The network protocol analyzer developed and maintained by the Wireshark Foundation

learn more… | top users | synonyms

4
votes
0answers
201 views

why am I not seeing traffic using TCPDUMP while sniffing on wireless interface with the station in WDS mode

I've 2 wireless interfaces one has the type of AP and the other has the type monitor. the AP is attached to a bridge br-lan. When I run for example: tcpdump port 5201 -s 0 -ni wlan0 TCPdump is ...
2
votes
0answers
32 views

Tshark. List all traffic between two IP's?

I am learning to use Tshark. I am trying to retrieve a list of all conversations between two IP addresses using Tshark. The two IP's are: 192.168.1.158|64.12.24.50 In Wireshark I am able to see the ...
2
votes
0answers
837 views

How to troubleshoot a VPN connection drop

I have a Windows 8 machine that won't connect to a work VPN (other machines configured the same* way work fine). The IT dept at work says the attempt never shows up in the logs. On my computer, it ...
2
votes
0answers
2k views

tcp port numbers reused on wireshark

I used raw socket to build a tcp client program on machine A to reproduce tcp 3-way handshake with a simple regular tcp server on machine B I captured packets on the client host and server host, and ...
2
votes
0answers
414 views

Decode SSL packets in WireShark

I have cert.cer, base64 x509 and a Wireshark dump in .pcap format. The packets are encoded, so how do I decode them? Now: [site-ip],443,http,xe.cer but it's still not working.
2
votes
0answers
462 views

Wireshark vs Netmon for precise time tagging

I'm using Wireshark to time tag and get some statistics on multicast traffic. When there is not much traffic, the stats looks good, but as soon as there is a bunch of packets arriving at the same ...
1
vote
0answers
18 views

Logging individual application network usage in Windows 8.1

I'm writing a review on ACD (Amazon Cloud Drive), and I need to know the following data for the ACD process: Which addresses does it visit, IP and domain; How much data does it send; Bandwidth usage ...
1
vote
0answers
28 views

Decoding HTTP GET parameter in Wireshark

I am capturing HTTP GET traffic with Wireshark and I have plenty of URLs that contain "cryptic" URL-encoded data. I'd like to see the URI split into the individual parameters see the parameter ...
1
vote
0answers
70 views

NAS causing Internet Time Outs on other computers

Yesterday I installed a new Synology DS715 NAS server. Since then the internet connection on all other LAN connected PCs encounter disconnects. This is most noticable when playing online games, which ...
1
vote
0answers
12 views

TCP Rentransmission when connecting sepcific website

Question: I'm an administrator of couple of websites. Every website is set on the same server provided by linuxpl.com. The server ip is: 95.211.176.132. The problem is, when I try to reach the server ...
1
vote
0answers
76 views

Running into problems while spoofing IP Address

I have a machine (IP:192.168.1.185) and i want to send spoofed IP address (e.g. 192.168.1.212) to another machine(192.168.1.213) . I am using a spoofing program for this which uses raw sockets. Now ...
1
vote
0answers
72 views

What causes these corrupted downloads and spurious retransmissions?

I encountered many corrupted downloads recently. Sometimes compressed files wouldn’t open or checksums would not match. Sometimes images on Websites would just be grey (or a wild mix of colour) after ...
1
vote
0answers
53 views

Wireshark does not show my USB dongle as capture interface

I am using wireshark 1.12.6 on windows 8.1. I cannot set my USB dongle as the capture interface (in linux it shows the dongle also as the capture interface. How can I do this in Windows?
1
vote
0answers
99 views

How to use wireshark to decode SSL stream from remote API server?

I'm trying to troubleshoot some issues with what my code is sending to a remote API (over https). I've seen a ton of articles on Wireshark and decoding SSL, but they all make up their own test server ...
1
vote
0answers
109 views

TCPDUMP Network IPv6 Packets

I am new to tcpdump tool and I am working in the analysis of network packets, I have analysed the IPv4 Ip packtes generated in case of wifi. But Now I am running my android phone in sim's 3g network ...
1
vote
0answers
86 views

TCP packet issue with 802.11ac but not with 802.11n on an Android Nexus 6

I have an Android Nexus 6 that connects to my computer via an ad-hoc network. When my phone connects to the 802.11n card (TP-LINK 300Mbps Wireless N), the bytes are sent with no issue; verified with ...
1
vote
0answers
295 views

