Open-source network packet analyzer

learn more… | top users | synonyms

0
votes
2answers
26 views

Wireshark and Playstation 3

I'm looking to capture all network traffic when playing my ps3 and find the external IP addresses of other players in my servers or game. I'm wondering if this is possible? If so how?
0
votes
2answers
1k views

Capture TCP communication on a specific port using wireshark

I have build a simple TCP server which listens on port 9999, and it has IP address 202.168.66.1. I have a TCP client which has the same IP address and connects to the server on the said port. Now ...
3
votes
2answers
7k views

How can I show only 127.0.0.1 traffic using Wireshark?

Every time I try to filter to just show a specific IP address, I get an error indicating that it is "not an interface or a field." I have no idea what that means. Furthermore, I don’t really see any ...
5
votes
2answers
7k views

How to write a filter in Wireshark/Ethereal that displays only packets with a specific string?

Wireshark supports filters like this: ip.addr == 192.168.0.1 What is the syntax to check the packet content? (C# equivalent of what I want) content.Contains("whateverYouWant")
0
votes
0answers
15 views

Wireshark dont work after install VirtualBox

I have the following problem whit Wireshark. I function normally until I installed Oracle VM VirtualBox, after installation of said program to me at the start Wireshark occur following problem: "No ...
1
vote
3answers
6k views

Decrypting SSL traffic in Wireshark. Only headers get decrypted

I'm trying to decrypt SSL traffic in Wireshark, and it partially works because I'm able to view the decrypted headers. The problem is that I don't see any of the packet contents, only their headers. ...
1
vote
1answer
24 views

Ethernet Data Traffic hidden from Wireshark capture

I have a puzzle I am not able to figure out, I would appreciate any help. I am connected to a remote desktop using windows default remote desktop utility (Windows 8 locally, Windows 7 remotely). The ...
0
votes
0answers
23 views

Eliminating extraneous network traffic

If I wanted to get the best performance (high data rate, low latency) out of an isolated gigabit ethernet LAN (N.B. NOT connected to the internet) I would assume this would occur when there was no ...
0
votes
1answer
33 views

How to get packets for a specific access point

I have Wireshark and Aircrack-ng and whenever I capture packets I don't know how to capture packets for a specific network (the network is "2WIRE207"). I need to do this so I can use Aircrack-ng.
0
votes
0answers
36 views

Capturing 802.11n HT control on wireshark

1) Using wireshark 1.12.2 with kernel 3.8.0-44-generic I cannot see any HTC+ fields in my packets. Is this a dissector issue in wireshark or related to my wireless nic. I have tried on both an alfa ...
0
votes
0answers
13 views

How do I get Wireshark to filter for a specific web host?

I'm using Wireshark on OSX, but I can't make any sense out of the filtering system. I have this filter set up: But when I hit that server, I don't see anything show up in the capture log. If I ...
-1
votes
0answers
13 views

How add rules to windows Firewall?

How add rules to windows Firewall? I have problem to receive UDP broadcast packets from one of my computer. I am able to receive the broadcast with same exe from another computer after same router. ...
0
votes
0answers
8 views

Mergecap multithread

I need to merge a lot of pcap files into one. I ran the command "mergecap *.pcap -w outputFile" , and it actually merges the files, but it's really slow. I was wondering if there's a way to launch a ...
1
vote
0answers
23 views

Capture network traffic between VM's Virtualbox using Wireshark

I'm trying to capture all network traffic between VMs (and in the VMs to themselves) running on a single host using Virtualbox for the VMs and Wireshark for the capturing. VMs are Ubuntu 14.04 and the ...
1
vote
1answer
20 views

Which HTTP Authentication used?

I need a way to find out which HTTP Auth mechanism is used for a particular website/web-server, which is responding to my HTTP request. I am open to use any browser, or any other tool (like ...
3
votes
1answer
357 views

How to properly use stunnel?

