Questions tagged [wireshark]

The network protocol analyzer developed and maintained by the Wireshark Foundation

Filter by
Sorted by
Tagged with
0
votes
0answers
15 views

SSLKEYLOGFILE for Bluestacks

Is there any way to make bluestacks.exe generate a file that can be used for by Wireshark to decrypt the data coming through TLS 1.2V requests from a specific server?
0
votes
0answers
38 views

Throughput oscillating in speedtest with iPerf3

I have to test my network speed using iPerf3. [SETUP] I'm using a Virtual Machine running Ubuntu 18.04 connected to a smartphone through WiFi. I'm using HE.NET on my smartphone, which allows me to ...
0
votes
0answers
10 views

Comparsion of captured traffic in pcap

I'm facing a problem that I can't figure out. My goal: Compare pcaps and measure the loss in capture. Scenario: I've sent data (1,5 GB file) from laptop A via WiFi to shared directory on laptop B. On ...
0
votes
1answer
16 views

Filtering for byte array in Wireshark

The Wireshark documentation for filters says (emphasis mine): The "contains" operator allows a filter to search for a sequence of characters, expressed as a string (quoted or unquoted), or bytes, ...
-1
votes
0answers
15 views

Cannot log into FTP server whose permission is set for all users

0 1 I need to eavesdrop FTP packets using Wireshark app in order to see that FTP does not encrypt its packets. I created an FTP server using windows server 2012. I also gave permission to all users ...
1
vote
2answers
55 views

Wireshark is not decrypting tls traffic from an exe file

I am trying to decrypt https traffic from an exe file, which is sending requests to some site. However, data is not being decrypted. How it looks like inside a Wireshark - https://prnt.sc/sfv7xb ...
0
votes
1answer
80 views

Analysing exe file https connections

I have a exe file, which is sending an https request to the remote server and I think, is downloading something from the site. With process hacker 2 I've got only the remote IP, but I need to see get ...
0
votes
0answers
19 views

Windows 7 LAN “unidentified network”, surprisingly not a driver issue (probably)

TLDR: cannot send packets over most network adapters, WiFi is miraculously exempt but is misbehaving in its own way. Suspect something at the OS layer? I have a Windows 7 computer that recently ...
0
votes
1answer
45 views

When connecting via SSH, does the Diffie-Hellman key exchange take place over an unencrypted TCP session or does encryption occur before the exchange?

I'm a cybersecurity student and I'm eager to understand the basic processes of an SSH session. I wrote down the stages to the best of my ability, but need help understanding what happens right after ...
1
vote
0answers
16 views

How to check packets on Not Attached Wireshark

I am currently running Windows 7 VirtualBox on my Windows 10 host. However, I do not want to connect them to each other since I need to check the packages being transferred when WannaCry is running. ...
2
votes
0answers
20 views

Realtime filtering of a capture in a different process

Posted this on network engineering earlier: https://networkengineering.stackexchange.com/questions/67433/realtime-filtering-of-a-recording-in-a-different-process I have a network recording setup ...
0
votes
0answers
32 views

How export WireShark Packet List and Packet Bytes to txt file or csv file?

how export WireShark csv file or txt file Packet List and Packet Bytes i want txt file or csv file to export in the following way no Time Source DesTination Protocol Length Source ...
0
votes
0answers
28 views

Correlation between DHCP and ARP

Can someone explain why there are so many ARP packets broadcasted from my client? And why is looking for my DHCP server?
0
votes
0answers
24 views

No wireless WAN connection on specific network card/router

It started fine when I started using this router, but not after a few weeks. Connection is perfectly fine on other APs except this one. All other devices can connect to it. Tried: Plugging WiFi ...
0
votes
0answers
21 views

Why do `tcpdump` and Chrome's network logs disagree? - net::ERR_EMPTY_RESPONSE

I'm trying to diagnose an issue where we occasionally see fetch requests to an internal service fail with a net::ERR_EMPTY_RESPONSE error in Chrome. I have recorded both a packet capture with ...
1
vote
0answers
79 views

Troubleshooting VPN connection with Wireshark by decrypting IPSec packets

I'm having troubling establishing a VPN connection to a specific network and I'm not the only one having issues. As per their instructions, I'm using the standard VPN client built in windows with pre-...
0
votes
0answers
16 views

Not Seeing Google DNS traffic from iphone

I'm new to this stuff so I probably just don't understand something. I'm arpspoofing my iphone, it works and I see TCP traffic in wireshark that's supposed to go to my iphone. When I filter for DNS, ...
1
vote
0answers
18 views

Snort causing DHCP ACK spam in VirtualBox internal network

I have an internal network (10.10.0.0/24) in VirtualBox which has been configured with a DHCP server using VBoxManage. There are 3 VMs on the network, Ubuntu 16 (10.10.0.2 & 10.10.0.5), Ubuntu 18 (...
1
vote
0answers
34 views

Why does “Add Wireshark to the system path” fail to make man work?

