The network protocol analyzer developed and maintained by the Wireshark Foundation

learn more… | top users | synonyms

2
votes
1answer
732 views

Excessive “name query” and “standard query” activity on Wireshark?

I started using Wireshark on some class at university and decided to look at my home wireless network with it, just out of curiosity. But now I'm noticing excessive activity to what it looks like a ...
2
votes
3answers
3k views

Problem with Wireshark on Wifi

I am using wireshark over wifi from my network card Atheros AR9825 network card but it but it is showing the following error. What is the issue? ""The capture session could not be initiated (failed ...
3
votes
3answers
5k views

WireShark: How to monitor traffic, rather than watch packets?

WireShark is good at showing me every packet that is sent or received over an interface. But I'm really trying to find a way to monitor traffic on a machine. In other words, rather than seeing: ...
4
votes
3answers
8k views

Packet Sniff over Wi-Fi

I've got a non-PC wireless client, and I'm wondering about some of its connections. I want to see the actual packets being exchanged from the net to my device over a Wi-Fi connection. I have ...
1
vote
1answer
229 views

Have I reached a hard-coded limit of tshark?

I am using tshark to dump bittorrent.piece.data and appear to have hit some internal limit within tshark. tshark -r 2-live.pcap -R "bittorrent.piece.data and ip.dst_host == 192.168.3.14" -T fields ...
3
votes
1answer
2k views

How do I use tshark to extract bittorrent piece data to a file for post processing/reporting

Wireshark does a good job of extracting bittorrent PIECE messages sent to specific peers from other peers using a filter like the following e.g.: bittorrent.piece.data and ip.dst_host == ...
7
votes
3answers
11k views

How do I return just the Http header from tshark?

I'm using tshark to sniff my packets and I'm only concerned with the http header (preferably in the form its sent, but I'll take what I can get). I tried using: tshark tcp port 80 or tcp port 443 -V ...
0
votes
1answer
295 views

Logging File through wireshark

I want to record time of packets in file using wireshark, kindly give me some hints so that I can do this. Sorry for my bad English.
1
vote
2answers
726 views

404 error - Finding what wasn't found with wireshark

I am using Wireshark to view my HTTP activity. When there is a 404 Not Found error returned, I can't find an easy way to determine what request could not found. Can anyone explain how to do this?
6
votes
2answers
13k views

How can I capture traffic to localhost using Wireshark?

I am using Wireshark on Windows Vista and I would like to capture http traffic to localhost (127.0.0.1), for debugging purposes, but I have some questions. How can I do this? What capture interface ...
2
votes
2answers
1k views

How do I monitor network traffic for IPP (LPD/LPR)?

I'm writing an application that sends print jobs over IPP to an LPR print server. I need a way to monitor the traffic going between that server and my development box. Right now I'm just sending jobs ...
6
votes
1answer
23k views

Capturing wireless traffic (using Wireshark)

When I run wireshark on a wired network it works fine and reports all of the packets. When I run it on a wireless network though I only see my own traffic. The wireless card I have is supposed to ...
54
votes
5answers
17k views

Mac Homebrew and Wireshark

I've installed Wireshark(.org) using Homebrew. brew install wireshark at the end the script says ==> ./configure --prefix=/usr/local/Cellar/wireshark/1.2.7 --disable-dependency-tracking ...
3
votes
2answers
6k views

What does this UDP Packet mean?

I'm total newbie at tcp/ip and I was experimenting with Wireshark. What this mean: 1824 578.194204 xxx.xxx.xxx.xxx yyy.yyy.yyy.yyy UDP Source port: 17500 Destination port: 17500 In data I ...
1
vote
3answers
267 views

Malware - Technical anlaysis

Note: Please do not mod down or close. Im not a stupid PC user asking to fix my pc problem. I am intrigued and am having a deep technical look at whats going on. I have come across a Windows XP ...
8
votes
4answers
2k views

Concern over running WireShark as root

I started WireShark on my Ubuntu machine and discovered that there were no interfaces I could listen to. So I launched it as root. This gave me access to all the interfaces, but gave me a warning: ...
1
vote
2answers
500 views

Is it possible to know which process opened a connection in Windows?

With netstat -a I can see all connections from my machine to the MySQL Server. There is any way too see which process or executable is responsible for each connection? The only solution I found so ...
3
votes
3answers
1k views

How to measure network traffic by protocol?

