The network protocol analyzer developed and maintained by the Wireshark Foundation

learn more… | top users | synonyms

3
votes
0answers
68 views

why am I not seeing traffic using TCPDUMP while sniffing on wireless interface with the station in WDS mode

I've 2 wireless interfaces one has the type of AP and the other has the type monitor. the AP is attached to a bridge br-lan. When I run for example: tcpdump port 5201 -s 0 -ni wlan0 TCPdump is ...
2
votes
0answers
635 views

How to troubleshoot a VPN connection drop

I have a Windows 8 machine that won't connect to a work VPN (other machines configured the same* way work fine). The IT dept at work says the attempt never shows up in the logs. On my computer, it ...
2
votes
0answers
1k views

tcp port numbers reused on wireshark

I used raw socket to build a tcp client program on machine A to reproduce tcp 3-way handshake with a simple regular tcp server on machine B I captured packets on the client host and server host, and ...
2
votes
0answers
379 views

Decode SSL packets in WireShark

I have cert.cer, base64 x509 and a Wireshark dump in .pcap format. The packets are encoded, so how do I decode them? Now: [site-ip],443,http,xe.cer but it's still not working.
2
votes
0answers
456 views

Wireshark vs Netmon for precise time tagging

I'm using Wireshark to time tag and get some statistics on multicast traffic. When there is not much traffic, the stats looks good, but as soon as there is a bunch of packets arriving at the same ...
1
vote
0answers
40 views

TCP packet issue with 802.11ac but not with 802.11n on an Android Nexus 6

I have an Android Nexus 6 that connects to my computer via an ad-hoc network. When my phone connects to the 802.11n card (TP-LINK 300Mbps Wireless N), the bytes are sent with no issue; verified with ...
1
vote
0answers
46 views

Viewing Xbox One Network Traffic

I am trying to view the HTTP/HTTPS traffic going from my XBOX one so I can see what is being requested. I started off trying to use Charles proxy like this https://www.youtube.com/watch?v=MP4ZcwSHxbw. ...
1
vote
0answers
23 views

Long SMB session setup delay

I have a Windows machine connecting to an SMB share on a local Debian server. Everything works flawlessly, when it's connected, but the first connection (either after a boot / reboot, or after ...
1
vote
0answers
343 views

How to use Charles as proxy to decrypt HTTPS messages in Wireshark?

I know I can view decrypted HTTPS data directly in Charles. But I want to view lower level SSL messages in Wireshark. So I setup Charles as the SSL proxy, using my own certificate, and I setup SSL ...
1
vote
0answers
85 views

How to split pcap files maintaining tcp sessions

I have a pcap file which contains tcp traces. I was wondering if there's a way to split these traces in order to maintain tcp flows, but also filtering the traffic on a src ip basis. For example, if ...
1
vote
0answers
200 views

Capture network traffic between VM's Virtualbox using Wireshark

I'm trying to capture all network traffic between VMs (and in the VMs to themselves) running on a single host using Virtualbox for the VMs and Wireshark for the capturing. VMs are Ubuntu 14.04 and the ...
1
vote
0answers
20 views

Route network traffic back to the same wire

I would like to monitor outgoing traffic from my wi-fi connected phone using Wireshark on my Windows desktop. I changed default gateway on the phone to the IP of the desktop and Wireshark can now see ...
1
vote
0answers
68 views

Can network sniffing in promisc mode on a network bridge produce “false” TCP retransmissions?

I have a Wireshark log from a computer that was running Ubuntu and tshark. The computer has two NICs and I've connected them to a bridge (using /etc/network/interfaces) and gave that bridge a static ...
1
vote
0answers
337 views

how to sniff from a TP-Link ADSL modem?

I have a PC and a tablet that connected to a TP-Link ADSL modem. PROBLEM: I want to see the packets that send and receive from my modem not my PC( to see both wire and wireless packets) I search ...
1
vote
0answers
190 views

RST, ACK from 216.98.48.133 without any SYN from me? For real? How? Why?

