Stack Exchange Network

Stack Exchange network consists of 174 Q&A communities including Stack Overflow, the largest, most trusted online community for developers to learn, share their knowledge, and build their careers.

Visit Stack Exchange

Questions tagged [wireshark]

The network protocol analyzer developed and maintained by the Wireshark Foundation

0
votes
0answers
9 views

Wireshark Build Location

I'm trying to build Wireshark from source. I was able to do so and run the run/wireshark command to launch the application, but after running make install in the build directory (which I had placed in ...
0
votes
1answer
23 views

What does a suspended TCP process in linux exactly do and do not?

Regarding TCP connections using NetGui (and wireshark for analyzing): I set a TCP connection between two PCs using the command nc -p 11111 etc... for the server, and the corresponding one for the ...
0
votes
0answers
9 views

sniffer with Wireshark in c9

I have a C code of client-server. I want to run them on C-9 IDE and sniff and analyze the traffic between them with Wireshark. how can I run Wireshark on c9 web, and analyze the traffic of the client-...
0
votes
0answers
46 views

One HTTP request, two responses?

I'm experimenting with my Samsung wireless speaker. I've been using Wireshark to examine and reverse engineer its API. One of the API calls I make causes strange behaviour where it seems one HTTP ...
0
votes
1answer
45 views

How to make Wireshark show http format instead of 802.11 or check if Wireshark is capturing it

First of all, this might look like a duplicate from this post, and it kind of is, but at the time writing my rep is not high enough to comment and I was walking in to some issues whilst applying that ...
0
votes
0answers
46 views

Filtering wireshark traffic for all snmp

What is the correct syntax for a CAPTURE filter to capture ALL SNMP traffic? (Note: SNMP can use both TCP and UDP protocols.
0
votes
1answer
57 views

Wireshark “Save As” Greyed Out

When I open the "File" menu in Wireshark, the "Save" and "Save As" entries are both greyed out, and clicking on them does nothing: I wish to save a subset of packets from a .cap file (which was ...
0
votes
1answer
32 views

How I can capture the traffic of my smartphone or tablet

I have 3 different devices for my kids connected to my home access point (smartphone, laptop, and iPad). I want to collect the traffic from their devices to monitor what for example they are browsing ...
2
votes
1answer
46 views

Can you intercept packets being sent to a VM over ethernet?

I have a VMware Workstation Pro instance with a bridged connection to a Gigabit PCI Express Network Adapter. I'm trying to intercept packets being sent to the VM from the Host. When I use Wireshark ...
-1
votes
0answers
50 views

How to make sure the client supports tls version only >= 1.2?

Here is the the client hello message packet intercepted from the client side. It supports TLS version from 1.0 to 1.2. How to configure it correctly in client side to support TLS version >= 1.2 so ...
1
vote
2answers
219 views

How can I monitor all activity from only one software with Wireshark?

I would like to know if it is possible in WireShark to monitor ONLY the activity coming from a single software. p.e. if I use CSVpad.exe, how can I monitor all activity from CSVpad?
0
votes
1answer
16 views

Putty/Wireshark in terminal/on vps?

Is there a way to use these specific programs through a terminal or on a vps? (By through a terminal, i mean with no displays, just the actual terminal). Im on RHEL/CentOS7.
0
votes
0answers
22 views

tshark: using frame contains and write to file

i want to filter out TCP packets that contain a specific string in the frame data (data.data) tshark -i 1 -f "tcp port 8800" -Y "frame contains FILE" -w "data.txt" This is exactly what i want. ...
0
votes
1answer
18 views

remote ssh tcpdump command, through a gateway, to be opened, in realtime, in Wireshark, on local machine

I (Host A - Windows based using plink) am trying to connect to a remote linux server (Host C), through a gateway linux server (Host B), and run this tcpdump on Host C to be piped all the way back to ...
1
vote
1answer
168 views

tcpdump read both ipv4 and ipv6 packets from pcap

I'm trying to gain some info from payload of tcp and udp. The filter (tcp.stream && tcp.flags.push == 1) || udp.stream in Wireshark gives me both ipv4 and ipv6 packets. But I can't figure ...
0
votes
1answer
23 views

Deauth frames showing up as ethernet II frames under wirshark

I'm trying to write a simple deauth attack script, but when I when fire up wireshark instead of deauth frames I only see Ethernet II frames; in addition the frames have no effect on any of my network'...
0
votes
1answer
120 views