I'm trying to setup Wireshark ssl debugging, and to do this, I'm trying to follow instructions in this article. I'm currently at stunnel part, and I'm trying to execute sudo stunnel -p ps.pem -d ...
0
votes
0answers
19 views

UPnP Discover can't captured by Wireshark

According to the UPnP standard, the UPnP discover packet should send to 239.255.255.250:1900. However, when my program send to 239.255.255.250:1900, the wireshark can't captured the packet. When my ...
1
vote
0answers
18 views

Route network traffic back to the same wire

I would like to monitor outgoing traffic from my wi-fi connected phone using Wireshark on my Windows desktop. I changed default gateway on the phone to the IP of the desktop and Wireshark can now see ...
0
votes
1answer
19 views

Monitoring physical network traffic with a VM

How can I monitor the physical network's traffic through a virtual machine (VMWare or Virtual Box)? I'm running Wireshark in a Linux VM and I would like to monitor all the network traffic. However ...
1
vote
1answer
150 views

How can I get the actual TCP sequence number in Wireshark?

In Wireshark, TCP sequence numbers are displayed as relative sequence numbers by default. How can I get the actual TCP sequence number?
1
vote
1answer
48 views

Can Wireless Sniffers capture and read your data with and without being connected to the WLAN?

Can some neighbor with his laptop capture the wireless traffic packets which I send and receive from my router, if he is not connected to my WLAN? Can someone connected to my WLAN and without access ...
1
vote
3answers
1k views

FTP disconnects after entering passive mode b/c packets are lost

For some reason, no matter how many times I try, after a client sends the PASV command (which is correctly received by the server), the server's reply (227 Entering Passive Mode) doesn't get back to ...
0
votes
1answer
30 views

http.host filter for tshark capturing

I would like to capture traffic to a specific domain name. I tried the following wireshark filter http.host == 'example.com' It works, but after a few hours the temp data gets very large, so I ...
0
votes
0answers
19 views

Can network sniffing in promisc mode on a network bridge produce “false” TCP retransmissions?

I have a Wireshark log from a computer that was running Ubuntu and tshark. The computer has two NICs and I've connected them to a bridge (using /etc/network/interfaces) and gave that bridge a static ...
4
votes
3answers
202 views

Is there a file format equivalent of Wireshark?

I love how Wireshark breaks down every packet by protocol section, explaining what every single bit and byte is for. What I would also love is a program that does the same thing for regular files: ...
1
vote
1answer
53 views

Kerberos failure emergency: need to filter a Wireshark capture to show only Kerberos and SPNEGO traffic

I am attempting to troubleshoot a serious Kerberos authentication problem on our SBS 2003 domain (none of our Windows 7 or XP workstations can authenticate). We have logged failed Kerberos ...
0
votes
0answers
36 views

Kerberos authentication failure: “SAM Active Directory Response - user unknown”

Everyone on our network is currently unable to access shared resources on our file server (SBS 2003 server with Windows 7 & XP workstations). A Wireshark packet capture revealed the following ...
1
vote
1answer
3k views

Using Wireshark to decrypt tls encrypted file with private key

I have a packet encrypted with TLS in a .pcap file. I also have the private key in a .priv file. How can I decrypt the .pcap file using Wireshark? I tried going to edit -> preferences -> protocols -> ...
0
votes
1answer
57 views

Can anyone interpret the data in this UDP packet?

I have been receiving large amounts of traffic to my computer recently so I downloaded and ran wireshark to find out I have been receiving lots of UDP packets. All of the packets I have received are ...
1
vote
1answer
222 views

Have I reached a hard-coded limit of tshark?

I am using tshark to dump bittorrent.piece.data and appear to have hit some internal limit within tshark. tshark -r 2-live.pcap -R "bittorrent.piece.data and ip.dst_host == 192.168.3.14" -T fields ...
1
vote
2answers
82 views

How do capture filters in Wireshark work internally?