I used Wireshark 3.2.2 Intel 64 to install Wireshark on macOS 10.15.3. And I installed ChmodBPF and Add Wireshark to the system path. tshark work in Oh My Zsh with iTerm2: $ tshark -h TShark (...
0
votes
0answers
35 views

How to determine forward/backward direction of a netflow

Suppose I have the information of SourceIP, DestinationIP, SourcePort, DestinationPort, and Protocol Is it possible for me to determine if this netflow is in forward direction or backward direction ...
0
votes
0answers
50 views

Wireshark causing blue screen of death

After researching for weeks on how to get monitor mode to work on Wireshark (it usually unchecks itself), I tried running with admin privileges. This finally let me check the monitor mode box, but ...
1
vote
2answers
101 views

Wireshark in promisc mode, Not capturing all packets from other devices

Im using wireshark on windows with an alfa network adapter, with promiscuous mode enabled. However, I am not seeing traffic from other devices on my network. See the screenshot of the capture I have ...
0
votes
0answers
121 views

Wireshark can't enable monitor mode

I'm running Wireshark on windows, and when I'm trying to capture in monitor mode. When I click the checkbox to enable monitor mode, it instantly unchecks itself. I've heard about this happening but ...
0
votes
0answers
27 views

UnInstall Docker but still get request

I recently install docker, but just uninstall it after a couple of test. I am very surprise to see that "network request" continue to be send to "host.docker.internal" when i run WireShark. Any idea ...
0
votes
0answers
16 views

Wireshark not displaying non standard port FTP data packets

I know this question may be off topic here but I believe network engineering is not right place for this question. My question is that why wireshark doesn't shows non standard port like 8081 FTP ...
1
vote
1answer
480 views

Capture packets on Asus router

I have Asus RT-AC87U router in my home network. I would like to analyse packets on specific ports like Wireshark does. Is it possible to build such system that could make traffic going trough router ...
0
votes
0answers
26 views

Creating systemd service for passive tshark capture without root

I am creating a systemd service to capture SIP/RTP/RTCP traffic sent over GRE to a capture box. The service calls a script, tshark_wrapper, which handles the capture/filter and the directory/file ...
0
votes
0answers
180 views

CTF challenge. How to receive full flag using netcat?

Im trying to dip my toes a bit more into networking, pentesting etc and i might have a slightly vague question but i hope one of you are able to help I'm trying to poke at a CTF that were made by ...
0
votes
0answers
108 views

Capturing stream from a cheap Chinese security camera

I have a cheap security camera and by default, I assume, the stream is being sent to some server and then you can watch it on iPad using dedicated App. It's obviously not ideal and I would like to ...
1
vote
1answer
56 views

Specify no check certificate for npm dependency?

I'm trying to install a private gitlab repo in my project. My package.json contains: "dependencies": { "<my-private-repo>": "git+https://<token>@<server>/<user>/<repo>...
1
vote
1answer
509 views

Capturing VPN Interface on Windows 10 black holes Traffic with Wireshark

I need to see if some issues that are occurring are due to the network, and want to start on the client to see why google speed test is failing over the VPN on the Windows 10 client. I admin the VPN ...
2
votes
0answers
66 views

Determine current USB address of device in Windows

TL;DR: How did my Win10 system arrive at a USB source address of 2.5.5 for my mouse (in Wireshark) when USBPcapCMD lists it as hub 2, port 6? Can I determine the 2.5.5 address without guessing? ...
0
votes
0answers
31 views

Decrypt Chacha20-poly1305 data with Wireshark

I'm working with embedded devices that talk to each other over UDP. The data transmitted over the UDP protocol is encrypted and authenticated with chacha20-poly1305. Is it possible for wireshark to ...
1
vote
2answers
265 views

Display filter to see WPS attempts in WireShark

I have tried "WPS" and "eap.wps.code" and neither work. This is a repost from the InfoSec SE: https://security.stackexchange.com/questions/221228/display-filter-to-see-wps-attempts-in-wireshark as ...
0
votes
0answers
31 views

