Open-source network packet analyzer
0
votes
1answer
32 views
Browser communication to a webserver and the OSI model
If I use google chrome (on a windows 7 machine) to access https://www.google.com, can someone tell me where the involved pieces fit into the OSI model?
I would also like to know
If I use ...
0
votes
1answer
834 views
Wireshark sniffing “microsoft-ds [syn] seq=0..”
I'm new to wireshark. (installed it today)
I'm just looking at the traffic and noticed this kind of packages:
60261 microsoft-ds [syn] seq=0 Win=8192 Len=0 MSS=1460 SACK_PERM=1
its sent to ip: ...
0
votes
1answer
34 views
How can I capture packets belonging to a certain process
I need to capture packets belonging to a program or process. I know Winshark, but it just displays network traffic in a mess (in my view).
If one wants to get the packets of a given process, you must ...
5
votes
3answers
4k views
Wireshark WPA 4-way handshake
From this wiki page:
WPA and WPA2 use keys derived from an EAPOL handshake to encrypt traffic. Unless all four handshake packets are present for the session you're trying to decrypt, Wireshark ...
0
votes
1answer
51 views
dig OK but dig @192.168.1.1 NOT
why dig works OK, but dig my NetGear router directly doesn't (while first goes to it too, because it is my DNS, NetGear itself has 8.8.8.8 set as prim dns). My NetGear has IP 192.168.1.1 on LAN. Here ...
1
vote
3answers
2k views
How to test Bit Error Rates on Ethernet Networks?
I need a tool software or otherwise (preferably software) that will allow me to test Bit Error Rates on an Ethernet Network.
I am using a software tool that I did not write and do not have access to ...
0
votes
1answer
42 views
Scapy: TCP Retransmission error
I've been using Scapy to send SCCP or Skinny packets to my Cisco Desk Phone. However I keep getting these TCP Retransmission errors, and I believe this is causing the Cisco Phone to not respond. I ...
5
votes
3answers
4k views
Wireshark cannot see traffic from a VirtualBox guest on Windows 7
I have been trying to use Wireshark to capture some traffic that comes from a virtual machine.
The setup is:
Windows 7 host
Ubuntu guest
VirtualBox 4
I send some packets from the guest to the ...
0
votes
1answer
77 views
vlc part of desktop streaming to <host>:<port>
With VLC, I wish to stream a portion of the desktop and send it to another host on my local area network.
The capture seems to work, I see a correct portion of the desktop into the VLC server, but ...
0
votes
1answer
68 views
Why Wireshark is not showing high layer packets like ICMP/IP/UDP? (Only broadcast packets are shown)
I am using Wireshark for 802.11g sniffing. The AP is not using any encryption. These are my observations:
The vast majority packets are beacons and the probe requests.
If I filter out beacons using ...
4
votes
1answer
4k views
Capture traffic for specific application
I have the application which communicate with some server. I want to know what is the IP of this server. How can I capture all the traffic from specific application and not just all the traffic like ...
1
vote
0answers
25 views
How to identify which network interface is my application using [duplicate]
I hoped to capture network traffic -using Wireshark- via a port on which my application is running. However when I fired up Wireshark, it listed 4 network interfaces not just 1 as I expected.
So I ...
0
votes
2answers
1k views
How can I capture other computers traffic in Wireshark on a WiFi-network?
I run Wireshark on a MacBook Air and I also have a Android phone on the same WiFi-network. If I visit a website with the Android phone I can't see that DNS-traffic (or other traffic) in Wireshark on ...
0
votes
1answer
46 views
wireshark: how to capture traffic between guest and host OS?
I'm trying to set up a lab to demonstrate ipv6 attack and detection mechanism on my Macbook. This is my set up with virtualbox:
Host OS: OS X 10.8.2 IPv6 automatically, wireless connection Geust
OS: ...
0
votes
1answer
40 views
wireshark makes network working
Have a number of boards with ethernet on it. Some boards have hardware bug. When pinging such boards, not always got answers.
But when running wireshark capture mode, have stable network exchange ...
0
votes
0answers
50 views
Check whether a packet contains some fields and then log all subsequent ones in Wireshark
How can I write a filter in Wireshark that checks if the first packet has some field, then checks the new packets for another field, and if they matched, show what you got:
if (someone has my valid ...