Viewing Xbox One Network Traffic

I am trying to view the HTTP/HTTPS traffic going from my XBOX one so I can see what is being requested. I started off trying to use Charles proxy like this https://www.youtube.com/watch?v=MP4ZcwSHxbw. ...
1
vote
0answers
39 views

Long SMB session setup delay

I have a Windows machine connecting to an SMB share on a local Debian server. Everything works flawlessly, when it's connected, but the first connection (either after a boot / reboot, or after ...
1
vote
0answers
146 views

How to split pcap files maintaining tcp sessions

I have a pcap file which contains tcp traces. I was wondering if there's a way to split these traces in order to maintain tcp flows, but also filtering the traffic on a src ip basis. For example, if ...
1
vote
0answers
831 views

How to change mode of an airmon-ng created interface(mon0) from managed to monitor?

I am connecting to a home router using wifi. The detais of my wireless cards are as follows: #lspci 01:00.0 Network controller: Qualcomm Atheros AR9485 Wireless Network Adapter (rev 01) #lspci -vv ...
1
vote
0answers
322 views

Capture network traffic between VM's Virtualbox using Wireshark

I'm trying to capture all network traffic between VMs (and in the VMs to themselves) running on a single host using Virtualbox for the VMs and Wireshark for the capturing. VMs are Ubuntu 14.04 and the ...
1
vote
0answers
24 views

Route network traffic back to the same wire

I would like to monitor outgoing traffic from my wi-fi connected phone using Wireshark on my Windows desktop. I changed default gateway on the phone to the IP of the desktop and Wireshark can now see ...
1
vote
0answers
127 views

Can network sniffing in promisc mode on a network bridge produce “false” TCP retransmissions?

I have a Wireshark log from a computer that was running Ubuntu and tshark. The computer has two NICs and I've connected them to a bridge (using /etc/network/interfaces) and gave that bridge a static ...
1
vote
0answers
490 views

how to sniff from a TP-Link ADSL modem?

I have a PC and a tablet that connected to a TP-Link ADSL modem. PROBLEM: I want to see the packets that send and receive from my modem not my PC( to see both wire and wireless packets) I search ...
1
vote
0answers
251 views

RST, ACK from 216.98.48.133 without any SYN from me? For real? How? Why?

I am trying to figure out why I always get "The Ubisoft server is not available at the time. Please try again later." Apparently, the server is actually up and running, so it seems the problem is on ...
1
vote
0answers
155 views

mergecap fails to create output file when run from crontab

I have created a script to merge pcap files using 'mergecap -w '. The script doesn't work as the output file is not already present. So I tried to use 'touch outputfile.pcap' before the mergecap ...
1
vote
0answers
28 views

Utility service that logs total network usage

I would like to know the total bandwidth our internet provider essentially provides to the many competing devices in our home. Is there a simple windows service that uses a wireshark like trick to log ...
1
vote
0answers
370 views

What happens when Capturing USB Packets using Wireshark

I am trying to capture the packets sent by a Mouse to a host PC using Wireshark. Operating System - Ubuntu 12.04 Wireshark - 1.8.2 Problem 1.) Before I plug in the USB Mouse, when I start the ...
1
vote
0answers
959 views

Synergy choppiness: Is my wireless router delaying packets after silent period?

I am sharing keyboard and mouse between my Linux desktop and MacBook Air using Synergy. There is a very noticeable lag every time I begin moving my mouse (or start typing), but everything becomes ...
1
vote
0answers
323 views

Booting with nfs just prints some weird character

Problem I have an embedded system which I am unable to boot via NFS using an Embedded Linux Kernel Image and rootfs both placed on my laptop (which serves as the NFS server as well as a TFTP ...
0
votes
0answers
25 views

NAT doesn't allow TCP ACK for sent TCP SYN

We are using TCP Simultaneous Open for connecting TCP socket. Lets call one SideA and other SideB. From the wireshark log I see that first two SYN sent from SideB is blocked by SideA NAT. Then SideA ...
0
votes
0answers
12 views

Wireshark FTP multiple ACK?

