The network protocol analyzer developed and maintained by the Wireshark Foundation

learn more… | top users | synonyms

1
vote
2answers
3k views

Monitor Mode doesn't work in Kali 2.0

For the last year or so I have been using this exact setup with Kali 1.0. Everything worked fine with Wireshark. Now, when I am connected to a Wi-Fi access point my card REFUSES to stay in monitor ...
1
vote
2answers
37 views

all outgoing tcp packets have source port 0.0.0.0

Currently I am connected to a network 169.254.x.x (a Hostel's Network) and there are three gateways that work as dhcp servers as well: 169.254.10.1 169.254.20.1 169.254.30.1 From a windows machine ...
0
votes
0answers
98 views

Wireshark won't open

I'm having trouble with wireshark on Kali Linux 1.1.0 when I try to open it the process bar loads to 100% and says "loading configuration files" but it gets stuck there. Anyone know how I can fix ...
1
vote
2answers
16 views

Can't decipher capture file

I'm playing with airodump-ng and wireshark (I'm not a networking specialist). I have captured some packets from my network with airodump-ng and wanted to open them in wireshark, but they seem to be ...
0
votes
1answer
169 views

How can I set up remote capturing in Wireshark, capturing from a CentOS server on my Windows laptop?

I'm looking to capture packets from a remote server network interface. The remote server is running CentOS and has tshark installed. I'm working on a Windows 8 machine with Wireshark installed. ...
2
votes
1answer
36 views

Using wireshark to snoop on RTSP over wifi

I just got a video baby monitor. It has several ports open including RTSP (554) by using Fing which is acting like nmap. I'd like to figure out what the full URL is of the stream. I have tried to ...
0
votes
2answers
363 views

Converting a Raw g722 File to a .wav with SOX

I am trying to troubleshoot some VOIP issues, and have been capturing the packets for the trouble calls. However my calls are all encoded in g722 and I am having trouble decoding this. I have ...
0
votes
1answer
9 views

Allow http request over specific port in iptables

I'm running Kodi with a web service for the remote control. The web server is listening to port 11734, however opening that port (UDP and TCP) doesn't seem to work. Once I accept all incoming traffic ...
0
votes
1answer
537 views

HDI: Capture specific content types in wireshark?

I've been tasked to audit in/outbound traffic at our site, but I don't know much about Wireshark. I understand how to set up a capture filter for broad protocols (IP only or tcp, udp, icmp, etc), but ...
0
votes
0answers
29 views

Simple ICMP DOS attack example with cmd on Windows 10 crashing the attacker's computer?

I had to make a simple batch file as an assignment in which I had to attack another pc on the same network by a ICMP DOS attack and analyze the traffic using Wire-Shark. Here the code which I used: ...
0
votes
1answer
37 views

Intercept traffic from a RJ45 TV box

I'm using a box that connects to the internet using an RJ45 cable. I would like to see the HTTP traffic that goes in and out the box. Would you plug a computer to the same network and run Wireshark, ...
0
votes
0answers
6 views

Capturing virtual machine traffic from Mac OS

I am running Windows 8.1 pro on VMware hosted by Mac OS. I want to capture the VM traffic via Wireshark installed on Mac. The Network Adapter on VM is set as Bridge (Ethernet). When I set ...
0
votes
1answer
23 views

How to use the old Wireshark interface?

I download Wireshark 2.0 and it has a new interface. The Release Notes 2.0 say: Wireshark 2.0 features a completely new user interface which should provide a smoother, faster user experience. The ...
1
vote
0answers
34 views

Packet injection in a Wi-Fi network with card in monitor mode

I have a computer connected to a WEP-protected Wi-Fi network. With scapy I can forge packets (let's say ICMP) and send them to another station of the same network. If I put my wireless card in ...
0
votes
1answer
48 views

Sniff wireless (Wi-Fi) traffic with Wireshark

I have a wireless card (ALFA AWUS036H) in monitor mode (with airmon-ng start wlan0) on my Debian machine. In Wireshark, in "capture options", all my interfaces are in promiscuous mode. The test ...
0
votes
0answers
18 views

Problems with NAT - Wireshark shows TCP Dup ACK

I'm having some issues with NATing to a couple of web servers on my site. I initially thought it was my firewall after an update (smoothwall) but I blanked it and reinstalled and its still not ...
0
votes
1answer
45 views

Cannot see VOIP calls in Wireshark 2.0.0

I received a pcap dump from a site, running Cisco JTAPI, who's VOIP traffic I need to analyse. I use Wireshark's VOIP calls analyser via the menu: The conversations display fine in Wireshark ...
2
votes
4answers
2k views

FTP disconnects after entering passive mode b/c packets are lost

For some reason, no matter how many times I try, after a client sends the PASV command (which is correctly received by the server), the server's reply (227 Entering Passive Mode) doesn't get back to ...
2
votes
1answer
1k views

Synergy choppiness: Is my wireless router delaying packets after silent period?

