The network protocol analyzer developed and maintained by the Wireshark Foundation

learn more… | top users | synonyms

1
vote
2answers
3k views

Monitor Mode doesn't work in Kali 2.0

For the last year or so I have been using this exact setup with Kali 1.0. Everything worked fine with Wireshark. Now, when I am connected to a Wi-Fi access point my card REFUSES to stay in monitor ...
-1
votes
0answers
13 views

Decrypting TLS Browser Traffic With Wireshark - Body is still encrypted

I was trying to reverse engineer a protocol using wireshark. I followed this article and tried to decrypt TLS Browser Traffic using SSLKEYLOGFILE since decrypting using private key didn't work for me. ...
0
votes
0answers
13 views

Promiscuous Mode On Surface Dock Ethernet NIC

I'm trying to use Wireshark promiscuous mode with a Surface Pro 4 and Surface Dock Ethernet interface, but it doesn't seem to work. How can I enable promiscuous mode using the Surface Dock? Is it ...
10
votes
3answers
22k views

How can I see 127.0.0.1 traffic on Windows using Wireshark?

Every time I try to filter to just show a specific IP address, I get an error indicating that it is "not an interface or a field." I have no idea what that means. Furthermore, I don’t really see any ...
6
votes
5answers
7k views

How to test Bit Error Rates on Ethernet Networks?

I need a tool software or otherwise (preferably software) that will allow me to test Bit Error Rates on an Ethernet Network. I am using a software tool that I did not write and do not have access to ...
2
votes
1answer
50 views

Tshark. List all traffic between two IP's?

I am learning to use Tshark. I am trying to retrieve a list of all conversations between two IP addresses using Tshark. The two IP's are: 192.168.1.158|64.12.24.50 In Wireshark I am able to see the ...
0
votes
0answers
7 views

How to uncompress an OpenVPN stream with lzo compression?

Hello I'm connecting to a VPN server using OpenVPN and the configuration file contain the parameter lzo-comp=yes meaning the data is at least compressed using the lzo algorithm. With Wireshark I'm ...
1
vote
0answers
26 views

Ethernet UDP First Received Packet is Delayed. Why?

I have a PC exchanging data using gigabit Ethernet with some custom hardware. My problem is that when data physically arrives on the network card (checked with an oscilloscope), the first frame is ...
-1
votes
1answer
17 views

how to decrypt SSH packets captured on Wireshark tool on a SUSE Linux box

Actually i want to compare two ssh clients, custom client(using OpenSSH library) and PuTTY. And see what commands are being sent. i am using Wireshark on SUSE linux box for capturing network packets. ...
1
vote
1answer
27 views

Using netcat to log traffic to a file

I currently have a Windows 10 laptop connected to a Ubuntu 12.04 Laptop via Ethernet. All of the traffic from the windows system has been routed to go through the Linux laptop and out the Linux ...
0
votes
1answer
15 views

Why can't I search for strings in wireshark after visiting plain website while capturing packets?

I'm trying to understand how the whole thing works and I don't understand why I can't search for a string in wireshark when I visit a non-encrypted website while capturing packets for that website IP. ...
0
votes
1answer
6 views

“Follow TCP stream” inserts extra line breaks and strings like “2000” “a7c” “0” (chunking?), how to hide that?

I often use "Follow TCP stream", very convenient to see the whole client/server conversation. PROBLEM: Some strange characters (that are not in the real packets) are shown. Maybe due to HTTP chunking?...
1
vote
1answer
19 views

How do I capture device specific USB packets with tshark?

I have a USB instrument, and I want to capture packets on it. I ran .\tshark.exe -D and the USB interface is number 6. then I ran the command: .\tshark.exe -c 100 -i 6 it seemed to capture the USB ...
1
vote
4answers
4k views

Installing WinPcap on Windows 8

I know there has been lots of discussion already on installing WinPcap on Windows 8. I'm running the RTM version. I was able to install WinPcap without a hitch by using the Windows 7 compatibility ...
0
votes
1answer
23 views

Run Wireshark without setuid OR capabilities

I want to run Wireshark so that I will have to type in my sudo password to run it, but I don't want to give the dumpcap binary special privileges (set-uid, capabilities, etc.). How can I do that ...
0
votes
2answers
51 views

Wireshark - How to export the info column of all packets to plain text

I have a set of captured packets and I only want the info column of every packet to be exported to plain text, how can I do this? I am on windows
0
votes
1answer
40 views

Routing between two NICs same PC

I have two NICs, 192.168.56.0/24 and my wifi NIC 192.168.1.0/24. Can I route between these two NICs to be able to ping from my Physical HOST to any host on 192.168.56.0/24 while using VMs? I know ...
0
votes
1answer
17 views

Can Wireshark decode Hessian-data?

