Skip to main content

Questions tagged [wireshark]

The network protocol analyzer developed and maintained by the Wireshark Foundation

Filter by
Sorted by
Tagged with
0 votes
0 answers
12 views

Server sometimes not sending ACK in response to PSH, ACK

We've implemented a TCP server socket in C++ on a linux machine which is connected to another device, streaming data small packets at high rate (800 Hz). To do so without too much latency (which we ...
Morten Nissov's user avatar
0 votes
1 answer
13 views

Detecting esp8266 traffic using Wireshark

I have programmed an esp8266 to make some http get requests to a remote webserver. I would like to analyze this http requests somehow, with an external tool like Wireshark. The purpose is to see how ...
Jaime38130's user avatar
0 votes
0 answers
66 views

ARP request is successful, but TCP SYN is not visible in output of Wireshark

I was redirected from Network Engineering, hopefully below is in scope of on-topics. I have a TCP server, its properties are the following: It runs within a virtual machine (VMware). The host OS is ...
user94749's user avatar
2 votes
1 answer
570 views

How to explain sequences of FIN,ACK instead of FIN - FIN,ACK?

Context: newly installed Debian 12, I get a bunch of strange logs related to ssh: root@square:~# journalctl -u ssh -f May 07 11:13:00 yop-square sshd[766]: error: kex_exchange_identification: ...
WoJ's user avatar
  • 3,233
1 vote
0 answers
27 views

802.11 frames gets resent by my linux

My program is sending custom 802.11 frames for WPA handshake, like authentication, association or acknowledgement. Yet the operating resend the same packet with modifying its radiotapheader and ...
C.Unbay's user avatar
  • 105
1 vote
1 answer
61 views

Why won't Google Chrome really or Firefox capture the network developer request of a form autopost

So imagine this code running on localhost:9080, the page does not render content but instead does a HTML auto post. But I like to use the network tab to see the HTML content rendered under the ...
Berlin Brown's user avatar
0 votes
1 answer
47 views

How to capture packets with different snaplen for different packets

I'm trying to capture packets to diagnose a network application. There are a small number of packets that I want to capture the entire contents for application level protocol analysis, but a large ...
Evan's user avatar
  • 103
0 votes
0 answers
36 views

Filename error for TFTP recovery for a damaged embedded device

I have a device that do not start, I connected it to my PC and launched Wireshark. As you can see bellow, the device is asking for a file ends with semi-colon called recovery; to be uploaded through ...
djkidoo's user avatar
0 votes
0 answers
54 views

TCP packets with Protobuf messages not dissected

I'm trying to use Wireshark to dissect Protobuf messages sent over TCP using gRPC. When I view the data portion of a messages, I see raw bytes instead of a dissected view. I've added the path to the ...
user2233706's user avatar
0 votes
0 answers
35 views

Downloads stop suddenly in 5ghz only

Without the possibility of using a wired connection, I use a Wifi connection via tplink router an Intel Wifi 6E 160MHz card(latest Intel driver installed) on Windows 10. I use an application (latest ...
DM7823145's user avatar
2 votes
1 answer
164 views

Does total network traffic being higher than the bit rate of a device's ethernet controller affect the controller?

I am using a Wago 750 ethernet controller on a local network that is at its peak hitting ~38,000,000 bits / second as per Wireshark. The Wago is becoming semi-unresponsive around the time of this ...
kep's user avatar
  • 23
1 vote
1 answer
171 views

PostgreSQL traffic analysis - Wireshark - how many bytes in total are being received by the client?

<TL;DR> How many bytes are being received in total when a SELECT * command is issued for a (small) table? </TL;DR> I have a PostgreSQL table - very simple (see fiddle here): CREATE TABLE ...
Vérace's user avatar
  • 111
2 votes
1 answer
262 views

How Wireshark is able to pick network traffic from within Windows10 coming from WSL2

My task is to create 2x programs written in C/C++ which can communicate with each other from within WSL2 and Windows 10. I'm able to send traffic from WSL2 to Windows 10, however I cannot manage to ...
user23461877's user avatar
0 votes
1 answer
239 views

Understanding packet routing when using Wireguard/Tailscale and the BitTorrent Protocol

I have a local machine on a VPN network with private IP A , and a VPS with private IP B which acts as an exit node, i.e. all traffic in the local machine is supposedly being routed from the local ...
Scb's user avatar
  • 113
1 vote
0 answers
97 views

USB Enumeration - Windows - Unusual Port Reset

I am testing a custom usb data logger hardware by running a long term test. My tests have been failing due to USB communication issues after 15 odd hours so I decided to investigate. I have Wireshark ...
ACBlue's user avatar
  • 11
1 vote
1 answer
113 views

Why am I able to send UDP packet larger than my WIFI interface's MTU?

I have written a simple python program to send a UDP datagram. import socket client_socket = socket.socket(socket.AF_INET,socket.SOCK_DGRAM) host_name = socket.gethostname() host_ip = '1.2.3.4' print(...
Akash Karnatak's user avatar
0 votes
1 answer
66 views

Windows laptop will not turn on after installing Wireshark

I have a Dell XPS laptop running Windows 10. I installed Wireshark from here, including Npcap from the same installer. All the additional options were left default. After closing the laptop lid for a ...
Day Trip's user avatar
0 votes
1 answer
68 views

From a computer connected in Wifi, can I see the traffic of ethernet-connected computers, with Wireshark?