Wireshark - ignore all packages captured so far

Lets say I start capturing and wait for a minute. How can I ignore all packages captured in that time so that similar packages are not showing anymore. I need this to filter out the "boring" standard ...
1
vote
0answers
37 views

My pc sends 14000 arp requests in 5 minutes to a single pc on the network

I am currently checking my network traffic on my home network using wireshark. I have noticed that my pc is continuously arp requesting a pc on the network with 192.168.1.20 but like 14000 times in 5 ...
0
votes
1answer
35 views

Port forwarding - no request received

On my router I am forwarding port :80 to my ubuntu pc's port :80. On the ubuntu pc is running Nginx reverse proxy which forwards the requests to other machines. The problem is, Nginx receives no ...
0
votes
0answers
35 views

WLAN traffic monitoring

I have trouble in viewing/monitoring network traffic using Wireshark on my router. I have one PC and two mobile phones (Android and iOS), all of them are connected to one TP Link Wireless Router (TL-...
0
votes
0answers
31 views

I'm new to networks and need help deciphering this packet: [Expert Info (Chat/Sequence): POST /version HTTP/1.1\r\n]

The source and destination is both 127.0.0.1 and the protocol is http. If I am not mistaken, the loopback IP destination (127.0.0.1) or any variant of this within a range could be used by malware to ...
1
vote
2answers
99 views

Wireshark : unable to catch network traffic to/from a device

I would like to use Wireshark to catch data to/from a device on my network. I have a connected devices (all based on a ESP8266) which have trouble getting out the sleep mode (I think it's that). So I ...
2
votes
0answers
48 views

Wireshark does not list USB HID mouse or keyboard

I have installed Wireshark 3.05 and USBPcap 1.2.0.4 on a Windows 10 machine (Version 10.0.18362.418) to sniff some USB communication from devices. Wireshark shows me three USBPcap interfaces after ...
0
votes
1answer
25 views

Find all packets that contain field name

I'd like to filter all the tcp packets that contain Server Name Indication as a field. This is an example of desired field: Usually when I search for contents, I use frame contains "string". This ...
0
votes
0answers
48 views

Wireshark - Don't mask non-printable characters (Windows)

Is there any way to have Wireshark running under Windows not mask non-printable characters in the packet view on the bottom? Currently, any characters < 0x20 and >= 0x7f are shown as . This ...
2
votes
1answer
228 views

tcpdump says “expression rejects all packets”

I want to create a filter which has 2 conditions:- Filter packets with network. (src net 2a01:111:xxxx::/44) Filter based on tcp handshake alert messages. (tcp[((tcp[12] & 0xf0) >> 2)] = ...
0
votes
0answers
57 views

Analysing wireless packet captures - VMware

Software: Wireshark Is it possible to analyse Wireless Packet captures on VMWare using Linux Ubuntu OS? I ask this as I’m using Windows for my computer but I’m struggling to get all the information I ...
0
votes
1answer
23 views

Confused about HTTP in Wireshark

I'm currently using Wireshark and I'm trying to fill out a table that what's the Packet Number for the HTTP request and HTTP Response. I've used the filter in Wireshark however, I'm not sure what ...
0
votes
1answer
360 views

How to decrypt Outlook traffic in Wireshark?

I have to follow Comparitech's SSL Decryption Guide: How to Decrypt SSL with Wireshark.  But it is not working for Outlook - Office 365 mail traffic.  I'm seeing traffic on port 443 only and it's SSL-...
0
votes
1answer
49 views

Want to monitor 802.11mc Fine time measurement packets . Is there any packet sniffer that allows me to get all packets/frames from link layer?

I am doing a project with new fine time measurement capability introduced with 802.11mc (2016). I would like to monitor the frames for that. Is it possible to get it using Wireshark or any other ...
0
votes
0answers
45 views

How does a virtual machine connect to the Internet?

I have a virtual machine running Kali Linux on VirtualBox, with the host OS being Windows 10, and it can connect to my Wi-Fi network — however, the network settings in Kali Linux displays “Wired ...
1
vote
1answer
187 views

Seeking explanation of occurences during Wireshark SSL/TLS decryption

Currently using: OS: Official Kali Linux 2019.4 Browser: Chromium Version 76.0.3809.100 (Developer Build) built on Debian bullseye/sid, running on Debian kali-rolling (64-bit) Wireshark 2.6.10 (Git ...

1
2 3 4 5
15