Open-source network packet analyzer

learn more… | top users | synonyms

41
votes
5answers
14k views

Mac Homebrew and Wireshark

I've installed Wireshark(.org) using Homebrew. brew install wireshark at the end the script says ==> ./configure --prefix=/usr/local/Cellar/wireshark/1.2.7 --disable-dependency-tracking ...
13
votes
2answers
13k views

How to set up wireshark to run without root on Debian?

I'm trying to use wireshark on a Debian machine, but when I run it with my non-root user account, it doesn't detect any network interface. I also tried running wireshark as root, but wireshark tells ...
12
votes
2answers
16k views

How do I decrypt WPA2 encrypted packets using Wireshark?

I am trying to decrypt my WLAN data with Wireshark. I have already read and tried eveything on this page but without any success (well, I tried the example dump on that page and succeeded, but I fail ...
11
votes
4answers
11k views

Wireshark WPA 4-way handshake

From this wiki page: WPA and WPA2 use keys derived from an EAPOL handshake to encrypt traffic. Unless all four handshake packets are present for the session you're trying to decrypt, Wireshark ...
10
votes
2answers
12k views

Why do I see “The NPF driver isn't running. You may have trouble capturing or listing interfaces.” when starting Wireshark?

When I start up Wireshark, why do I see this message? "The NPF driver isn't running. You may have trouble capturing or listing interfaces."
8
votes
4answers
2k views

Concern over running WireShark as root

I started WireShark on my Ubuntu machine and discovered that there were no interfaces I could listen to. So I launched it as root. This gave me access to all the interfaces, but gave me a warning: ...
7
votes
3answers
9k views

How do I return just the Http header from tshark?

I'm using tshark to sniff my packets and I'm only concerned with the http header (preferably in the form its sent, but I'll take what I can get). I tried using: tshark tcp port 80 or tcp port 443 -V ...
7
votes
3answers
14k views

X11/XQuartz won't auto-launch after upgrading to OS X Mavericks?

I can't use Wireshark on latest OS X 10.9 Mavericks. Previously, I was using XQuartz to run X11 applications like Wireshark. But, yesterday, after I upgraded my iMac operating system to OS X 10.9, ...
7
votes
1answer
4k views

How can I diff two network dumps from tcpdump or Wireshark?

I'm having a problem with one of our customers' embedded computers. They seem to discard some network packets which they should not. I can capture the TCP communication from a managed switch outside ...
6
votes
6answers
3k views

Lightweight tool for viewing raw HTTP messages?

I'm investigating differences in behaviour between a couple of Web servers. I need to see raw response data from the servers (i.e. before the response is de-chunked if it has ...
6
votes
2answers
12k views

How can I capture traffic to localhost using Wireshark?

I am using Wireshark on Windows Vista and I would like to capture http traffic to localhost (127.0.0.1), for debugging purposes, but I have some questions. How can I do this? What capture interface ...
6
votes
3answers
2k views

Chrome browser sending Keep-Alive packets?

I ran Wireshark on my PC and found that my chrome browser was sending LOTS of Keep-alive packets even when there are no sites loaded in the browser, and even when there are no extensions installed!! ...
5
votes
5answers
9k views

Wireshark cannot see traffic from a VirtualBox guest on Windows 7

I have been trying to use Wireshark to capture some traffic that comes from a virtual machine. The setup is: Windows 7 host Ubuntu guest VirtualBox 4 I send some packets from the guest to the ...
5
votes
2answers
218 views

Remove/change private data (e.g. passwords)

Is it possible to remove/change packages captured with Wireshark? My Situation: I captured some packages and want to send them to somebody else. The problem is, that one of the packages contains ...
5
votes
1answer
21k views

Capturing wireless traffic (using Wireshark)

When I run wireshark on a wired network it works fine and reports all of the packets. When I run it on a wireless network though I only see my own traffic. The wireless card I have is supposed to ...
5
votes
2answers
7k views

How to write a filter in Wireshark/Ethereal that displays only packets with a specific string?

