The network protocol analyzer developed and maintained by the Wireshark Foundation

learn more… | top users | synonyms

0
votes
2answers
2k views

launch wireshark in linux

I have wireshark-1.2.15-2.el6_2.1.x86_64.rpm installed on CentOS. I was hoping to see a command like "wireshark", but couldnt find it. How do i launch wireshark? After querying the rpm, following ...
0
votes
1answer
491 views

WireShark in Ubuntu 12.04

I'm new in UNIX. I've installed WireShark on Ubuntu 12.04 and there is no interface list in Capture section. There is only text "No interface can be used for capturing in this system with the current ...
3
votes
3answers
12k views

Wireshark Not Displaying Packets From Other Network Devices, Even in Promisc Mode

System Setup: MacBook Air running Mountain Lion and connected wirelessly to a router. Wireshark installed and capturing packets (I have "capture all in promiscuous mode" checked) I filter out all ...
1
vote
3answers
1k views

How to make wireshark show http protocol instead of 802.11?

I recorded the wlan traffic in my network and saved this as a pcap file. Now I'd like to see the recorded http traffic and filter for some parts of the http traffic. I can open the pcap file in ...
0
votes
1answer
185 views

Is there any software that uses SSDP protocol like iChat for windows 7

Is there any software that uses SSDP protocol like iChat for windows 7. The reason I want this so that I can communicate with other users on my same local area network. As I see a lot of SSDP ...
0
votes
1answer
664 views

How to get RSSI values in wireshark captures

I'm running Mountain Lion and have Wireshark 1.8.3. I want to display the RSSI of each packet but I seem unable to do so. I went to Edit->Preferences->User Interface->Columns and select RSSI to be ...
0
votes
0answers
658 views

Wireshark does not show any HTTP traffic

My PC is running windows XP. I have been trying to capture HTTP traffic but if I apply the following filters, the Wireshark gives results not required http result: it only show ssdp traffic http (!...
4
votes
2answers
1k views

How can I get Wireshark with a GUI on my EC2?

I have an Amazon EC2 machine that I'd like to run Wireshark on, using X forwarding. Unfortunately, the only Wireshark packages found with $ yum search wireshark are: wireshark-devel.x86_64 wireshark....
1
vote
1answer
542 views

Need advice on using Wireshark + aircrack-ng

I am making acquiantance with wireless security and attacks and was told to run some tests with aircrack-ng and wireshark. So I installed both of them and ran airmon to switch wi-fi card to monitor ...
0
votes
1answer
705 views

Can't display RSSI values in Wireshark

I am trying to analyze the up-link Wireless traffic generated by my Sony Ericsson phone and captured by my D-Link router, on which I installed the DD-WRT firmware. To do this, first I log in the ...
1
vote
4answers
4k views

Installing WinPcap on Windows 8

I know there has been lots of discussion already on installing WinPcap on Windows 8. I'm running the RTM version. I was able to install WinPcap without a hitch by using the Windows 7 compatibility ...
2
votes
0answers
428 views

Decode SSL packets in WireShark

I have cert.cer, base64 x509 and a Wireshark dump in .pcap format. The packets are encoded, so how do I decode them? Now: [site-ip],443,http,xe.cer but it's still not working.
4
votes
1answer
6k views

Why does a PING reply require an ARP request for the originating hosts MAC?

I have a scenario as depicted below. Here two host machines are connected via a hub: Ok, so host-1 wants to ping host-2 and i have setup wireshark on a 3rd host connected to the same hub. Now ...
0
votes
2answers
6k views

Monitor Mode on the Intel Centrino(R) Advanced-N 6205 (WEP Penetration) On Windows

Can anyone tell me a way to do WEP hacking (legal, of course) (on my own wireless connection, for the purposes of this question) with Wireshark or similar programs on an Intel Centrino Advanced-N 6205?...
0
votes
2answers
1k views

How can I filter out a large number of addresses in Wireshark

I'm looking to create a "blacklist" of IP addresses that Wireshark will ignore. I'm monitoring traffic originating on an iPhone, and there's a lot of chatter from Apple, Google Services, etc. I never ...
5
votes
1answer
4k views

How to determine what program send the packet recorded in Wireshark?

