Questions tagged [wireshark]

The network protocol analyzer developed and maintained by the Wireshark Foundation

Filter by
Sorted by
Tagged with
0 votes
0 answers
9 views

Wireshark only decrypting MDNS, ARP, etc

I am playing with Wireshark. I am trying to view an HTTP request to http://example.com/?q=foobar that I made from a device on my Wi-Fi network. I inputted my SSID and WPA password to the 802.11 ...
user avatar
0 votes
0 answers
17 views

Unable to capture ICMP packets in wireshark

Ok I used yirsinia to launch a trunk port attack and right now the switch is recognizing my device as a trunk port. Except when I use wireshark to capture the packets from a different vlan (but right ...
user avatar
0 votes
0 answers
26 views

How do I capture non-local packets using WireShark on MacOS?

This is a pretty simple question. I'm trying to use WireShark to capture packets using my MacBook Pro 2019. Every time I run a capture on en0 (my Wi-Fi interface), all I am seeing is packets directed ...
user avatar
  • 121
0 votes
1 answer
25 views

Where is the iptables MARK location in TCP package?

In my CentOS7 Server, I emptied all the iptables rules, and then add below rule: iptables -t mangle -N DIVERT iptables -t mangle -A PREROUTING -p tcp -m socket -j DIVERT iptables -t mangle -A ...
user avatar
  • 730
0 votes
0 answers
31 views

Capturing Traffic from Specific Application (EXE) Only

Is it possible to filter a specific application (.exe) in Wireshark and listen only to the traffic of that running process? If yes, how or what's the filter syntax? I can't seem to find any search ...
user avatar
0 votes
1 answer
19 views

Send individual bluetooth LE packet from command line

I have a Bluetooth-controlled 'Smart Plug' to control appliances. I want to be able to control it using programs of my own devising, rather than just the manufacturer's proprietary app. I know how to ...
user avatar
  • 181
1 vote
1 answer
131 views

wireshark bad udp length > ip payload length

I have a custom made (not by me) imaging device here. It connects to a computer via ethernet cable. The companying application software guides the user in the process of acquiring an image. So far so ...
user avatar
  • 514
0 votes
0 answers
18 views

Monitor application network traffic

I have application that connects to MQTT server and performs some actions. Is it possible somehow monitor network traffic that my application performs? I like Wireshark, but I can't find any feature ...
user avatar
  • 2,049
0 votes
0 answers
163 views

"This application failed to start because no Qt platform plugin could be initialized"

I have created a Kali-Linux environment on Windows using Oracle VM VirtualBox 6.1.32. I've been trying to run wireshark on kali-linux. But when I type wireshark in the terminal, I get this error. I've ...
user avatar
0 votes
1 answer
36 views

Is it possible to configure Computer A as a network gateway for Computer B? (for Wireshark monitoring)

First of all, to avoid the X/Y problem, here's what I'm trying to achieve: I want to monitor Computer B's raw network traffic from Computer A using Wireshark (more specifically npcap). This is ...
user avatar
0 votes
1 answer
48 views

How to understand Wireshark ICMP data size

When I send a ping from Linux specifying 8972 bytes, the command output looks like this: PING 192.168.100.100 (192.168.100.100) 8972(9000) bytes of data. That 9014 number includes the 8 byte ICMP ...
user avatar
  • 961
0 votes
1 answer
93 views

Tshark can not be initiated under WSL (Windows Subsystem Linux) ((socket: Adress Family not supported by protocoll))

I'm visiting a computer network course. For learning purposes I'd like to run tshark in my WSL-Debian under Windows. I succesfully installed it using: sudo apt-get install tshark My Version using ...
user avatar
0 votes
2 answers
177 views

Ping doesnt work but wireshark detecting ICMP request and reply

I am running into a weird issue and would be grateful if anyone of you can add information. I have configured two different subnets and as a test. I am trying to ping one machine at 10.10.11.9/30 (on ...
user avatar
0 votes
1 answer
203 views

Search for a string in packet bytes of a pcap file using tshark

I am able to search for a string in the in packet bytes of a pcap capture using Wireshark. Is there similar functionality available in tshark ? I already have the pcap files. But I need to go through ...
user avatar
  • 133
0 votes
1 answer
21 views

Grouping filter button not working in wireshark

I tried using "//" label separator to group filters buttons. But it is not grouping the buttons. If I named the buttons DNS // Response and DNS // Request then two buttons are created with ...
user avatar
0 votes
0 answers
41 views

Capture traffic of local network, cant decrypt data packets WPA2

I'm trying to capture the wifi traffic of my local wifi network. I would like to see the traffic of my phone or my smart speaker since they are connected as well. I'm using a live Kali usb and ...
user avatar
  • 1
0 votes
0 answers
46 views

Wireshark - expose urlencoded-form.key as a column for a certain key

So I have a load of data that comes from a form with several fields. Exposing this in a field called urlencoded-form.key I get the following My question is whether I can add a column that would ...
user avatar
  • 474
8 votes
1 answer
2k views

Why, if I am connected via Wi-Fi and send a packet to another device in the same Wi-Fi, the dest MAC address in the link layer is not the AP's?