I am wondering exactly what happens internally in TShark when I use a capture filter. Specifically, let's say I have the following filter to capture multicast data: host 224.0.26.3 && port ...
0
votes
0answers
24 views

Wireshark doesn't capture successful pings towards me

So I disabled WAN blocking of my modem/router, I allowed ICMP in inbound and outbound firewall options, and I am capturing icmp filtered packets in Wireshark. It captures all pings I made, but: It ...
0
votes
0answers
27 views

Filter for Wireshark to show amount of downloaded data from a specific host

Need to check amount of downloaded data from some address when there are connection issues. Such issues are emulated with clumsy (http://jagt.github.io/clumsy/index.html). All packets that are ...
0
votes
1answer
89 views

Unable to build wireshark in the centOS 5.3

I downloaded the source code from the wireshar.org and tried to build it but I am facing the problem in compiling it. Following is the error I am getting during configure (./configure) checking for ...
0
votes
1answer
3k views

How to find HTTP GETs in Wireshark

How can I use the filter in Wireshark to find only those lines that have HTTP GET in them?
0
votes
2answers
1k views

How to filter out information in Wireshark

I am not interested in any information about network activity from any address that starts with 192.168. How can I make Wireshark hide those?
2
votes
3answers
741 views

Wireshark filter for different interface

I know that before capturing packets, I can select specific interface. I wonder is there any filter to distinguish different interfaces after I capture packets? That is, at the beginning, I capture ...
0
votes
0answers
60 views

Verify python request with wireshark or proxy HTTPS

I am working on a scraper, that is scraping data using python requests package. The website has a secured connection (https). I managed to get over the login part, over the search part, and now I have ...
1
vote
1answer
3k views

Sniffing the Router for Packets

I have used WireShark software to sniff my Network Interface. What if i wanted to sniff the router that what other computers on the network are doing? Is there any way to do that? Computers are ...
0
votes
0answers
26 views

Wireshark - Cannot find any Content Encoding header

I am using Wireshark in order to investigate some websites. After the site finishes loading, I checked on Wireshark with the filter "http.content-encoding" and cannot see any frame containing that ...
0
votes
0answers
56 views

Wireshark does not pick up outbound traffic

I have a bit of 'n problem at a client. We are running a WCF Client/Server application, and for some reason when one of the users try to connect to the server, he gets a timeout, but the second time ...
5
votes
5answers
9k views

Wireshark cannot see traffic from a VirtualBox guest on Windows 7

I have been trying to use Wireshark to capture some traffic that comes from a virtual machine. The setup is: Windows 7 host Ubuntu guest VirtualBox 4 I send some packets from the guest to the ...
0
votes
0answers
47 views

Ettercap and Wireshark broken when not logged in as root

I'm having an issue with Kali Linux (v.1.0.8-amd64) where network sniffing programs such as the aforementioned are not displaying my network interfaces, thus not allowing me to use them. This only ...
0
votes
1answer
55 views

Need help understanding network interfaces on my machine

I do not understand why wireshark and the device list on my computer do not show the same set of network interfaces. Also, I am not even sure what some of the interfaces are. Here are the reports: ...
0
votes
1answer
118 views

cannot capture packets on wireshark without internet

I am using Wireshark on my Windows 8.1 Pro 32-bit pa and whenever I start Wireshark without internet, it can't capture ant packets. But when I am connected to the internet, it captures packets form ...
0
votes
2answers
406 views

How to capture 802.1X EAPOL packets in windows 7?

I want to capture 802.11 EAPOL packets on windows 7,however,i fail to capture any EAPOL packet use wireshark.What tools can i use to capture the EAPOL packet? my environment is windows 7,wireshark ...
3
votes
3answers
12k views

promiscuous mode with Intel Centrino Advanced-N 6200 AGN wireless card

I'm trying to solve this problem for a long time, googling, reading and trying with no help. I have laptop with Intel Centrino Advanced-N 6200 AGN wireless card which suppose to support promiscuous ...
1
vote
1answer
155 views

Provide Session Master Key to Wireshark UI?

I'm working on an issue with HTTPS. I suspect its related to client certificates. I want to read some of the encrypted handshake messages that follows the ServerHelloDone message. (Once the ...
0
votes
2answers
247 views

How can I tell if Wireshark has sucessfully decrypted a capture

I have used Microsoft Network Monitor 3.4 in Windows 7 to create a capture file from my wireless g network by setting monitor mode. When loaded into Wireshark I can see the four way handshake and I ...
2
votes
1answer
30 views

Explanation of port protocols in Wireshark?

When using Wireshark you can display the packets with just the plain number of the port, or with a "transport layer name resolution" (via the View/Name Resolution menu, for example). Unfortunately, ...