We are debugging a problem with our application using tcpdump-captured data in Wireshark. Some of the data is in binary format (Hessian): Content-Type: x-application/hessian which is a pain to ...
1
vote
1answer
19 views

Wireshark/PCAP XML attributes explained

I'm generating XML-formatted output from a Wireshark dump using the following command: tshark -r my_wireshark_data.pcap -T pdml > my_wireshark_data.xml Looking at the XML file generated, I ...
0
votes
2answers
36 views

What is the first data that Wireshark displays?

The following image shows a regular TCP packet captured in Wireshark: Is the data that I have marked in the image exists in the packet itself, or is it some information that Wireshark has generated?...
0
votes
1answer
20 views

Regular expression not working as expected for special characters

I have a Wireshark capture and I'm trying to create a display filter [Wireshark documentation] that finds XML documents which contain the term @@ V? (at-at-space-V-questionmark). The documentation ...
3
votes
2answers
4k views

Why can't Wireshark read packets from ping?

I have Wireshark started, then I ping an IP address. But Wireshark is not picking up any packet sending to or receiving (echoing) from the destination address. Why? Is ping "protected" from being ...
0
votes
3answers
638 views

Converting a Raw g722 File to a .wav with SOX

I am trying to troubleshoot some VOIP issues, and have been capturing the packets for the trouble calls. However my calls are all encoded in g722 and I am having trouble decoding this. I have ...
0
votes
0answers
701 views

Replaying Client Hello from previous session

I am basically testing an SSL server. I need to capture the client hello and then replay the same client hello with exact same field values. Here are the steps that I performed- 1) Captured the client ...
18
votes
3answers
23k views

How to set up wireshark to run without root on Debian?

I'm trying to use wireshark on a Debian machine, but when I run it with my non-root user account, it doesn't detect any network interface. I also tried running wireshark as root, but wireshark tells ...
0
votes
1answer
24 views

Human readable SSL/TLS packets

If I have a protocol-analyzer/packet-sniffer, such as wireshark installed on a particular device.. (or in this case; tcpdump & tshark etc. on my smartphone..) ..should I be able to read ...
-1
votes
2answers
48 views

Why does a USB Adapter set to monitor mode on Linux not capture non-WiFi traffic send on the same frequency (2.4GHz) as WiFi ?

I have a WiFi Adapter from Alfa that can function in Monitor mode on Linux. Once I set it up and run Wireshark, I am able to see traffic across other routers and devices. If there is a new protocol ...
1
vote
1answer
54 views

Wireshark's reassembled PDU consists of TCP segment size > MSS?

I'm looking into a Wireshark record provided by someone, to analyze something for them. Wireshark has conveniently reassembled 3 TCP segments that all transported a single TLS packet. The TLS packet ...
0
votes
0answers
62 views

Windows Server 2012 r2 DHCP not serving addresses

Yesterday I encoutered a DHCP problem. After windows update and restart, my dhcp won't serve any new IP addresses. The ones wich has been sent before are working but no new IP-s. I tried restarting ...
3
votes
0answers
52 views

where does Windows Task Manager measure network data rate

I am trying to build a 10Gbps Ethernet channel between an FPGA and a Windows 7 PC. For a rough estimate, I measured the bandwidth usage of the link using Windows Task Manager's Network Tab. Later I ...
0
votes
0answers
17 views

Using TCPView / wireshark to find exact address application reaches

I think a c++ application I have on my computer is download a virus from a server. I have used wire shark and TCPView and have determined the global broadcasting address it is connecting to. However ...
0
votes
0answers
17 views

Unable to find traffic for specific device w/ Wireshark (over Wi-Fi)

I have a device communicating with a TCP server running on my machine. My machine is normally connected to the network via ethernet, however I also have a wireless adapter that I can use to connect to ...
7
votes
4answers
58k views

How to block the Whatsapp Android application in a network

I need to block the users from accessing Whatsapp Android application who have logged in to my network. I tried to take Wireshark logs and tried to find the server's IP Address and port number, but I ...
1
vote
2answers
46 views

all outgoing tcp packets have source port 0.0.0.0

Currently I am connected to a network 169.254.x.x (a Hostel's Network) and there are three gateways that work as dhcp servers as well: 169.254.10.1 169.254.20.1 169.254.30.1 From a windows machine ...
0
votes
0answers
131 views