In the IEEE 802.11 protocol, in the link frame, the second address is the sender MAC address, and the first address is the receiver MAC address, which is the AP address if the sender is a station, and ...
user avatar
  • 211
3 votes
1 answer
42 views

Origin of USBMS packets referring to MS-DOS

I've been messing around with traffic interception over USB (using Wireshark) when I noticed that one MP3 player was sending some odd packets in response to read request on the first block of the mass ...
user avatar
1 vote
0 answers
14 views

How do I disable the graphs on the startup screen of Wireshark?

When I start up Wireshark, it begins monitoring all the interfaces on my PC and shows me graphs of how much traffic is on each interface. On Windows this generates ~15 consecutive UAC prompts. I can ...
user avatar
  • 119
1 vote
0 answers
34 views

How to manually resolve an address in WireShark?

There is an address in the capture window that i want to manually resolve: So i right-click the address, click Manually Resolve Address, and enter a Name for the address: When i click OK, WireShark ...
user avatar
  • 20.8k
0 votes
0 answers
39 views

How to translate a display filter on the FCS field to a capture filter in wireshark?

I am planning to capture a lot of trafic for a long time during a network test. The wireshark capture will stop due to the size of it if I don't set up a capture filter. Curently the display filter I ...
user avatar
0 votes
0 answers
72 views

How to SSH to a device connected locally through Ethernet without having any access to it

I have an Nvidia Jetson board I want to connect to via SSH. It is not connected to any router or any display, but my Windows computer through an Ethernet cable. I assume got the IPv6 of the device and ...
user avatar
0 votes
1 answer
144 views

What ends a TCP stream?

I am using WireShark and went to google.com. I got 23 TCP streams,23 TCP conversations, 23 handshakes right? I know that the TCP streams end with FIN Flag and that TCP segments are encapsulated in the ...
user avatar
0 votes
1 answer
49 views

No connectivity between hosts on UDP port

Host with IP address 192.168.212.49 is not able to reach host with IP address 10.50.140.179 via UDP 4501 port. ICMP (ping) communication is possible. There are two routers between these hosts. Note: ...
user avatar
0 votes
1 answer
43 views

SSDP replies from 192.168.1.1. What exactly is at this ip address?

When I send a crafted ssdp request packet with ssdp:all to 239.255.255.250, an address 192.168.1.1 replies with a bunch of HTTP 1.1 OK ssdp messages(captured on Wireshark). Are these ssdp services ...
user avatar
  • 3
0 votes
0 answers
59 views

How can I get the last n packets from a pcap file?

I know that I can use editcap to request a specific range of packets from a file with editcap -r <infile> <outfile> <start>-<end>. However, I would like a way to get the last n ...
user avatar
  • 101
0 votes
1 answer
33 views

Using NMAP to scan local device/own computer

Can't seem to find google-fu info on how to scan your own computer. Alot of guides suggest using your local IP address but i've accidentally just port scanned a foreign internet server. Is there an ...
user avatar
  • 1
0 votes
0 answers
23 views

Windows Wireshark on network bridge does not show all the packets

I have a Windows PC with two NIC used for network monitoring between two devices. When I setup a network bridge and launch Wireshark. I can see ARP requests and IP multicasts on both sides but no ...
user avatar
  • 2,618
0 votes
1 answer
33 views

Device communicates with server through bridge, unable to capture all packages

I'm trying to reverse engineer a device to be able to access its API locally. Currently it is communicating with an online server, where I can log into to see its data. Set up The device connects ...
user avatar
  • 113
0 votes
0 answers
530 views

How to capture docker container traffic using wireshark?

I’m trying to wrap my head around some basic networking concepts using docker and wireshark to capture and analyze packets. I’m quite new to this so please let me know if I need to clarify anything, ...
user avatar
  • 1
0 votes
1 answer
139 views

How to read mDNS response so I can parse it?

I know nmap has mDNS service discovery script but it wasn't helpful in my case as it doesn't include the correct service names. So I want to parse the following response as caught in wireshark, any ...
user avatar
  • 1
0 votes
0 answers
53 views

How to watch a traffic for a specific app?