I was taking some tutorials on Wireshark in order to analyze the packets sent and received when talking to a web server for purposes of learning. When I start listening/recording packets in Wireshark,...
1
vote
2answers
1k views

Tracking Wireless Network Usage

How do you determine the overall bandwidth usage for each computer connected to a wireless network? I manage a small wireless network consisting of a couple of cheap Cisco/Linksys wifi routers. ...
2
votes
1answer
2k views

need display filter to display tcp packets of non zero payload in wireshark

i have a pcap which contains only tcp packets. now i want to see only those packets which have non zero payload length. can someone please let me know which display filter to use ? using data.len or ...
1
vote
1answer
249 views

Unknown Inbound UTP Packets

I need some help figuring out something. I was looking at my network traffic using Wireshark and I saw a bunch of inbound UTP (uTorrent Transport Protocol) packets to my IP. About 10 different IP's ...
9
votes
2answers
102k views

What's all this deploy.akamaitechnologies.com traffic?

I happened to do a tcpdump while leaving my Mac idle, and when I came back after a mere half-hour there were something like 5000 packets involving deploy.akamaitechnologies.com, in which my computer ...
0
votes
2answers
2k views

Wireshark: there are no interfaces on which a capture can be done

I've made all steps described in wiki.wireshark.org/CaptureSetup/CapturePrivileges, but I still get next error message There are no interfaces on which a capture can be done. Where I've made a ...
1
vote
3answers
1k views

Capture/Peek WiFi data traffic?

My goal: I want to analyze the network protocols of a wireless device on my net. I've successfully set my linux laptop into monitor and promiscuous mode for its wifi interface. I used airmon-ng to ...
2
votes
2answers
620 views

Program to record data transmission between two computers using a TCP port

I am looking for a way to view data being transmitted over a TCP port between two computers. Is there a software package that allows this? I suppose I could script something to re-route data coming ...
1
vote
1answer
323 views

How to enter pcap filter in Wireshark 1.8?

Previously in capture options window there was a very handy input field for pcap filter expression. But in 1.8.* this window looks different: So, how to set pcap filter expression before starting ...
0
votes
1answer
3k views

How to extract mpeg-1 stream from pcap in wireshark

I have a pcap network dump that has an MPEG-1 stream inside and I would like to play the mpeg stream. So far I've tried playing through the RTP analyzer but that plays without any sound. I've also ...
5
votes
2answers
2k views

Wireshark: Accessing USB Bus Interfaces without sudo

I am trying to monitor some USB traffic using Wireshark on Linux (Ubuntu). If I start Wireshark as my normal user without root privileges, the USB bus interfaces are not listed. If I sudo wireshark ...
1
vote
3answers
463 views

Why would my network slow down?

The network at my work has about 40 computers on it and a quite a few printers. When there are a lot of people working the network will be slow. I can test the ping between my computer and the router ...
0
votes
1answer
125 views

Why does Windows constantly ping wireless network bridge?

I was looking at a Wireshark capture off my Windows XP box, and I noticed a rather curious behavior. Every 1-2 seconds, the machine sends a ping request to my Linksys WET610N wireless network bridge, ...
3
votes
1answer
2k views

Having trouble Getting “RTSP over HTTP”

There is an axis camera that is connected to our site (camba.tv) through axis one click connection component (which acts as proxy). We can communicate with this camera only through http by setting the ...
1
vote
1answer
542 views

Wireshark RPC packet capture with localhost

I want to capture RPC-XML packets on locahost using wireshark. As RPC-XML is at the top of tcp/udp, I enabled all protocols still I am not able to capture the traffic. Is there other way to do so? I ...
2
votes
1answer
576 views

What do these fields mean in Wireshark?

What does the following mean in the info section of wireshark? Source Client Destination Server Protocol HTTP Length 522 Info 522 GET /intl/en/images/logo.gif HTTP/1.1 More ...
0
votes
1answer
542 views

HDI: Capture specific content types in wireshark?

I've been tasked to audit in/outbound traffic at our site, but I don't know much about Wireshark. I understand how to set up a capture filter for broad protocols (IP only or tcp, udp, icmp, etc), but ...
2
votes
1answer
1k views

Sniffing SSL Traffic with Wireshark Locally

I ahve an application that is submitting and recieving information via HTTPS. If I place wireshark on the same box and the client. Will I be able to decrypt all of the data within the communication ...
1
vote
1answer
6k views

How to set intel centrino advanced-n 6205 in “monitor mode” in Windows 7 (32bit) and Wireshark

I've just installed Wireshark on my laptop and can't see it's working in "monitor mode". Logically I'm not connected with my home network, do I have to be able to monitor my ipads traffic? WinPCAP ...
0
votes
2answers
490 views

One VoIP conversation but two RTP streams?

