Questions tagged [wireshark]
The network protocol analyzer developed and maintained by the Wireshark Foundation
857
questions
0
votes
0
answers
7
views
Wireshark capture packet in host-only VM
I have 3 VMs: Pfsense, Kali and Windows XP (kali and window use host-only VMnet1, Pfsense 1 interface uses VMnet1 and one uses NAT). I open Wireshark on Kali machine, then I make a DNS request on ...
- 1
2
votes
2
answers
28
views
extract the top 5 TCP or UDP flows from tshark sorted in descending by Total bytes
As the question heading states, given a packet capture I want to extract the top 5 flows for TCP (or UDP) sorted based on total bytes in the descending order.
I have come up with this so far
tshark -r ...
0
votes
0
answers
31
views
In a GPON network, running wireshark captures SIP phone calls from other users
I plugged my laptop into my ONT and fired up Wireshark.
To my surprise a lot of SIP packects were present, and I could see phone numbers of other costumers, and the people they called. I didn't ...
- 1
0
votes
0
answers
33
views
How to fix receiving UDP data on windows?
On a windows 10 machine I am running the following python code (3.10.11) to receive data on UDP port 9001 (without any VM running):
sock = socket.socket(socket.AF_INET, socket.SOCK_DGRAM)
sock.bind((&...
- 532
2
votes
0
answers
34
views
WSL2 cannot connect to the Internet when Sangfor aTrust is running
I am using WSL2 on Windows 11 22H2 22624.1470. Ubuntu 22.04.6 LTS installed on WSL2. When I run a program called aTrust, which is developed by a corporation called Sangfor, my WSL2 cannot connect to ...
- 21
0
votes
0
answers
36
views
How to get wireshark to sniff packets between client and server using VMs attached to NAT Network
I am really new to pen testing. I am using Oracle Virtualbox, and I have three kali linux VMs setup. I am trying to use wireshark on a VM to sniff packets between a Modbus client VM and a Modbus ...
- 1
1
vote
2
answers
46
views
Send Data Across NICs Using socat
I'm working on a project trying to develop a data diode for unidirectional transfer of data, and I'm hoping to use socat for some measurements. As a first step, I want to use socat to send data from ...
- 11
0
votes
0
answers
17
views
How to debug Wake-on-LAN
I have a windows PC and I enabled the Wake-on-LAN feature in my ethernet network adapter and BIOS settings.
I'm trying to send a wol packet to this windows PC by using the MAC address from my ...
- 121
1
vote
0
answers
42
views
Mouse disconnects when I flick at high speed
Issue
I use a zowie EC2-A mouse to play fps games.
I'm using a custom built PC running windows 10.
I've been noticing recently that when I flick the mouse quickly to the right or left that it will ...
- 111
0
votes
0
answers
35
views
Why is the output of tshark `http.file_data` different from the Content Length?
I've got a PCAP file that has 3,445 HTTP "206 Partial Content" packets for the application/pdf media type. Each of these requests is for the same file, different Content-Ranges are being ...
- 101
0
votes
2
answers
30
views
Can I find e-mails, sent over MS-Exchange, using MS-Outlook?
I'm working with MS-Outlook and I would like to see the mails I'm sending in a wireshark capture. I tried filtering on "SMTP" but there's nothing.
How can I see my sent and received mails in ...
- 1,921
0
votes
1
answer
26
views
Windows 10 LAN connection freezes during download, blocks reboot, but only if internet download
I'm wondering if anyone has seen something similar or has any idea of what to test to further isolate the problem. What I'm observing is that my LAN connection kind of freezes during large internet ...
- 103
0
votes
1
answer
93
views
Is it normal to see "excessive" ARP requests from cable modem?
I'm troubleshooting my home network because we are having frequent outages and slow connections. Very often the ASUS Wifi router shows that it has no WAN IP address. To view what might be going on I ...
- 129
9
votes
2
answers
2k
views
How many TCP retransmissions Internet traffic is considered normal for a basic home setup?
Out of curiosity, I connected my laptop with an ethernet cable to the router and fired up Wireshark to understand and 'visualize' what's going on.
Some packets caught my attention.
I was having some ...
- 91
0
votes
2
answers
278
views
How to disable promiscuous mode in hyper-v?
I enable promiscuous mode on hyper-V system(windows 11) following by
hypervPromiscuousModeSetUp
I test wireshark on hyper-v running Kali linux OS, It works well.
But, I want to disable promiscuous ...
- 3
0
votes
2
answers
279
views
Wireshark filtering, wpa2 handshake type value and other types
I am capturing a wpa2 handshake with wireshark, and there is the type value of 03 which is a key I wonder if this type is constant for wpa2 handshakes, also the value of other types, if there were to ...