In the following network, if I open Wireshark on ComputerA, can I see the traffic of ComputerB (to internet) with Wireshark? ____________________ | Home router | | (provided by ISP) | | 192....
Basj's user avatar
  • 1,900
0 votes
0 answers
389 views

ffmpeg - Jitter when streaming audio over RTP

So as a disclaimer, i'm trying to do something with ffmpeg that may be at the limit of what can be achieved. However, even though it's not possible, i would like to understand why. What I want to do ...
Nicolas Floquet's user avatar
0 votes
2 answers
100 views

Can my network admin see my traffic over a Flask app?

So I've got a Flask app that connects to the internet to send/receive data. It does so by connecting to a website's API (which has HTTPS). So I'm quite sure the Flask app is HTTP. I connect as 127.0.0....
bzcaski's user avatar
1 vote
1 answer
709 views

Trying to understand how WSL2 networking and routing works when pinging google.com, confused

I'm trying to learn networking and i'm still a novice. I'm confused about how the routing is done between the virtual adapter and my wifi card When I ping google.com from WSL, I can see on Wireshark ...
jsc's user avatar
  • 13
0 votes
0 answers
281 views

How to capture packets at the Ethernet layer on a SOCKS5 proxy server?

When I capture packets with tcpdump on an Ubuntu 20.04 VM running a SOCKS proxy server on port 1080, they are often larger than 1500 bytes. My network device has an MTU of 1500, so as far as I ...
try0S's user avatar
  • 1
1 vote
0 answers
80 views

kali linux filter by protocol wireshark's pcaps

I spent the last 2h looking for a way to quikly filter pcaps, it seems that it is possible using cmd/bat on windows but I can't find anything for kali linux. I have a way too big pcap and I want to ...
the shadow's user avatar
0 votes
0 answers
54 views

How do I detect BGP attacks in these Wireshark packets

I received a Wireshark capture file as a task. There are 3 TCP packets for the TCP 3-way handshake to establish the connection and 4 BGP packets. I received additional information and now I have to ...
christofeckerlin's user avatar
0 votes
0 answers
68 views

Wireshark showing packet exchanges with unconnected IPs

Running Wireshark on a PC for network monitoring and I noticed something strange. Application data is being exchanged with websites that are not open in the browser, or on any other device on the ...
Instream's user avatar
0 votes
0 answers
19 views

Implementing Video streaming restrictions based on hourly usage at home

I'm new at networking, so my question might be basic or naive. I want to implement restrictions for mobile devices if it is being used to view videos for more than an hour continuously then its ...
Trying Tobemyself Rahul's user avatar
0 votes
0 answers
177 views

Wpa PTK and GTK in detail

I have been checking Pairwise and Group Transient keys in a network for security. I understand PTK is derived from = PMK, AP nonce (ANonce), STA nonce (SNonce), AP MAC address, and STA MAC address ...
C.Unbay's user avatar
  • 105
0 votes
1 answer
266 views

Configure Virtualbox to capture network traffic between 2 VMs on the same host from another physical machine

My context is: A physical machine with windows 10 (PC_Physcial_01) that host 2 virtualbox linux VMs PC_VM_01 & PC_VM_02) An other physical machine dedicated to sniff network traffic (...
sebdub's user avatar
  • 1
-1 votes
1 answer
76 views

Why is it written in nmap official doc that -sL does not send any packet, when it actually send them?

Sniffing with wireshark, I see a bunch of ARP, and DNS requests. So why in the official doc it's written this: The list scan is a degenerate form of host discovery that simply lists each host of the ...
Allexj's user avatar
  • 254
0 votes
0 answers
191 views

Setting MacOS Airport Utility into monitoring multiple channels

I am using MacBook Pro 14' 2021 M1 Pro with MacOS Ventura 13.3.1. I would like to use wireshark in monitor mode with wifi interface. I have read, that I can switch 802.11 channels with the command: /...
Woiro's user avatar
  • 1
1 vote
0 answers
115 views

Why is TCP connection on Windows machines, retransmitting after receiving a correct ACK from HTTP server

Using two different Windows laptops, one with Win 7 and the other Win 11, I'm trying to connect to the HTTP GUI of a device (cell phone booster) that's connected directly to my laptop through an ...
Frank's user avatar
  • 139
4 votes
3 answers
1k views

Does DNS-over-HTTPS hide domain name of websites from packet analyzers?

A person on my same Wifi network is tracking name of the websites that I visit using tools like Wireshark. Does DNS over HTTPS hide the name of the sites that I visit? My DNS settings are - DNS ...
Gopal S's user avatar
  • 45
1 vote
1 answer
527 views

Retransmission of TCP packets

I have device A (10.10.25.1), which is connected to device B(10.10.25.52) via unmanaged switch. Device A is a computer. Device B is measurement instrument. Device A is continuously(every 1sec) sending ...
Pablo's user avatar
  • 4,765
0 votes
1 answer
192 views

Reassemble Wireshark WiFi captured LLC packets into original message

I have the following setup within my own WiFi network: one machine (A) connected to my WiFi (which connects to the internet), and one machine (B) running Wireshark, with a WiFi adapter in monitoring ...
Tristan Tran's user avatar
0 votes
1 answer
583 views

How to disable TCP SACK in Windows XP?