I am trying to figure out why I always get "The Ubisoft server is not available at the time. Please try again later." Apparently, the server is actually up and running, so it seems the problem is on ...
1
vote
0answers
124 views

mergecap fails to create output file when run from crontab

I have created a script to merge pcap files using 'mergecap -w '. The script doesn't work as the output file is not already present. So I tried to use 'touch outputfile.pcap' before the mergecap ...
1
vote
0answers
26 views

Utility service that logs total network usage

I would like to know the total bandwidth our internet provider essentially provides to the many competing devices in our home. Is there a simple windows service that uses a wireshark like trick to log ...
1
vote
0answers
295 views

What happens when Capturing USB Packets using Wireshark

I am trying to capture the packets sent by a Mouse to a host PC using Wireshark. Operating System - Ubuntu 12.04 Wireshark - 1.8.2 Problem 1.) Before I plug in the USB Mouse, when I start the ...
1
vote
0answers
728 views

Synergy choppiness: Is my wireless router delaying packets after silent period?

I am sharing keyboard and mouse between my Linux desktop and MacBook Air using Synergy. There is a very noticeable lag every time I begin moving my mouse (or start typing), but everything becomes ...
1
vote
0answers
316 views

Booting with nfs just prints some weird character

Problem I have an embedded system which I am unable to boot via NFS using an Embedded Linux Kernel Image and rootfs both placed on my laptop (which serves as the NFS server as well as a TFTP ...
0
votes
0answers
18 views

Connection interruptions on Debian router, possibly due to excessive duplicate ACKs?

I have a Debian server as a house router, which for a year has been working flawlessly. However, I recently moved and switched service providers from FiOS to Comcast, and possibly as a result am ...
0
votes
0answers
5 views

Tshark interface to sniff on

I have a MQTT broker and a MQTT client both running on the same machine. The client sends publish packets to the broker. The broker processes it and sends it back to the same client as publish packet. ...
0
votes
0answers
12 views

Using I/O graph how to interept bytes/tick against packet details information?

I'm working on a trace-file which has reported ISP throttling occurrences in it. My task is to use IO graph to understand at what point in time the throttling process effected client upload ...
0
votes
0answers
23 views

Monitor TCP port traffic and get a sound alert when a specific text string is found on Windows

I need to watch a port for several hours and make an audible alert whenever a specific string comes through. Windows only. Is this possible with Wireshark or another sniffer tool or maybe a sniffer ...
0
votes
0answers
20 views

router automatically disables wifi and enables after 2-3min

Router: Netgear DGN2200v2 Problem: THe router disables the wifi network automatically(with no human interference what so ever), thus all pc's disconnect and have no network access(as if the router ...
0
votes
0answers
31 views

How to get Alfa awus036nha to work with Ubuntu 14.04?

I installed Ubuntu 14.04 in a dual boot configuration with OS X Yosemite. I then installed Wireshark on Ubuntu and I'm going to use an Alfa AWUS036NHA (Atheros chipset) adapter. The problem is that ...
0
votes
0answers
24 views

How to capture VirtualBox VM packets

I am currently running a series of three Ubuntu 14.04 VMs on my Windows 7 x64 host. The guests are all configured thusly: Host-Only Adapter Intel Pro/1000 MT Desktop Promiscuous Mode: Allow VMs Cable ...
0
votes
0answers
34 views

Https request call capture in Wireshark

I have installed Wireshark and Windows based application(to be analyzed) which uses https request authentication to validate user.When I use interfaces -- > capture all the request of my system is ...
0
votes
0answers
68 views

WireShark - Vmware Network Interfaces

I've recently installed wireshark v1.12.4 on my Windows 8 Machine, and I am totally new to the program. I have a virtual machine running on vmware (Red Hat Linux 7.2) and got all the network ...
0
votes
0answers
141 views

Wireshark fails to install on OS X 10.10.3 using brew

I've encountered the following issue while installing wireshark via brew. ➜ ~ brew reinstall wireshark --with-qt5 ==> Reinstalling wireshark with --with-qt5 ==> Downloading ...
0
votes
0answers
34 views

Decrypt SSL Data in wireshark

In all the tutorials which I saw in web, they pointed me to add key file in Edit->Prefereces->Protocols->SSL->SSL key file but there is no such SSL key file in version I use. Can somebody guide how ...
0
votes
0answers
35 views

Reading packets with Wireshark

How do I read packets captured with Wireshark. I was finally able to capture incoming and outgoing data in hopes of developing something along the lines of an IDS. Thanks in advance for the help. A ...
0
votes
0answers
25 views

tcptrace from wireshark capture

How can I use tcptrace to generate tcptrace graph from captures on wireshark ? I already know how to generate the tcptrace on wireshark itself, but I want to generate the graph outside wireshark ...
0
votes
0answers
20 views

Wireshark capture file: getting “missing packet” now, was not there 1 year ago

I captured data on a LAN. I then opened the pcap file with wireshark and could extract an email which was sent unencrypted on purpose. Means, I selected a package from the email and used "follow TCP ...
0
votes
0answers
25 views

VirtualBox Network confusion?

