The network protocol analyzer developed and maintained by the Wireshark Foundation

learn more… | top users | synonyms

4
votes
0answers
250 views

why am I not seeing traffic using TCPDUMP while sniffing on wireless interface with the station in WDS mode

I've 2 wireless interfaces one has the type of AP and the other has the type monitor. the AP is attached to a bridge br-lan. When I run for example: tcpdump port 5201 -s 0 -ni wlan0 TCPdump is ...
3
votes
0answers
42 views

where does Windows Task Manager measure network data rate

I am trying to build a 10Gbps Ethernet channel between an FPGA and a Windows 7 PC. For a rough estimate, I measured the bandwidth usage of the link using Windows Task Manager's Network Tab. Later I ...
2
votes
0answers
43 views

Tshark. List all traffic between two IP's?

I am learning to use Tshark. I am trying to retrieve a list of all conversations between two IP addresses using Tshark. The two IP's are: 192.168.1.158|64.12.24.50 In Wireshark I am able to see the ...
2
votes
0answers
117 views

How to use wireshark to decode SSL stream from remote API server?

I'm trying to troubleshoot some issues with what my code is sending to a remote API (over https). I've seen a ton of articles on Wireshark and decoding SSL, but they all make up their own test server ...
2
votes
0answers
903 views

How to troubleshoot a VPN connection drop

I have a Windows 8 machine that won't connect to a work VPN (other machines configured the same* way work fine). The IT dept at work says the attempt never shows up in the logs. On my computer, it ...
2
votes
0answers
432 views

What happens when Capturing USB Packets using Wireshark

I am trying to capture the packets sent by a Mouse to a host PC using Wireshark. Operating System - Ubuntu 12.04 Wireshark - 1.8.2 Problem 1.) Before I plug in the USB Mouse, when I start the ...
2
votes
0answers
2k views

tcp port numbers reused on wireshark

I used raw socket to build a tcp client program on machine A to reproduce tcp 3-way handshake with a simple regular tcp server on machine B I captured packets on the client host and server host, and ...
2
votes
0answers
425 views

Decode SSL packets in WireShark

I have cert.cer, base64 x509 and a Wireshark dump in .pcap format. The packets are encoded, so how do I decode them? Now: [site-ip],443,http,xe.cer but it's still not working.
2
votes
0answers
464 views

Wireshark vs Netmon for precise time tagging

I'm using Wireshark to time tag and get some statistics on multicast traffic. When there is not much traffic, the stats looks good, but as soon as there is a bunch of packets arriving at the same ...
1
vote
0answers
52 views

Packet injection in a Wi-Fi network with card in monitor mode

I have a computer connected to a WEP-protected Wi-Fi network. With scapy I can forge packets (let's say ICMP) and send them to another station of the same network. If I put my wireless card in ...
1
vote
0answers
35 views

Use Ethernet only for Wireshark when WiFi is enabled (Linux)

I'm using Wireshark to capture network traffic (via a SharkTap 10/100.) This works well but when I plug in the Ethernet cable the laptop treats it as a normal LAN connection and routes all laptop ...
1
vote
0answers
68 views

How to parse a Wireshark pcap for a string

What efficient ways exist to parse a Wireshark capture to check for a given string? I'm trying to find a STOP command for an embedded device that its plaintext in the Wireshark 'info' field. Are ...
1
vote
0answers
20 views

Logging individual application network usage in Windows 8.1

I'm writing a review on ACD (Amazon Cloud Drive), and I need to know the following data for the ACD process: Which addresses does it visit, IP and domain; How much data does it send; Bandwidth usage ...
1
vote
0answers
71 views

Decoding HTTP GET parameter in Wireshark

I am capturing HTTP GET traffic with Wireshark and I have plenty of URLs that contain "cryptic" URL-encoded data. I'd like to see the URI split into the individual parameters see the parameter ...
1
vote
0answers
139 views

NAS causing Internet Time Outs on other computers

Yesterday I installed a new Synology DS715 NAS server. Since then the internet connection on all other LAN connected PCs encounter disconnects. This is most noticable when playing online games, which ...
1
vote
0answers
17 views

TCP Rentransmission when connecting sepcific website

Question: I'm an administrator of couple of websites. Every website is set on the same server provided by linuxpl.com. The server ip is: 95.211.176.132. The problem is, when I try to reach the server ...
1
vote
0answers
103 views

Running into problems while spoofing IP Address

I have a machine (IP:192.168.1.185) and i want to send spoofed IP address (e.g. 192.168.1.212) to another machine(192.168.1.213) . I am using a spoofing program for this which uses raw sockets. Now ...
1
vote
0answers
233 views

monitor and log LAN network traffic on CentOS 6.x

I've been fiddling with this one for almost a week now. My setup is: LAN (windows/linux PCs/servers) <-> CentOS gateway/firewall box <-> ISP I'm trying to setup a monitoring solution which ...
1
vote
0answers
109 views

What causes these corrupted downloads and spurious retransmissions?