0
votes
0
answers
34
views
POSTFail code from USB headphones
A couple of months ago I bought USB headphones (which has a slider to increase/decrease the volume), since the audio port on my desktop is not working anymore.
Recently, every time I connect them, ...
- 1
0
votes
0
answers
869
views
TCP Retransmission (TCP Port numbers reused) issues
I developed a web server and this is running on GKE.
Whenever I send any request to this server from my local pc, it occurs TCP retransmission.
Following is captured packets with Wireshark. The red ...
- 111
0
votes
0
answers
80
views
Why does my LAN NIC get a lot of TCP retransmissions and timeouts?
yesterday I recognized that git cloneing repositories from my private GitLab instance wasn't working consistently. My internet connection is fine and I can also visit GitLab's web interface without ...
- 41
0
votes
1
answer
114
views
How to capture TCP/UDP, HTTP traffic on wireshark. Only getting 802.11 from my machine with adp
So I am fairly new to using Wireshark and cannot figure out how to capture all the traffic on my network. The steps I have taken are putting my card into monitor mode then opening Wireshark and ...
- 121
0
votes
0
answers
35
views
Arp scan can't find all the device connected to the LAN except mine and router
I'm new here.
I'm trying to do an arp scan on a LAN and monitor in on via wireshark
My problem is why do I only get the router's mac/response and my mac address on source column?
I am pretty sure that ...
- 1
0
votes
0
answers
140
views
Why does wireshark say invalid key format?
Upon trying to enter wpa-pwd or wpa-psk, wireshark says "invalid key format" before I even begin to enter the password/key. Am I not entering it into wireshark the right way?
- 15
0
votes
0
answers
73
views
Cannot see HTTP when using Wireshark on two different models of Alfa Wi-Fi adapters
I just upgraded my Wi-Fi adapter from Alfa AWUS036ACS to the Alfa AWUS036ACM and I can tell it's much better.
However, I am still not getting the desired results in Wireshark which leads me to believe ...
- 15
0
votes
1
answer
148
views
How does 802.11a,b,g,n,ac and channel factor into sniffing with wireshark?
I have been playing around with wireshark lately and am wondering how your 802.11 version as well as channel impact packet capture? If my router uses 802.11a,g,n and ac and my wifi adapter uses 802....
- 15
0
votes
1
answer
55
views
Will this adapter work with wireshark?
Will the Alfa awus036acm with mt7612u chipset work with wireshark 6.0.2 on Kali 6.0.0 for packet sniffing tcp,udp,dns,http,etc? I have seen both negative and positive reviews on it so I'm not sure.
- 15
0
votes
0
answers
108
views
Why is Wireshark not showing any TCP, UDP, DNS or HTTP traffic?
I'm using Wireshark 4.0.2 on Kali 6.0.0 with an Alfa AWUS036ACS and in managed mode with promiscuous mode enabled I don't see any TCP, UDP, DNS or HTTP.
If I switch to monitor mode with promiscuous ...
- 15
0
votes
1
answer
42
views
Forwarding tcpdump packets on remote gateway to wireshark
I'm trying to capture packets on a usb over ethernet interface (usb0) on a gateway. I have a ionoPi that is connected to the gateway (i.e. no gui on the pi and gateway) that sits between my ubuntu vm (...
- 3
0
votes
1
answer
244
views
Wireshark showing Cloudflare WARP packets as DLEP instead of WireGuard or UDP
From what I've found so far, DLEP belongs to Cisco ? and Cloudflare WARP is supposed to use WireGuard
I need help understanding why I'm seeing DLEP packets in WireShark instead of UDP or WireGuard.
I'...
user1752038
1
vote
2
answers
752
views
How can I determine an IP camera’s streaming URL using Wireshark?
I have an unknown Chinese brand IP camera and I need to determine its streaming (most likely RTSP) URL.
Accessing the camera's IP address through a browser loads a web page including the settings and ...
- 19
0
votes
0
answers
6
views
Wireshark crash while exporting dissections in Clan?
the User wireshark system crashes while exporting dissections in c format? the operating system is Mac onboard a chip released in 2019. Is it common?
- 11
0
votes
0
answers
227
views
I get no HTTP or DNS traffic in wireshark
I am trying to analyze the traffic from a smartphone, through wireshark, but when I enter the HTTP or DNS filter, it shows nothing.
The network I am analyzing is WPA2/PSK. I put the PSK key in ...
- 293
7
votes
1
answer
1k
views
ICMP packet with TCP?
For some time now I have found myself interested in packet analyzing and I try to figure out all kinds of stuff that I see in network captures. I hope you guys might want to help me find out this one.
...