I would like to see what is going on when the app (win32 executable) is waiting for a response from the server. For the web application, when you want to check the network activity, you go to Chrome ...
user avatar
0 votes
0 answers
59 views

Unknown ethernet traffic when capturing traffic with pktmon on Windows 10

When I capture traffic on Windows 10 machines through pktmon, a big chunk of traffic is only ethernet, with an unknown ethertype and unknown, but not locally administered MAC Addresses.Example: ...
user avatar
  • 1
0 votes
0 answers
39 views

GNS3 Wireshark packet missing?

I just have started learning networking. Now i am trying to understand ARP, using GNS3 and Wireshark. I created a simple network with 2 PCs, which are connected by switch, and started capturing ...
user avatar
0 votes
1 answer
233 views

Capturing management frames using Windows Network Monitor

I am trying to capture network traffic - specifically management frames (and from these, particularly beacon frames) in Windows. My wireless NIC is Intel Wifi AX201 160mhz, which seems to support ...
user avatar
  • 117
1 vote
1 answer
32 views

Start network capture as soon as interface is up

I'm trying to debug the network traffic that happens right when a USB RNDIS network adapter is plugged in. Right now I can use Wireshark to analyze the traffic after the USB has already been plugged ...
user avatar
  • 268
0 votes
0 answers
50 views

Wireshark is not display the packets between the client and server

On my machine there a TCP server is running @port 54000 which is a echo server it sends the same message which is sent to it. I have multiple clients which is connected to this server. Clients and the ...
user avatar
0 votes
2 answers
40 views

Monitor router traffic from PC

I want to monitor traffic on my home router, how to do this? I have a Huawei router. I have searched this question before asking here but most of the sites and blogs just mentioned hacking and other ...
user avatar
0 votes
0 answers
111 views

Decrypt TLS traffic from robot vacuum machine (Cecotec Conga 4690)

So recently I bought a Conga 4690 robot vacuum machine, which works perfectly fine. Since I'm a Home Assistant enthusiast, I want to connect the vacuum to Home Assistant. Unfortunately, this specific ...
user avatar
  • 1
1 vote
1 answer
25 views

Wireshark does not open URLs in GET requests anymore

Since a few days my Wireshark does not seem to open URL anymore, when I double click them in the corresponding section in the GET request packet. Instead, it gets copied to the clipboard. As I have to ...
user avatar
0 votes
1 answer
35 views

Monitoring with Wireshark on Wirless Networks

I'm a beginner and started working with Wireshark and hacking and I have some questions about it. The monitoring of a particular computer does not always work immediately. Why does the monitoring of a ...
user avatar
  • 3
1 vote
0 answers
19 views

Capturing network traffic of a single Application/Tab

I often come across a situation where I have to analyze external communication of a Mobile or Desktop Application or even a paritcular tab of a browser. I sniff traffic usually with wireshark but at ...
user avatar
  • 111
0 votes
0 answers
34 views

Unusual amount of ARP who is on WLAN form unknown IP

I am seeing a unusual amount of ARP traffic on my Wireless network. My wireless network is on the subnet 192.168.1.0/24 but the ARPs are coming from 10.215.0.1 which is not in my subnet. It is also ...
user avatar
  • 141
0 votes
0 answers
50 views

Capturing packets using wireshark of an IoT device

I have an IoT device that connects to my wifi router using wifi. There is a limitation of capturing network logs on the device itself so I thought to capture it using Wireshark. I am using windows 10 ...
user avatar
0 votes
0 answers
56 views

PC on home network sudden slow speed, wireshark syn/ack/psh/fin loop

A PC on my home network suddenly exhibits very low connection speeds and I have no idea why. It's using a wireless adapter to connect to our cable modem/router). The PC was getting around 20-30 Mbps ...
user avatar
  • 1
1 vote
0 answers
61 views

Many broadcast data frame over my Wi-Fi channel

I occasionally experience unstable connection to the Wi-Fi AP I use, so I used wireshark to sniff the packets on the same channel of my Wi-Fi network using monitor mode. I surprisingly find a lot of ...
user avatar
  • 11
0 votes
1 answer
73 views

Read packets in Wireshark

INV message hex dump shared on https://developer.bitcoin.org/reference/p2p_networking.html#inv has information about transactions that is human readable but I don't see anything similar in INV or ...
user avatar
  • 101
0 votes
2 answers
419 views

Can a non-admin user sniff network traffic?

Is it possible for a non-administrator/non-root user in Windows/Linux to sniff network traffic? With no preinstalled third-party tools. (The user can install third-party tools, but without admin ...
user avatar
1 vote
0 answers
23 views

Export object options greyed out. How to export objects?

I'm following a tutorial for detecting malware with wireshark. In the tutorial he exports all http objects. When I try to export all http objects the information is greyed out. I'm on version 3.4.6. ...
user avatar
  • 141

1
2 3 4 5
17