I'm trying to visualise somes frames that correspond to a file transfer between two machines on Wireshark. The thing is that there are multiple ACK for each FTP-DATA segment and I don't understand ...
0
votes
0answers
21 views

How to check which TLS cipher suite is used in tcp connection

I am using imapfilter to sort my mails on a remote IMAP server provided by some company. My configuration restricts imapfilter to the usage of TLS 1.2 via STARTTLS. I do know how to check which TLS ...
0
votes
0answers
46 views

Spying on Wi-Fi-connected device from laptop

I want to capture (and possibly modify) packets from a WiFi-connected device using my MacBook Pro and I am trying to figure out the most straightforward way of doing so. I have solved the problem ...
0
votes
0answers
53 views

Replay captured TCP packets

I captured a tcp traffic using wireshark and saved the traffic in pcap file. I did two tests: Test 1: sudo tcprewrite --infile=capturedtraffic.pcap --outfile=temp.pcap ...
0
votes
0answers
18 views

Routing between two NICs same PC

I have two NICs, 192.168.56.0/24 and my wifi NIC 192.168.1.0/24. Can I route between these two NICs to be able to ping from my Physical HOST to any host on 192.168.56.0/24 while using VMs? I know ...
0
votes
0answers
30 views

Cannot see VOIP calls in Wireshark 2.0.0

I received a pcap dump from a site, running Cisco JTAPI, who's VOIP traffic I need to analyse. I use Wireshark's VOIP calls analyser via the menu: The conversations display fine in Wireshark ...
0
votes
0answers
19 views

Windows 7 frequent download interruption

I just upgraded to Windows 7 Pro from Home Premium, and now almost all downloads (Youtube videos, online games, ftp/http downloads) are interrupted after a random length of time. Sometimes the ...
0
votes
0answers
43 views

Wireshark isn't showing all interfaces in Windows 7

This is what I've done to check what was going on: Restarted PC Made sure WinPCAP driver (NPF) was installed Stopped and started NPF driver Running as admin But it's only showing one interface, ...
0
votes
0answers
23 views

IKEv2, ESP PFS. Which packets includes the configuration?

i am investigating currently the IKEv2 protocol with ESP payload encryption. For ESP i want to use PFS with DH Group 5 (which works). However, i am not able to figure out in which packet this settings ...
0
votes
0answers
91 views

TCP connect fails with certain websites

I am running Windows 10. I am unable to browse a few seemingly random websites (CBS.com is one of them) using any of my browsers, although I can successfully ping all of them. Also, other computers ...
0
votes
0answers
66 views

Clients have problems sending DNS requests

Some of my clients can't use internal DNS server to resolve internal addresses. All IP addresses can be pinged, but I can't ping name or name.domain.com. Restart DNS client service or ipconfig ...
0
votes
0answers
33 views

Can't see HTTP in Wireshark on OSX

Every Youtube video that even explains how to install Wireshark sees HTTP traffic. Why can't I see it? Fresh Wireshark install, I am capturing WiFi traffic and I made some HTTP requests. TCP, UDP, ...
0
votes
0answers
27 views

Wireshark in Linux not receiving packets, and Linux is in a VirtualBox

I am using Kali Linux, but on a VirtualBox. So when I'm using Wireshark, I can't capture any packets. I can't use the wireless card directly so I'm using eth0 through the Mac OS. is there any way to ...
0
votes
0answers
144 views

monitor and log LAN network traffic on CentOS 6.x

I've been fiddling with this one for almost a week now. My setup is: LAN (windows/linux PCs/servers) <-> CentOS gateway/firewall box <-> ISP I'm trying to setup a monitoring solution which ...
0
votes
0answers
50 views

Confusion in Iperf server report?

I am connecting one of my computers to LAN which is connected to 802.11n Access Point using ethernet cable while my other computer is connected to wifi. When I send 20Mbps traffic from iperf while ...
0
votes
0answers
45 views

How can I use Microsoft Network Monitor to view messages sent via socket client/server

I would like to view the exact messages sent/received in Microsoft network monitor, but I do not know how. I have build a program to send messages via TCP socket and If a message "ready" is sent over ...
0
votes
0answers
60 views

Wireshark won't open

I'm having trouble with wireshark on Kali Linux 1.1.0 when I try to open it the process bar loads to 100% and says "loading configuration files" but it gets stuck there. Anyone know how I can fix ...
0
votes
0answers
13 views

Is there a light exe / sniffer to ensure that certain traffic is traveling over intended ports to validate vpn/ssh settings?

I'm using ssh and split-tunneling vpn and I'd like to get a log of which traffic is sent over which ports. Is there a simple software to do this? Is there a way to easily show this over wireshark ...
0
votes
0answers
28 views

Multiple syn's before handshake connection?

I have a scenario, I'm analyzing ssl (decrpyt) traffic to my webserver. I'm investigating server and end-to-end delay issues. In between this I'm stuck at following traffic pattern for which I need ...