I would like to select a type of traffic, as I do in Wireshark, and measure the total traffic in each way for this filter. Is it possible with Wireshark? Is it possible with another Windows tool?
0
votes
2answers
1k views

How to save POST&GET headers of a web page with “Wireshark”?

I've been trying to find a python code that would log in to my mail box on yahoo.com from "Google App Engine". I was given this code: import urllib, urllib2, cookielib url = ...
2
votes
0answers
453 views

Wireshark vs Netmon for precise time tagging

I'm using Wireshark to time tag and get some statistics on multicast traffic. When there is not much traffic, the stats looks good, but as soon as there is a bunch of packets arriving at the same ...
0
votes
3answers
3k views

Wireshark is not capturing traffic through http://localhost:8888

Currently, my wireshark can capture traffic from http://localhost (traffic that is on port 80) but it won't capture traffic on localhost:8888 Is there any extra configuration/software that I need for ...
6
votes
6answers
3k views

Lightweight tool for viewing raw HTTP messages?

I'm investigating differences in behaviour between a couple of Web servers. I need to see raw response data from the servers (i.e. before the response is de-chunked if it has ...
2
votes
2answers
6k views

Usefulness of packets in wireshark? SSDP protocol, rather than HTTP?

I used to be able to filter my wireshark packets to get useful information from them. However, with my current configuration on OSX, all of the HTTP traffic is coming through as the SSDP protocol and ...
0
votes
1answer
91 views

How would I do this in wireshark?

I have four packets captured in wireshark. ARP request and reply packets and ICMP packets. What field and values are used to identify the different packets carried by an ethernet frame?
4
votes
3answers
3k views

Wireshark and Windows Firewall

If I block a port in the Windows Firewall, and then attempt a connection to that port from another PC, what should I expect to see in Wireshark? When running wireshark at the destination machine ...
3
votes
3answers
5k views

Interpret Wireshark Captures

I am troubleshooting wireless connectivity problem in my home network. My Thinkpad X200 laptop which use Intel Wifi Link 5100 AGN is not able to surf the internet stably. Sometimes it works, but most ...
2
votes
1answer
2k views

How do I un-gzip data captured by Wireshark?

I have a Wireshark capture file with a HTTP request, however, the request is gzipped. My question is how can I ungzip it so see what data was transfered in cleartext? The capture file is here if ...
5
votes
3answers
8k views

Capture traffic for specific application

I have an application which communicates with some server. I want to know what the IP of this server is. How can I capture all the traffic from a specific application and not just all the traffic like ...
2
votes
3answers
5k views

Wireshark - permission problem in Ubuntu

I installed wireshark (tshark) using sudo apt-get install tshark this installed the tshark executable in /usr/bin/tshark. The problem now is that I am unable to run it without root permissions. ...
2
votes
1answer
266 views

What is wag-service?

Does anyone know what wag-service is? I'm seeing it a lot in Wireshark
4
votes
1answer
3k views

How to filter those TCP packets on Wireshark/Ethereal?

Packets that I want to see (just samples, there are thousands of them): 314 2.280146 192.168.0.1 192.168.0.2 TCP ah-esp-encap > 11188 [PSH, ACK] Seq=1 Ack=1 Win=65535 Len=121 316 2.290003 ...
5
votes
2answers
8k views

How to write a filter in Wireshark/Ethereal that displays only packets with a specific string?

Wireshark supports filters like this: ip.addr == 192.168.0.1 What is the syntax to check the packet content? (C# equivalent of what I want) content.Contains("whateverYouWant")
2
votes
1answer
842 views

Have wireshark save the capture-stream at a certain amount of frames, then start new capture

Wireshark can easily capture hundreds of thousands of captures in under an hour. I'm wondering if it's possible to configure Wireshark to have WireShark save the capture after a certain amount of ...
0
votes
2answers
5k views

Wireshark does not see interfaces (winXP)

Short story: Wireshark is working....on my winXP-32b ... usage .... Long long time later Wireshark does not work It can't find any usefull interface (just VPN) ipconfig /all Ethernet adapter ...
1
vote
2answers
3k views

How can I monitor the traffic on a single port?

I am developing a python messenger client but I feel this is more targeted to superuser than StackOverflow. My server application seems not to get the data sent from time to time, so I want to see ...
1
vote
1answer
2k views

Multi language support in wireshark

Do we have multiple language support with Wireshark. We are using Windows Xp SP2 and Ubuntu Linux environment. Actually we have a plugin which is UDP based and we have a requirement to Analyse the ...