I'm trying to adjust my VirtualBox guest network in order for my guest O/S traffic look like its coming from my Host. Can I do this with NAT? Here's a simpler outlook on what I am trying to achieve ...
0
votes
0answers
41 views

Wireshark capture SSL only

I would like to capture SSL or HTTPS traffic only in Wireshark, this is not something that can be filtered after due to the length of the time I would be recording the data after and the size of the ...
0
votes
0answers
264 views

Whatsapp traffic analyzed by WireShark

how to know info about the person I chat with in the Whatsapp by analyzing traffic got by WireShark Software where is he located at the moment of chatting. regards, Samad
0
votes
0answers
47 views

Do not fragment bit and windows 7

Recently had an issue where the DF bit was set to 1 going from a W7 workstation to the update server, the issue is it was sending 32K of data when the MTU was set to 1500. When the packet hits the NIC ...
0
votes
0answers
145 views

init-p01md.apple.com/bag - iMessage?

I have a question about Apple network traffic. In my network program I can see these three domains (GET) http://init-01md.apple.com/bag http://init.ess.apple.com/WebObjects/VCInit.woa/wa/getBag?ix=1 ...
0
votes
0answers
22 views

Frame logging of third party hardware on my router (specifically smart TV)

After reading recently about so-called smart TVs "listening" to sound in a person's home, and transmitting this recorded sound across the internet for speech-to-text translation, I have become curious ...
0
votes
0answers
35 views

Can I use a Windows 7 Computer as a Bridge and Sniff Traffic

Sorry if this has been asked before, but I've been searching for quite a while. My question is simple - can I use a Windows 7 computer as a bridge, and run WireShark to capture all of the packets at ...
0
votes
0answers
18 views

WLAN topology: does it work like a bus?

Does wifi work as a star network with a switch or does it work like a bus ? To be more precise, if I am in promiscuous mode, do I only see my traffic and broadcasted messages or do I get every packet ...
0
votes
0answers
53 views

HTTP Sniffing using wireshark

I am using Wireshark on my Mac, which is running Yosemite. When I am sniffing the HTTP protocol, I can only see the HTTP/get and I cannot see the HTTP/OK.. Is there a way to enable this on my MAC? I ...
0
votes
0answers
129 views

Why does lldpctl show no neighbors on standalone Ubuntu system?

I have installed sudo apt-get install lldp in two different ubuntu system and in both system I have set (/etc/default/lldp) DAEMON_ARGS="-x -c -s -e -l" I have check in wireshark also transmitted ...
0
votes
0answers
75 views

Windows7 LIVE CD with winpcap

Is it possible to create a LiveCD of windows 7 with winpcap installed for wireshark. I already tried with winbuilder 0.82 but there is no working script for winpcap and since it is not a portable app ...
0
votes
0answers
45 views

Wifi sniffing only outgoing packets

When I am setting my wifi card in monitor mode and disconnecting it from wifi I am able to sniff every packet coming in and out from my tablet (http requests and responses) but when I connect to ...
0
votes
0answers
96 views

packet sniffing 3ds

I am trying to packet sniff my 3DS just to see what information is available. With Wireshark I noticed that I can only capture traffic which communicates with my computer directly, and not any device ...
0
votes
0answers
497 views

How to change mode of an airmon-ng created interface(mon0) from managed to monitor?

I am connecting to a home router using wifi. The detais of my wireless cards are as follows: #lspci 01:00.0 Network controller: Qualcomm Atheros AR9485 Wireless Network Adapter (rev 01) #lspci -vv ...
0
votes
0answers
27 views

Wireshark dont work after install VirtualBox

I have the following problem whit Wireshark. I function normally until I installed Oracle VM VirtualBox, after installation of said program to me at the start Wireshark occur following problem: "No ...
0
votes
0answers
34 views

Eliminating extraneous network traffic

If I wanted to get the best performance (high data rate, low latency) out of an isolated gigabit ethernet LAN (N.B. NOT connected to the internet) I would assume this would occur when there was no ...