0
votes
0answers
49 views
Capturing Internet Connection Sharing (ICS) traffic using Fiddler
Does anyone have any idea how to capture HTTP traffic that goes through my ICS connection?
Full details:
I have a PC connected to internet via Ethernet.
PC has set up a Wifi Hotspot using Internet ...
2
votes
2answers
2k views
Installing WinPcap on Windows 8
I know there has been lots of discussion already on installing WinPcap on Windows 8. I'm running the RTM version. I was able to install WinPcap without a hitch by using the Windows 7 compatibility ...
1
vote
1answer
618 views
Windows 7 PC sends a lot of NetBIOS Name Queries for non-existent computer names
I have a Windows 7 PC, and have been monitoring network traffic using Wireshark, and I'm seeing this PC send out a lot of NetBIOS Name Queries for non-existent computer names.
These are some of the ...
1
vote
1answer
96 views
Record multicast stream on multi-homed Linux host
I have what sounds like the simplest possible use case, and yet nothing is satisfactory.
I have a multi-homed host and I would like to listen to multicasts on eth1, and shove all the payload (NOT ...
0
votes
2answers
155 views
Wireshark - Help seeing all network traffic
I have a Ralink RT3290 802.11bgn Wi-Fi Adapter and am running Windows 8. Sadly although my new computer helps in the design and testing of my touch based applications, my Network Engineering abilities ...
0
votes
2answers
125 views
Sniffing network traffic these days
I've been always worrying about using HTTPS in all sites and using secure connections in Messenger, Email, etc, because I don't want people being able to read my private info or hacking my sessions on ...
0
votes
0answers
38 views
Follow a .pcap file in wireshark like tail -f
I have a .pcap file on my android device, that I can access from my PC with wireshark via smb and wondering if it possible to get a 'Live view' of that file in wireshark.
Is there any solution?
1
vote
0answers
92 views
tcp port numbers reused on wireshark
I used raw socket to build a tcp client program on machine A to reproduce tcp 3-way handshake with a simple regular tcp server on machine B
I captured packets on the client host and server host, and ...
0
votes
1answer
69 views
display and save only packet captured by filter
how can I let wireshark display only packets that are captured by a filter I don't want to have all packets, this takes a large memory space ?
0
votes
0answers
88 views
Analyzing home network traffic using wireshark
I am using wireshark to analyize my home netowrk traffic since it has become painfully slow (Slow download speeds) recently (restarting modem and MediaLink router didn't help, also upgraded the ...
0
votes
3answers
199 views
RS232 / Ethernet Port Servers - Protocols Involved?
Firstly, I'm not responsible for the equipment, so don't panic that I'm asking such basic questions :)
At work we have multiple RS232 / Ethernet port servers (Say the 16 port version of this ...
0
votes
0answers
58 views
Traffic of virtual machine capture in ubuntu 12
I have ubuntu 12 running on my PC . On this Ubuntu, I have another linux distribution running on a virtual machine (virtual box).
When I launch a ping from ubuntu to the virtual machine, the ping ...
0
votes
0answers
39 views
Networking ping
I installed OpenWrt in VirtualBox with this network configuration:
-access bridge
-eth0
-type of card: PCnet-FAST III
the eth0 adress of OpenWrt is: 192.168.1.226 the eth0 adress of the OS ...
0
votes
1answer
64 views
why does Wireshark on Mac OS X runs on X11?
I know little bit about X11 and i have used it for remotely interacting with my applications on my Linux machine. But I don't understand why running Wireshark locally will start an X11 process?
1
vote
3answers
2k views
Wireshark Not Displaying Packets From Other Network Devices, Even in Promisc Mode
System Setup:
1. MacBook Air running Mountain Lion and connected wirelessly to a router.
2. Wireshark installed and capturing packets (I have "capture all in promiscuous mode" checked)
3. I filter out ...
1
vote
3answers
105 views
Why does Wireshark show MAC addresses in the source\destination?
Every device on the my LAN should have IP's along with MAC addresses, and for most of the traffic Wireshark gets on me device, the source and destination columns shows IP addresses, but sometimes it ...
0
votes
0answers
67 views
Synergy choppiness: Is my wireless router delaying packets after silent period?
I am sharing keyboard and mouse between my Linux desktop and MacBook Air using Synergy. There is a very noticeable lag every time I begin moving my mouse (or start typing), but everything becomes ...