I encountered many corrupted downloads recently. Sometimes compressed files wouldn’t open or checksums would not match. Sometimes images on Websites would just be grey (or a wild mix of colour) after ...
1
vote
0answers
99 views

Wireshark does not show my USB dongle as capture interface

I am using wireshark 1.12.6 on windows 8.1. I cannot set my USB dongle as the capture interface (in linux it shows the dongle also as the capture interface. How can I do this in Windows?
1
vote
0answers
151 views

TCPDUMP Network IPv6 Packets

I am new to tcpdump tool and I am working in the analysis of network packets, I have analysed the IPv4 Ip packtes generated in case of wifi. But Now I am running my android phone in sim's 3g network ...
1
vote
0answers
94 views

TCP packet issue with 802.11ac but not with 802.11n on an Android Nexus 6

I have an Android Nexus 6 that connects to my computer via an ad-hoc network. When my phone connects to the 802.11n card (TP-LINK 300Mbps Wireless N), the bytes are sent with no issue; verified with ...
1
vote
0answers
418 views

Viewing Xbox One Network Traffic

I am trying to view the HTTP/HTTPS traffic going from my XBOX one so I can see what is being requested. I started off trying to use Charles proxy like this https://www.youtube.com/watch?v=MP4ZcwSHxbw. ...
1
vote
0answers
45 views

Long SMB session setup delay

I have a Windows machine connecting to an SMB share on a local Debian server. Everything works flawlessly, when it's connected, but the first connection (either after a boot / reboot, or after ...
1
vote
0answers
173 views

How to split pcap files maintaining tcp sessions

I have a pcap file which contains tcp traces. I was wondering if there's a way to split these traces in order to maintain tcp flows, but also filtering the traffic on a src ip basis. For example, if ...
1
vote
0answers
937 views

How to change mode of an airmon-ng created interface(mon0) from managed to monitor?

I am connecting to a home router using wifi. The detais of my wireless cards are as follows: #lspci 01:00.0 Network controller: Qualcomm Atheros AR9485 Wireless Network Adapter (rev 01) #lspci -vv ...
1
vote
0answers
379 views

Capture network traffic between VM's Virtualbox using Wireshark

I'm trying to capture all network traffic between VMs (and in the VMs to themselves) running on a single host using Virtualbox for the VMs and Wireshark for the capturing. VMs are Ubuntu 14.04 and the ...
1
vote
0answers
25 views

Route network traffic back to the same wire

I would like to monitor outgoing traffic from my wi-fi connected phone using Wireshark on my Windows desktop. I changed default gateway on the phone to the IP of the desktop and Wireshark can now see ...
1
vote
0answers
162 views

Can network sniffing in promisc mode on a network bridge produce “false” TCP retransmissions?

I have a Wireshark log from a computer that was running Ubuntu and tshark. The computer has two NICs and I've connected them to a bridge (using /etc/network/interfaces) and gave that bridge a static ...
1
vote
0answers
562 views

how to sniff from a TP-Link ADSL modem?

I have a PC and a tablet that connected to a TP-Link ADSL modem. PROBLEM: I want to see the packets that send and receive from my modem not my PC( to see both wire and wireless packets) I search ...
1
vote
0answers
303 views

RST, ACK from 216.98.48.133 without any SYN from me? For real? How? Why?