Device 1 Windows XP. 192.168.101.173, I have access to the application code, but it is massive. Device 2 Embedded device. 192.168.101.205. I don’t have access to the code or even to logs from this ...
Beto's user avatar
  • 3
1 vote
1 answer
217 views

TLS certificate validation depth

Background: I'm using the curl library to upload files via TLS to a server with a DigiCert certificate. Phenomenon: During the handshake phase, the server sends a Hello message and returns the ...
Abner Sun's user avatar
0 votes
0 answers
49 views

Can't see my update location request but kc has changed, general information about GSM

I need to ask for your help because I feel I miss something in my train of thoughts. So, I've installed gr-gsm with all the dependencies from a fresh docker https://github.com/uetacog/grgsm_docker ...
mattia's user avatar
  • 1
0 votes
0 answers
45 views

Loosing UDP messages during routing?

I am trying to test software that I’ve written to send UDP messages. This software works if I don’t bind the socket to a port (i.e. it defaults to NIC 1). I can see the messages with Wireshark running ...
user1585453's user avatar
0 votes
1 answer
1k views

Wireshark: how to show UDP payload as text?

I have a device that broadcasts strings for debugging purposes, and i need to capture these UDP message and read the string. As you can see, i cannot read anything in the data.text column, while the ...
Parduz's user avatar
  • 113
0 votes
0 answers
63 views

TCP Receiver's Window stop increasing

I'm debugging a high-bandwidth TCP connection whose throughput is significantly lower than the capability of the device and the network. The network between these 2 hosts is expected to be high ...
Alex's user avatar
  • 101
0 votes
0 answers
86 views

Install Linux on Chromebook for wireless security testing?

I’m envisioning myself walking around my home with a small laptop in one hand, and a smartphone in the other hand. The laptop would have wireless security software (WireShark, maybe nzyme or similar) ...
NotAnAccountant's user avatar
0 votes
1 answer
704 views

Troubleshooting SMB connection to file share

I have a bunch of servers and a file share set up on a remote HNAS. The file share is set up to use SMB 3.1.1 and the servers are all Windows Server 2019. 5 out of 6 servers connects just fine to ...
JaggenSWE's user avatar
  • 273
0 votes
1 answer
152 views

Wireshark hex escapes not woking while matching payload

In wireshark I was trying to match packets whose payloads does not begin with 00 24. But for some reason, this filter is failing: not(udp.payload ~ "^\x00\x24") But surprisingly this works: ...
Sourav Kannantha B's user avatar
0 votes
1 answer
860 views

How to decode DCE RPC stub data in WireShark

I need to compare connection session of 2 OPC DA clients connecting to a remote server. Under the hood they uses DCOM and DCE RPC. Fortunately, WireShark provides dcerpc dissector, but it doesn't ...
devaskim's user avatar
  • 111
2 votes
2 answers
300 views

extract the top 5 TCP or UDP flows from tshark sorted in descending by Total bytes

As the question heading states, given a packet capture I want to extract the top 5 flows for TCP (or UDP) sorted based on total bytes in the descending order. I have come up with this so far tshark -r ...
Trevor Philip's user avatar
0 votes
0 answers
150 views

In a GPON network, running wireshark captures SIP phone calls from other users

I plugged my laptop into my ONT and fired up Wireshark. To my surprise a lot of SIP packects were present, and I could see phone numbers of other costumers, and the people they called. I didn't ...
flyrelay's user avatar
0 votes
0 answers
1k views

How to fix receiving UDP data on windows?

On a windows 10 machine I am running the following python code (3.10.11) to receive data on UDP port 9001 (without any VM running): sock = socket.socket(socket.AF_INET, socket.SOCK_DGRAM) sock.bind((&...
Alex's user avatar
  • 432
2 votes
0 answers
225 views

WSL2 cannot connect to the Internet when Sangfor aTrust is running

I am using WSL2 on Windows 11 22H2 22624.1470. Ubuntu 22.04.6 LTS installed on WSL2. When I run a program called aTrust, which is developed by a corporation called Sangfor, my WSL2 cannot connect to ...
szw0407's user avatar
  • 21
0 votes
0 answers
269 views

How to get wireshark to sniff packets between client and server using VMs attached to NAT Network

I am really new to pen testing. I am using Oracle Virtualbox, and I have three kali linux VMs setup. I am trying to use wireshark on a VM to sniff packets between a Modbus client VM and a Modbus ...
nendae's user avatar
  • 1
1 vote
2 answers
630 views

Send Data Across NICs Using socat

I'm working on a project trying to develop a data diode for unidirectional transfer of data, and I'm hoping to use socat for some measurements. As a first step, I want to use socat to send data from ...
Peter Story's user avatar

1
2 3 4 5
18