I'm testing a VoIP system based on OpenSIPS. It has no RTPproxy, so calls do not pass through OpenSIPS. I tried to make a call between two smartphones, and it succeeded. I also turned on Wireshark, ...
1
vote
2answers
2k views

Do machines connected to the same switch belong to the same subnet?

When we talk about a subnet - do we mean all the systems connected to the same switch? If I have an assigned IP address of 10.0.2.1, am I in the same subnet as that of 10.0.1.39? When we talk about ...
2
votes
3answers
1k views

Wireshark on home-network

So basically I want to make WireShark ( Windows ) capture packets of the home network. As you know, home-networks are usually set by local IPs ( 192.168 or 10.0 range ) instead of the WAN IP so if we ...
0
votes
0answers
162 views

Saving traffic on a port to pcap format using an active intermediary

I have a service which listens on host1:5000. My intention is to redirect my client to localhost:5000. What I desire is a service running on localhost:5000 that redirects all traffic to host1:5000 ...
1
vote
2answers
9k views

What is the protocol 'ftp-data' identified by wireshark?

Just implementing a FTP server and use wireshark to analize the protocol. I find there is a protocol identified by wireshark FTP-DATA. What is that? Any document or RFC can be referred? Thanks and ...
1
vote
1answer
8k views

Windows 7 PC sends a lot of NetBIOS Name Queries for non-existent computer names

I have a Windows 7 PC, and have been monitoring network traffic using Wireshark, and I'm seeing this PC send out a lot of NetBIOS Name Queries for non-existent computer names. These are some of the ...
2
votes
1answer
7k views

How can I stop my computer from doing arp poisoning attacks?

I have a small LAN in my home about 4 - 5 computers. The problem is that when there are usually 3 or more pc's online we keep losing the Internet access randomly about every 2 minutes. So we took a ...
0
votes
1answer
2k views

running tshark command in windows batch file

I have written a batch file that runs a tshark command to filter fields from a wireshark pcap file and write them to a csv file. When i ran on the windows cmd CLI, i had to change the current working ...
0
votes
1answer
2k views

Can I use Wireshark to see what URL's my computer is invoking?

Is it possible to use Wireshark to see what URL and what params are being requested by my computer? Something like: www.foobar.com/someendpoint/bazboo Does Wireshark offer this information in it'...
13
votes
4answers
17k views

Wireshark WPA 4-way handshake

From this wiki page: WPA and WPA2 use keys derived from an EAPOL handshake to encrypt traffic. Unless all four handshake packets are present for the session you're trying to decrypt, Wireshark won'...
1
vote
1answer
693 views

Replace sensitive IP addresses in Wireshark with XXX.XXX.XXX.XXX

What would be an easy way to replace a sensitive IP address in a Wireshark packet capture with XXX.XXX.XXX.XXX? When I export the pcap in txt or csv I can no longer import it into Wireshark.
0
votes
1answer
824 views

Wireshark: Byte order changes when data exported

I am looking at a packet capture in Wireshark and try to export the data from a packet. In Wireshark, it looks like this: 46 a5 e2 fb bd 69 ... Then, after downloading, hexdump shows: a5 46 fb e2 ...
2
votes
1answer
3k views

Cannot connect to website - SSL handshaking fails

So I cannot connect to certain websites. Just a few, most are OK. The one I really care about is paypal.com. I have done the usual things. Let's see: Cleared browsing history Tried different ...
13
votes
2answers
22k views

How do I decrypt WPA2 encrypted packets using Wireshark?

I am trying to decrypt my WLAN data with Wireshark. I have already read and tried eveything on this page but without any success (well, I tried the example dump on that page and succeeded, but I fail ...
1
vote
2answers
2k views

how to find tcp streams without final ack/fin sequence in a huge packet capture file

I have a huge pcap file which contains a large number of individual tcp streams.But out of these , there are some invalid streams which dont have the final fin/ack sequence. Is there any way i can ...
0
votes
1answer
900 views

Do the “follow TCP stream” option in wireshark include duplicate packets?

When I tried to follow a TCP stream in wireshark, I found some duplicate packets. I wanted to know whether wireshark excludes duplicate(or retransmission) TCP packets from the "follow TCP stream" ...