Wireshark supports filters like this: ip.addr == 192.168.0.1 What is the syntax to check the packet content? (C# equivalent of what I want) content.Contains("whateverYouWant")
5
votes
3answers
7k views

Capture traffic for specific application

I have an application which communicates with some server. I want to know what the IP of this server is. How can I capture all the traffic from a specific application and not just all the traffic like ...
4
votes
4answers
3k views

MTU is 1500, why the first fragment length is 1496 in IPv6?

ping6 ipv6Address -s 1500 This command will result a fragment. Observed by wireshark, the 1st fragment packet's length is 1496 (from layer 3). Since the MTU is 1500, I am confused by this 1496 ...
4
votes
2answers
998 views

Unable to capture outgoing traffic with Wireshark on wi-fi network

I'm trying to use Wireshark on Backtrack 5 to capture packets that are transmitted through my home wi-fi network. I'm perfectly able to capture outgoing traffic from localhost and, it seems, incoming ...
4
votes
1answer
2k views

How to determine what program send the packet recorded in Wireshark?

I was taking some tutorials on Wireshark in order to analyze the packets sent and received when talking to a web server for purposes of learning. When I start listening/recording packets in ...
4
votes
1answer
833 views

Vista DPI Scaling: Cannot disable DPI Scaling for Wireshark

I'm trying to disable dpi scaling for Wireshark, except Windows won't let me: Yet i pick any other random executable in the folder, uninstall.exe for instance, i can do it fine: What gives? i ...
4
votes
1answer
2k views

tcpdump filter for given bytes on given position

I'm searching for a way to filter traffic for specific bytes. What I have is a stream that I capture with wireshark or tcpdump. Now it logs way too much, so I want to drop every packet that has 0x23 ...
4
votes
3answers
203 views

Is there a file format equivalent of Wireshark?

I love how Wireshark breaks down every packet by protocol section, explaining what every single bit and byte is for. What I would also love is a program that does the same thing for regular files: ...
4
votes
3answers
7k views

Packet Sniff over Wi-Fi

I've got a non-PC wireless client, and I'm wondering about some of its connections. I want to see the actual packets being exchanged from the net to my device over a Wi-Fi connection. I have ...
4
votes
1answer
11k views

How to block the Whatsapp Android application in a network

I need to block the users from accessing Whatsapp Android application who have logged in to my network. I tried to take Wireshark logs and tried to find the server's IP Address and port number, but I ...
4
votes
2answers
895 views

How can I get Wireshark with a GUI on my EC2?

I have an Amazon EC2 machine that I'd like to run Wireshark on, using X forwarding. Unfortunately, the only Wireshark packages found with $ yum search wireshark are: wireshark-devel.x86_64 ...
4
votes
3answers
3k views

Wireshark and Windows Firewall

If I block a port in the Windows Firewall, and then attempt a connection to that port from another PC, what should I expect to see in Wireshark? When running wireshark at the destination machine ...
4
votes
1answer
3k views

Why does a PING reply require an ARP request for the originating hosts MAC?

I have a scenario as depicted below. Here two host machines are connected via a hub: Ok, so host-1 wants to ping host-2 and i have setup wireshark on a 3rd host connected to the same hub. Now ...
4
votes
4answers
4k views

How to test Bit Error Rates on Ethernet Networks?

I need a tool software or otherwise (preferably software) that will allow me to test Bit Error Rates on an Ethernet Network. I am using a software tool that I did not write and do not have access to ...
3
votes
2answers
744 views

My Mac trying to connect to a possible intruder's machine, that is not in the network anymore

I just asked a question I think someone else has access to my wireless network. What next?. I have changed wireless security to WPA2, changed the password, disabled file sharing etc as =suggested in ...
3
votes
3answers
5k views

WireShark: How to monitor traffic, rather than watch packets?

WireShark is good at showing me every packet that is sent or received over an interface. But I'm really trying to find a way to monitor traffic on a machine. In other words, rather than seeing: ...
3
votes
2answers
339 views

Filter packets sent via HTTP to a port other then 80?