I am trying to figure out why I always get "The Ubisoft server is not available at the time. Please try again later." Apparently, the server is actually up and running, so it seems the problem is on ...
1
vote
0answers
170 views

mergecap fails to create output file when run from crontab

I have created a script to merge pcap files using 'mergecap -w '. The script doesn't work as the output file is not already present. So I tried to use 'touch outputfile.pcap' before the mergecap ...
1
vote
0answers
30 views

Utility service that logs total network usage

I would like to know the total bandwidth our internet provider essentially provides to the many competing devices in our home. Is there a simple windows service that uses a wireshark like trick to log ...
1
vote
0answers
327 views

Booting with nfs just prints some weird character

Problem I have an embedded system which I am unable to boot via NFS using an Embedded Linux Kernel Image and rootfs both placed on my laptop (which serves as the NFS server as well as a TFTP ...
0
votes
0answers
28 views

Windows Server 2012 r2 DHCP not serving addresses

Yesterday I encoutered a DHCP problem. After windows update and restart, my dhcp won't serve any new IP addresses. The ones wich has been sent before are working but no new IP-s. I tried restarting ...
0
votes
0answers
14 views

Using TCPView / wireshark to find exact address application reaches

I think a c++ application I have on my computer is download a virus from a server. I have used wire shark and TCPView and have determined the global broadcasting address it is connecting to. However ...
0
votes
0answers
16 views

Unable to find traffic for specific device w/ Wireshark (over Wi-Fi)

I have a device communicating with a TCP server running on my machine. My machine is normally connected to the network via ethernet, however I also have a wireless adapter that I can use to connect to ...
0
votes
0answers
43 views

Simple ICMP DOS attack example with cmd on Windows 10 crashing the attacker's computer?

I had to make a simple batch file as an assignment in which I had to attack another pc on the same network by a ICMP DOS attack and analyze the traffic using Wire-Shark. Here the code which I used: ...
0
votes
0answers
6 views

Capturing virtual machine traffic from Mac OS

I am running Windows 8.1 pro on VMware hosted by Mac OS. I want to capture the VM traffic via Wireshark installed on Mac. The Network Adapter on VM is set as Bridge (Ethernet). When I set ...
0
votes
0answers
30 views

Problems with NAT - Wireshark shows TCP Dup ACK

I'm having some issues with NATing to a couple of web servers on my site. I initially thought it was my firewall after an update (smoothwall) but I blanked it and reinstalled and its still not ...
0
votes
0answers
16 views

How do I configure an ESP SA for wireshark 2.0.2 to decrypt ? It doesn't seem to let me set up the SAs

I read detailed directions which do not correspond to what I see in ESP (Edit->Preferences->Protocols->ESP) I see ESP SAs [Edit..] but, clicking edit, I cannot edit. What is the trick ?
0
votes
0answers
29 views

Troubleshooting dropped packets in Telegram Messenger

I'm experiencing problems in using Telegram Messenger on my Mac, but only when connected at home (specifications at the end). More specifically, when uploading and downloading media (or even while ...
0
votes
0answers
49 views

NAT doesn't allow TCP ACK for sent TCP SYN

We are using TCP Simultaneous Open for connecting TCP socket. Lets call one SideA and other SideB. From the wireshark log I see that first two SYN sent from SideB is blocked by SideA NAT. Then SideA ...
0
votes
0answers
24 views

Wireshark FTP multiple ACK?

I'm trying to visualise somes frames that correspond to a file transfer between two machines on Wireshark. The thing is that there are multiple ACK for each FTP-DATA segment and I don't understand ...
0
votes
0answers
83 views

Spying on Wi-Fi-connected device from laptop

I want to capture (and possibly modify) packets from a WiFi-connected device using my MacBook Pro and I am trying to figure out the most straightforward way of doing so. I have solved the problem ...
0
votes
0answers
67 views

Replay captured TCP packets

I captured a tcp traffic using wireshark and saved the traffic in pcap file. I did two tests: Test 1: sudo tcprewrite --infile=capturedtraffic.pcap --outfile=temp.pcap ...
0
votes
0answers
25 views

Routing between two NICs same PC

I have two NICs, 192.168.56.0/24 and my wifi NIC 192.168.1.0/24. Can I route between these two NICs to be able to ping from my Physical HOST to any host on 192.168.56.0/24 while using VMs? I know ...
0
votes
0answers
20 views

Windows 7 frequent download interruption

I just upgraded to Windows 7 Pro from Home Premium, and now almost all downloads (Youtube videos, online games, ftp/http downloads) are interrupted after a random length of time. Sometimes the ...
0
votes
0answers
55 views

Wireshark isn't showing all interfaces in Windows 7

This is what I've done to check what was going on: Restarted PC Made sure WinPCAP driver (NPF) was installed Stopped and started NPF driver Running as admin But it's only showing one interface, ...
0
votes
0answers
37 views

IKEv2, ESP PFS. Which packets includes the configuration?

i am investigating currently the IKEv2 protocol with ESP payload encryption. For ESP i want to use PFS with DH Group 5 (which works). However, i am not able to figure out in which packet this settings ...