- 73
0
votes
2
answers
31
views
Wireshark UI, how to have current packet stand out in packet list pane?
Default Wireshark UI seems to be very unfriendly in one aspect. When I'm scrolling and viewing a packet's detail, the UI gives very little visual clue about [which packet in the packet list I'm ...
- 5,563
0
votes
1
answer
83
views
Wrong Epoch time while sync with NTP server
I have two clients which are synchronized with the NTP server. I am trying to measure the latency of packet from client1 to client2. But the Epoch time still does not make sense because the packet ...
- 3
0
votes
0
answers
36
views
How can I identify which process created an ARP-request on my Windows-machine?
I am trying to find out which process is sending out ARP-requests repeatedly on my Windows-machine.
I already tried TCPView from Sysinternals, but it doesn't list the target IP-address that's listed ...
- 921
0
votes
1
answer
940
views
How can I view the TLS 1.2 and 1.3 certificates in Wireshark?
I'm testing a new proxy and monitoring the connection using Wireshark, but I'm not seeing any certificate at all. my goal is to find out exactly what sensitive and identifiable data is leaving my ...
user285140
0
votes
1
answer
326
views
How does a web server communicate HTTP/2 support to a client?
I built a nodeJS HTTP2 server on my localhost: 127.0.0.1:8443. Went to wireshark and selected the loopback adapter to capture the traffic when i hit the server from my chrome. I dont see the server ...
- 113
0
votes
1
answer
231
views
How to use ciscodump?
In wireshark, there is this option called Cisco remote capture: ciscodump, which, from my understanding, should enable to do a tcpdump on a cisco router (for example) via SSH and get back the results ...
0
votes
0
answers
203
views
How to decrypt dns over tls data using wireshark
Good afternoon.
I need to know the procedure I need to follow or any clues on how to decrypt DoT traffic in wireshark using pre-master keys shared. Another alternative would be to create a dns server ...
- 1
0
votes
1
answer
32
views
Host seemingly isolated from other hosts on my network
I came across a weird issue an I need help to locate the problem or at least reduce the search area. I'll give a general insight but I can provide details on request.
I have an HP laptop which runs ...
- 17
0
votes
0
answers
54
views
Where could my packets be being blocked?
I am working on a video streaming project, I have issues when sending above a certain amount of traffic (something like 20 Mbs) I no longer receive any packets. Some quick facts:
Windows task manager ...
- 111
0
votes
0
answers
174
views
Decrypting TLSv1.3 data using SSLKEYLOGFILE from native app
I am trying to decrypt TLSv1.3 packets using Wireshark. I have succeeded in doing so using this tutorial: https://blog.didierstevens.com/2020/12/28/decrypting-tls-streams-with-wireshark-part-2/
This ...
0
votes
0
answers
143
views
Ping device connected directly to the Ethernet port from computer
I have the following situation: I've connected a device (an automotive ECU) to my PC via the Ethernet port. In WireShark I can see the packets from the device: WireShark
The packets are from IPs 172....
0
votes
1
answer
108
views
How can I monitor a wi-fi device communication like monitoring an Ethernet-linked device using port-mirroring switch and WireShark?
In an Ethernet network, it's well-known to connect devices with a port-mirroring switch and then watch communication among devices using WireShark. Before WireShark can capture packets from other ...
0
votes
0
answers
264
views
How do I stop TCP reset packets?
Full story: This has been quite the odyssee, finding out who is sending these TCP reset packets. The isp pointed me in the direction of the minecraft server, the minecraft server said it has to be the ...
- 101
0
votes
1
answer
2k
views
wireshark is not capturing http traffic
I have a lab server that I have a desktop that I would like to monitor with wireshark directly connected to and I am bridging the NICs to the internet connection between the server and the desktop. ...
1
vote
0
answers
56
views
Unable to see mirrored traffic with wireshark
I am trying to monitor the network traffic coming/going into my network. I have a switch setup between the modem and the router where I have the port going to the router mirrored to a port connected ...
0
votes
1
answer
1k
views
Modbus traffic in Wireshark
I am tinkering with some modbus python scripts to try and learn it but I cant seem to capture traffic on wireshark. Can a Modbus client and server both run localhost on the same computer listening on ...
- 185
0
votes
1
answer
42
views
Extract data from a pcap file
Is there any way to export the data section of all the packets from a pcap file?
For eg: the data section according to the image is ffffffff72636f6e203434207174
I tried searching a lot on web but ...
- 143
0
votes
0
answers
99
views
Every second an unknown MAC address sends an ARP probe
I just inherited a network and found something I can't say I've seen before.
About every second (sometimes longer, sometimes shorter) a MAC address that I can't find anything about sends an ARP probe ...
- 1