I have a database communicating on port 7474 via HTTP (sigh), and I want to debug the queries sent to / from it. However, a filter such as http.request.method == "POST" Filters out every post ...
3
votes
5answers
3k views

Wireshark (Linux) captures only packet from and to my PC when in promiscuous mode

I've installed Wireshark and configured it to let my user run it with all needed privileges (I enabled dumpcap and added my user to wireshark group, then restarted). Devices are shown and capture ...
3
votes
3answers
4k views

Interpret Wireshark Captures

I am troubleshooting wireless connectivity problem in my home network. My Thinkpad X200 laptop which use Intel Wifi Link 5100 AGN is not able to surf the internet stably. Sometimes it works, but most ...
3
votes
2answers
128 views

One arp request for two different pings

I pinged google and yahoo and captured the packets using wireshark and found that there was only one arp request for both of them. Can anyone explain why there is only one arp request for the two ...
3
votes
1answer
3k views

How to filter those TCP packets on Wireshark/Ethereal?

Packets that I want to see (just samples, there are thousands of them): 314 2.280146 192.168.0.1 192.168.0.2 TCP ah-esp-encap > 11188 [PSH, ACK] Seq=1 Ack=1 Win=65535 Len=121 316 2.290003 ...
3
votes
2answers
7k views

How can I show only 127.0.0.1 traffic using Wireshark?

Every time I try to filter to just show a specific IP address, I get an error indicating that it is "not an interface or a field." I have no idea what that means. Furthermore, I don’t really see any ...
3
votes
1answer
491 views

Wireshark and promiscous mode

I am using Wireshark for class. Does Wireshark put your card in promiscuous mode automatically, or must you manually do it? I've searched everywhere I can, and cannot find the answer. I have it ...
3
votes
1answer
1k views

Wireshark doesn't capture 802.11 data packets

Lately I have been trying to analyze wifi traffic over my own test router. I looked on the wireshark website on how to do this and setup my own testing network. my network: dd-wrt router with WPA2 ...
3
votes
1answer
13k views

TCP segment of a reassembled PDU

In wireshark sometimes I see this: 478195 5738.896809 192.168.1.79 61.213.44.124 TCP [TCP segment of a reassembled PDU] What is a PDU? Was it reassembled? What does this mean?
3
votes
3answers
12k views

promiscuous mode with Intel Centrino Advanced-N 6200 AGN wireless card

I'm trying to solve this problem for a long time, googling, reading and trying with no help. I have laptop with Intel Centrino Advanced-N 6200 AGN wireless card which suppose to support promiscuous ...
3
votes
2answers
845 views

usbmon (wireshark, tshark) for regular user

I have libpcap set up with the newest cvs version. Regular users can run Wireshark and tshark. Specifically, they have been added to the wireshark group and can capture from 1. eth0 2. br0 3. nflog ...
3
votes
1answer
136 views

Interactive network sniffing

I'm looking for what essentially amounts to an "interactive" Wireshark. I am looking for a tool that allows me to view network traffic on a given port and allow/deny/modify traffic on a per-packet ...
3
votes
1answer
2k views

How do I use tshark to extract bittorrent piece data to a file for post processing/reporting

Wireshark does a good job of extracting bittorrent PIECE messages sent to specific peers from other peers using a filter like the following e.g.: bittorrent.piece.data and ip.dst_host == ...
3
votes
3answers
1k views

How to measure network traffic by protocol?

I would like to select a type of traffic, as I do in Wireshark, and measure the total traffic in each way for this filter. Is it possible with Wireshark? Is it possible with another Windows tool?
3
votes
1answer
3k views

why still dns lookup when using proxy?

I've configured my browser(firefox) to use proxy ,but I find that it's still looking up the dns when I visit http://domain.name, why is that still necessary?
3
votes
2answers
2k views

How do I trace HTTP packets with Wireshark?

What can I do in order to see packets that come from different sessions in a web page? For example when I open yahoo.com there are different sessions in yahoo; I dont know how to see which packet is ...
3
votes
1answer
68 views

ICMP Fails after first packet

I'm trying to ping any ip, other than my LAN IP & localhost, it fails except the first packet!! Snapshot from CMD with the pings But Wireshark capture shows that the ICMP is success!! ...
3
votes
1answer
648 views

SYN-ACK not received

On a standard TCP connection between server and client, I have this issue: the SYN-ACK is not received from the client, while it is sent from the server. I could see this on Wireshark from both server ...
3
votes
0answers
398 views

Capturing Internet Connection Sharing (ICS) traffic using Fiddler

Does anyone have any idea how to capture HTTP traffic that goes through my ICS connection? Full details: I have a PC connected to internet via Ethernet. PC has set up a Wifi Hotspot using Internet ...