I am sharing keyboard and mouse between my Linux desktop and MacBook Air using Synergy. There is a very noticeable lag every time I begin moving my mouse (or start typing), but everything becomes ...
0
votes
0answers
12 views

How do I configure an ESP SA for wireshark 2.0.2 to decrypt ? It doesn't seem to let me set up the SAs

I read detailed directions which do not correspond to what I see in ESP (Edit->Preferences->Protocols->ESP) I see ESP SAs [Edit..] but, clicking edit, I cannot edit. What is the trick ?
1
vote
0answers
33 views

Use Ethernet only for Wireshark when WiFi is enabled (Linux)

I'm using Wireshark to capture network traffic (via a SharkTap 10/100.) This works well but when I plug in the Ethernet cable the laptop treats it as a normal LAN connection and routes all laptop ...
0
votes
1answer
307 views

Wireshark does not pick up outbound traffic

I have a bit of 'n problem at a client. We are running a WCF Client/Server application, and for some reason when one of the users try to connect to the server, he gets a timeout, but the second time ...
1
vote
2answers
5k views

How can I get the actual TCP sequence number in Wireshark?

In Wireshark, TCP sequence numbers are displayed as relative sequence numbers by default. How can I get the actual TCP sequence number?
0
votes
1answer
17 views

A bunch of tcp unseen segments and duplicates on wireshark?

Recently, my Mac has been unable to use the internet well. Even though it said my ping was between the ranges of 10-20 ms and my download speed was around 20 Mbps along with around a 10 Mbps upload ...
1
vote
1answer
18 views

Acknowledgement number of an RST packet

This question states that the acknowledgement number of an RST packet should be 0, but I have found it to be other than 0 when I captured some HTTP packets using Wireshark. So when does the ...
0
votes
2answers
52 views

Wireshark showing only my own packets in promiscuous mode even in open Wi-Fi

I am doing some tests for my project, and I am connected to my Access Point (which is open; no security) wirelessly. Theoretically, when I start a capture in promiscuous mode, Wireshark should ...
1
vote
0answers
46 views

How to parse a Wireshark pcap for a string

What efficient ways exist to parse a Wireshark capture to check for a given string? I'm trying to find a STOP command for an embedded device that its plaintext in the Wireshark 'info' field. Are ...
1
vote
1answer
741 views

tcpdump not displaying RSSI

I am monitoring Wi-Fi probe requests via tcpdump on Debian and am trying to capture the RSSI (signal strength) of each probe request element. Currently, the output from tcpdump for each probe request ...
0
votes
2answers
28 views

Wireshark does not display ARP frames before ICMP frames on a ping request

So far I know that if Wireshark does not display ARP frames before ICMP frames, it's usually because there are ARP requests in the cache. I did check the cache and deleted any ARP data in the cache: ...
0
votes
1answer
35 views

How to check which TLS cipher suite is used in tcp connection

I am using imapfilter to sort my mails on a remote IMAP server provided by some company. My configuration restricts imapfilter to the usage of TLS 1.2 via STARTTLS. I do know how to check which TLS ...
0
votes
3answers
1k views

Reconstructing web content through Wireshark

Suppose I have a Wireshark log of traffic from a web site. Can I reconstruct various elements like HTML file, picture files, java script files, etc? Ideally, it'd take the .pcap file and ...
0
votes
0answers
65 views

How can I use Microsoft Network Monitor to view messages sent via socket client/server

I would like to view the exact messages sent/received in Microsoft network monitor, but I do not know how. I have build a program to send messages via TCP socket and If a message "ready" is sent over ...
9
votes
2answers
6k views

How can I diff two network dumps from tcpdump or Wireshark?