Wireshark won't open

I'm having trouble with wireshark on Kali Linux 1.1.0 when I try to open it the process bar loads to 100% and says "loading configuration files" but it gets stuck there. Anyone know how I can fix this?...
1
vote
2answers
23 views

Can't decipher capture file

I'm playing with airodump-ng and wireshark (I'm not a networking specialist). I have captured some packets from my network with airodump-ng and wanted to open them in wireshark, but they seem to be ...
0
votes
1answer
1k views

How can I set up remote capturing in Wireshark, capturing from a CentOS server on my Windows laptop?

I'm looking to capture packets from a remote server network interface. The remote server is running CentOS and has tshark installed. I'm working on a Windows 8 machine with Wireshark installed. I'...
2
votes
1answer
64 views

Using wireshark to snoop on RTSP over wifi

I just got a video baby monitor. It has several ports open including RTSP (554) by using Fing which is acting like nmap. I'd like to figure out what the full URL is of the stream. I have tried to ...
0
votes
1answer
13 views

Allow http request over specific port in iptables

I'm running Kodi with a web service for the remote control. The web server is listening to port 11734, however opening that port (UDP and TCP) doesn't seem to work. Once I accept all incoming traffic ...
0
votes
1answer
544 views

HDI: Capture specific content types in wireshark?

I've been tasked to audit in/outbound traffic at our site, but I don't know much about Wireshark. I understand how to set up a capture filter for broad protocols (IP only or tcp, udp, icmp, etc), but ...
0
votes
0answers
71 views

Simple ICMP DOS attack example with cmd on Windows 10 crashing the attacker's computer?

I had to make a simple batch file as an assignment in which I had to attack another pc on the same network by a ICMP DOS attack and analyze the traffic using Wire-Shark. Here the code which I used: ...
0
votes
1answer
46 views

Intercept traffic from a RJ45 TV box

I'm using a box that connects to the internet using an RJ45 cable. I would like to see the HTTP traffic that goes in and out the box. Would you plug a computer to the same network and run Wireshark, ...
0
votes
0answers
6 views

Capturing virtual machine traffic from Mac OS

I am running Windows 8.1 pro on VMware hosted by Mac OS. I want to capture the VM traffic via Wireshark installed on Mac. The Network Adapter on VM is set as Bridge (Ethernet). When I set Ethernet:...
0
votes
1answer
52 views

How to use the old Wireshark interface?

I download Wireshark 2.0 and it has a new interface. The Release Notes 2.0 say: Wireshark 2.0 features a completely new user interface which should provide a smoother, faster user experience. The ...
1
vote
0answers
73 views

Packet injection in a Wi-Fi network with card in monitor mode

I have a computer connected to a WEP-protected Wi-Fi network. With scapy I can forge packets (let's say ICMP) and send them to another station of the same network. If I put my wireless card in ...
0
votes
1answer
98 views

Sniff wireless (Wi-Fi) traffic with Wireshark

I have a wireless card (ALFA AWUS036H) in monitor mode (with airmon-ng start wlan0) on my Debian machine. In Wireshark, in "capture options", all my interfaces are in promiscuous mode. The test ...
0
votes
0answers
46 views

Problems with NAT - Wireshark shows TCP Dup ACK

I'm having some issues with NATing to a couple of web servers on my site. I initially thought it was my firewall after an update (smoothwall) but I blanked it and reinstalled and its still not working....
0
votes
1answer
61 views

Cannot see VOIP calls in Wireshark 2.0.0

I received a pcap dump from a site, running Cisco JTAPI, who's VOIP traffic I need to analyse. I use Wireshark's VOIP calls analyser via the menu: The conversations display fine in Wireshark v1.10....
2
votes
4answers
3k views

FTP disconnects after entering passive mode b/c packets are lost

For some reason, no matter how many times I try, after a client sends the PASV command (which is correctly received by the server), the server's reply (227 Entering Passive Mode) doesn't get back to ...
2
votes
1answer
1k views

Synergy choppiness: Is my wireless router delaying packets after silent period?

I am sharing keyboard and mouse between my Linux desktop and MacBook Air using Synergy. There is a very noticeable lag every time I begin moving my mouse (or start typing), but everything becomes ...