1
vote
1answer
67 views
Lightweight network packet capture solution for windows? [closed]
I'm looking for a lightweight packet capture solution for Windows. It needs to capture all packets on a physical network device and write them to a file (preferably .pcap, because that's easiest for ...
2
votes
2answers
1k views
How do I trace HTTP packets with Wireshark?
What can I do in order to see packets that come from different sessions in a web page?
For example when I open yahoo.com there are different sessions in yahoo; I dont know how to see which packet is ...
-1
votes
2answers
136 views
Reconstructing web content through Wireshark
Suppose I have a Wireshark log of traffic from a web site.
Can I reconstruct various elements like HTML file, picture files, java script files, etc?
Ideally, it'd take the .pcap file and ...
0
votes
0answers
128 views
DNS leak: Looking up own hostname with DNS queries
I was checking a proxied program for DNS leaks with tshark when I noticed this:
13.170066 10.0.2.15 -> 192.168.1.1 DNS 66 Standard query 0xd473 A [hostname]
13.753496 10.0.2.15 -> ...
0
votes
2answers
59 views
How to check the packets in wireshark while doing the internet
I am using Wireshark first time.Can we see the packet in wireshark while having the internet on the laptop(or PC).
But I don't see any packet in wireshark.While I have internet connection.
Please ...
0
votes
2answers
96 views
Filter in Wireshark for TLS's Server Name Indication field
Does wireshark have a filter for TLS's Server Name Indication field?
0
votes
1answer
110 views
change Wireshark file (pcap file) via bittwiste (change ip)
i want to take pcap file and change all packet with specific ip to new ip and i know i can do it in this way:
bittwiste.exe -I myFile.pcap -O newFile.pcap -T ip -s 192.0.16.50,61.68.133.207
...
0
votes
1answer
101 views
How do I capture 802.11 headers on an AP while not in monitor mode?
I am wondering if it is possible to extract 802.11 frames on a router running OpenWrt operating as an access point. I tried using tcpdump and loading the dumped packets in Wireshark, but I could only ...
0
votes
3answers
262 views
Sniff traffic coming from one particular application?
Basically I'd like to sniff HTTP requests made by an .exe on Windows. I tried using wireshark, but it's somewhat unhandy since it sniffs all traffic on the interface. Are there any alternatives?
0
votes
2answers
93 views
How can I filter out a large number of addresses in Wireshark
I'm looking to create a "blacklist" of IP addresses that Wireshark will ignore.
I'm monitoring traffic originating on an iPhone, and there's a lot of chatter from Apple, Google Services, etc. I never ...
3
votes
1answer
9k views
Capturing wireless traffic (using Wireshark)
When I run wireshark on a wired network it works fine and reports all of the packets.
When I run it on a wireless network though I only see my own traffic. The wireless card I have is supposed to ...
0
votes
1answer
83 views
how to capture rsync traffic in wireshark
I want to analyse what raw-data rsync transfers across for a sample input file.
So I am using rsync over rsh (As traffic captured in wireshark will be easy to interpret).
I am using following rsync ...
0
votes
0answers
244 views
RegEx and RTMP for XBMC & LiveStreams
I love this idea/tool and I'd like to master it: LiveStreams (video) Add-on - an alternative to .strm files
I downloaded C420's LiveStreams addon and it works great! I have since tried applying the ...
1
vote
1answer
47 views
Capture internal ports
Is there any way to capture packets all through internal ports
for ex:
A packets from 192.168.2.79 4000 to 192.168.2.79 4001
In this case its a TCP connection and the packets will not flow out ...
0
votes
0answers
30 views
How to differentiate between three different flavours of pcap files?
There appears to be 3 different file formats associated with the ".pcap" extension -- libpcap /w microsecond timestamps, libpcap /w nanosecond timestamps, and pcapng.
Is there an easy way to ...
0
votes
1answer
226 views
Orbit Download Manager massive send packets (no torrent)
recently I've noticed my internet connection speed is low even my modem console was opening very slow , after troubleshooting using Wireshark I've found massive packets send to "sg.ilovewebgame.co.kr" ...
2
votes
1answer
429 views
Excessive “name query” and “standard query” activity on Wireshark?
I started using Wireshark on some class at university and decided to look at my home wireless network with it, just out of curiosity. But now I'm noticing excessive activity to what it looks like a ...