I'm having a problem with one of our customers' embedded computers. They seem to discard some network packets which they should not. I can capture the TCP communication from a managed switch outside ...
0
votes
1answer
36 views

Is there a way to reliably search for command line execution in Wireshark?

Let's suppose I wish to inspect the Packet Bytes section and search for inbound shell command execution--specifically, the "dir" command on a Windows machine. From a remote attacker's CLI, I'll ...
0
votes
1answer
333 views

How do I record time of packets in file using wireshark?

I want to record time of packets in file using Wireshark. Any hints about how I can do this?
0
votes
1answer
206 views

how fix configure: error: Qt is not available when install wireshark?

this is my problem: cd '/home/james/Desktop/wireshark-2.0.2' ./configure ... checking if profile builds must be generated... no checking for Qt5Core - version >= 5.0.0... no checking for QtCore ...
18
votes
2answers
22k views

How to set up wireshark to run without root on Debian?

I'm trying to use wireshark on a Debian machine, but when I run it with my non-root user account, it doesn't detect any network interface. I also tried running wireshark as root, but wireshark tells ...
2
votes
2answers
4k views

Wireshark only capturing beacon frames

I am trying to sniff my own network to capture http traffic. On airodump my network security show "WPA - TKIP - PSK", so I went to Wireshark > Edit > Preferences > Protocols > IEEE 802.11 > Enabled ...
0
votes
0answers
25 views

Troubleshooting dropped packets in Telegram Messenger

I'm experiencing problems in using Telegram Messenger on my Mac, but only when connected at home (specifications at the end). More specifically, when uploading and downloading media (or even while ...
0
votes
1answer
29 views

How to identify an internet hog?

Our small office network will occasionally slow when a coworker starts a large download or a large file transfer between an in-house server and their local machine. How can I identify this hog on my ...
2
votes
3answers
2k views

What's the difference between wlan.sa, wlan.ra, wlan.ta and wlan.da?

Tshark/wireshark (CLI) has several fields to display for WLAN, including these four (+ description from manual): wlan.sa: Source address wlan.ra: Receiver address wlan.ta: Transmitter address ...
1
vote
1answer
719 views

Orbit Download Manager massive send packets (no torrent)

recently I've noticed my internet connection speed is low even my modem console was opening very slow , after troubleshooting using Wireshark I've found massive packets send to "sg.ilovewebgame.co.kr" ...
0
votes
1answer
28 views

Capture Only HTTP traffic in tshark

I am new to tshark tool usage. I am trying to use tshark tool for capturing only HTTP traffic but i am unable to do it. Here is the cmd i run to get the all traffic: tshark -c 1000 -w packetFile.pcap ...
0
votes
1answer
150 views

promiscuous mode not working

I've searched, and heard that the promiscuous mode lets us listen to all wireless trafic in the Access Point that we are associated with. But when i use this mode with wireshark, i don't get the exact ...
0
votes
1answer
36 views

Does Ventrilo encrypt the VoIP stream, session, and/or communications?

If you're not familiar, Ventrilo is a voice chatroom used for gaming. Here's the wiki for Ventrilo and similar software Mumble and TeamSpeak to give you an idea of what the software is about. I ...
5
votes
2answers
2k views

Wireshark: Accessing USB Bus Interfaces without sudo

I am trying to monitor some USB traffic using Wireshark on Linux (Ubuntu). If I start Wireshark as my normal user without root privileges, the USB bus interfaces are not listed. If I sudo wireshark ...
0
votes
0answers
41 views

NAT doesn't allow TCP ACK for sent TCP SYN

We are using TCP Simultaneous Open for connecting TCP socket. Lets call one SideA and other SideB. From the wireshark log I see that first two SYN sent from SideB is blocked by SideA NAT. Then SideA ...
1
vote
1answer
39 views

Why am I seeing packets intended for other recipients while behind a router?

I'm using a wired internet connection. The ISP provides an ethernet cable, a static private IP, and a dynamic public IP. I bought a router and gave the router the static private IP. I'm using ...
0
votes
1answer
10 views

How can specify limit for trace collection in OS X wireshark?

Wireshark noob here, trying to figure out how to set a limit for trace collection in OS X Wireshark. I did a search on the wiki page but nothing comes up in the results.
0
votes
1answer
18 views

Safe Capture of WAN Packets

I have an aggregating network tap between my WAN connetion and my home router. I have a dedicated machine running Wireshark to capture all WAN traffic via the network tap. This machine is running ...