) - ((tcp[12]&0xf0)>>2)) != 0)' ...
6
votes
3answers
2k views

Chrome browser sending Keep-Alive packets?

I ran Wireshark on my PC and found that my chrome browser was sending LOTS of Keep-alive packets even when there are no sites loaded in the browser, and even when there are no extensions installed!! ...
1
vote
2answers
857 views

Networking packet sniffer for Linux that captures the application names?

I tried Wireshark. It shows the source and destination IP address, port number, and packet contents, but nothing about which application is using the packets. Apparently tcpdump is similar; network ...
0
votes
1answer
1k views

How to monitor traffic passing through my Wi-Fi access point

I know how to monitor the network interfaces on my local computer with Wireshark. But, how do I monitor the traffic flowing through my wireless access point from connected computers? It seems like ...
5
votes
4answers
7k views

Wireshark cannot see traffic from a VirtualBox guest on Windows 7

I have been trying to use Wireshark to capture some traffic that comes from a virtual machine. The setup is: Windows 7 host Ubuntu guest VirtualBox 4 I send some packets from the guest to the ...
0
votes
3answers
1k views

Using nc (netcat) to emulate NTP server response

I want to test some security on an NTP client developed in-house and would like to use netcat to do it. I have packets captured with Wireshark from previous NTP exchanges that I tried to feed to the ...
2
votes
1answer
421 views

Linux alternative to Fiddler2 (different use! Not same question!)

I am aware that this question has been asked before; but my use for fiddler is completely different; Fiddler2 is my example. In Fiddler2 I can download streams from websites; for example if I stream ...
1
vote
1answer
321 views

Network being flooded with TCP Junk

I've been using Wireshark to check out the traffic on my home network. Fairly recently, I started getting a bunch of junk generated constantly. I've been unable to find out the cause, as virus/spyware ...
3
votes
1answer
3k views

why still dns lookup when using proxy?

I've configured my browser(firefox) to use proxy ,but I find that it's still looking up the dns when I visit http://domain.name, why is that still necessary?
0
votes
1answer
452 views

VirtualBox and missing packets in wireshark

I've been using virtualbox for some time for development purposes. Under the latest version of virtualbox 4.04 where Linux is the host, I'm noticing that I cannot see packets sent to the virtual ...
7
votes
1answer
4k views

How can I diff two network dumps from tcpdump or Wireshark?

I'm having a problem with one of our customers' embedded computers. They seem to discard some network packets which they should not. I can capture the TCP communication from a managed switch outside ...
2
votes
1answer
12k views

TCP segment of a reassembled PDU

In wireshark sometimes I see this: 478195 5738.896809 192.168.1.79 61.213.44.124 TCP [TCP segment of a reassembled PDU] What is a PDU? Was it reassembled? What does this mean?
0
votes
1answer
2k views

How to find HTTP GETs in Wireshark

How can I use the filter in Wireshark to find only those lines that have HTTP GET in them?
0
votes
2answers
1k views

How to filter out information in Wireshark

I am not interested in any information about network activity from any address that starts with 192.168. How can I make Wireshark hide those?
0
votes
1answer
202 views

How to get information out of Wireshark

I need to make a program that makes use of information that Wireshark collects from the network. Is there a way to get that information from Wireshark and into the program?
0
votes
1answer
55 views

What is an application for “web site recognition”?

This explanation isn't clear to me. Let me describe an application for web site recognition. Suppose that we want to know what everyone is doing with the web at starbuck. We can use ...
1
vote
3answers
2k views

Wireshark can see outside of the virtual machine?

I'm running Windows in a VM inside of OSX. If I start Wireshark inside Windows, then a message from OSX pops up saying that Wireshark is trying to monitor all network traffic. If I accept, then ...
0
votes
2answers
231 views

Is this normal Wireshark behavior?

I'm running Wireshark in Windows inside a virtual machine. Wireshark keeps reporting network activity, even though I don't have anything running in there that's accessing the network.
3
votes
2answers
2k views

How do I trace HTTP packets with Wireshark?

What can I do in order to see packets that come from different sessions in a web page? For example when I open yahoo.com there are different sessions in yahoo; I dont know how to see which packet is ...