Find string packet in decrypted data with wireshark/tshark

I am analysing a capture of encrypted traffic with wireshark. I have decrypted the traffic with the proper passphrase in wireshark and I can see the decrypted data of each frame. The point is that if ...
1
vote
0answers
48 views

Arps in virtual machines and virtual interfaces

I am using wireshark inside and outside of a virtual machine, inside oracle box virtual box. Outside of oracle box my main OS basically shows up two arps, the reuter asking who am I and my machine ...
4
votes
1answer
60 views

Why does the 2nd ARP request wait until the pings are over to show up?

This problem was presented to me by one of my professors because it only happened after switching from 100Mb cards to Gigabit NICs. The second arp request that comes from the computer being pinged (to ...
0
votes
1answer
48 views

Capturing packets without connecting to the WLAN

How can wireless sniffers capture packets from a WLAN without being connected to that specific WLAN (without having access credentials of that WLAN by any means). How to get the interface of that ...
0
votes
0answers
46 views

Wireshark can not filter protocol IPv4

I have a list of packages: I input cldap, I can filter out all the protocol packages: If I input the IPv4: I can not filter out what should appear:
0
votes
1answer
833 views

How does VLC-player play Samba-shared video files?

I have to Virtual Machines (Ubuntu 18.04) which are running on the same internal network. The Server-VM stores a video in a folder which is shared to the Client-VM using Samba. The bitrate of the ...
0
votes
0answers
36 views

home network with multiple ip adresses for same mac

My home network is working on and off, but even when working there is something strange going on (router alternating between 192.168.1.1 and 192.168.0.1). Every now and then I cannot connect at all. ...
2
votes
1answer
140 views

Using wireshark to only capture the traffic between my computer and a specific host

I'm a .NET developer who's used to using fiddler. I'm trying just see the traffic from a web service running on my local machine and a specific web service. When I hit this web service from an ASP....
0
votes
0answers
121 views

Home wifi sends ICMP messages to servers in China, Russia, Ukraine, Bulgaria and US

I recently found out how to capture outgoing packets of my router, so I tried it out and captured a few minutes of traffic. When I analyzed the packets with wireshark I noticed something odd: There ...
0
votes
0answers
120 views

DNS query and query response in wireshark

I am connected to a captive portal network.I am studying about DNS queries and responses. Sometimes when i connect to the captive portal it redirects the traffic to a login page, but while noticing ...
1
vote
0answers
65 views

Google Recaptcha fails over tethering

I've done research for the last couple days concerning tethering Fedora 28 x64 bit over an android tethering. The android phone is a non-standard AOSP with functional APN settings. I recently ...
0
votes
2answers
77 views

DNS and understanding root servers

Firstly, is this explanation on how DNS works right? When we visit a site, say (www.example.com),we are doing a lookup to convert the domain name to an i.p address. So, our computer first looks at ...
0
votes
0answers
66 views

Bulk file download of Wireshark attachments

Many people post capture files to Wireshark bug reports (https://bugs.wireshark.org/bugzilla/), and these capture files are very useful for testing purposes. Unfortunately, there is seemingly no easy ...
0
votes
1answer
1k views

wireshark: error while loading shared libraries: libQt5Core.so.5 [duplicate]

I succesfully installed wireshark 2.6.2, but I can't execute it due to this error wireshark: error while loading shared libraries: libQt5Core.so.5: cannot open shared object file: No such file or ...
0
votes
1answer
78 views

Capturing mail traffic with Wireshark

i've been trying to use Wireshark to capture an email i am sending from my smartphone on the same wifi network. I'm using Kali Linux (not a virtual machine), i am in monitor mode, i have set up the ...
0
votes
0answers
102 views

Different TLS versions in the ClientHello from the same client

I have a python client. Using ssl.SSLContext() (documentation here) and set_ciphers(myciphers) (where myciphers is my list of ciphersuites that I change with every handshake, i.e., with every socket ...
0
votes
1answer
64 views

manually set wifi card frequency on MacOS X

I'm using macOS High Sierra (10.13.6). I would like to sniff live wifi traffic on a specific wireless channel using Wireshark. I'm able to put the interface in monitor mode using Wireshark and see all ...
0
votes
1answer
43 views

Is it normal to have a device on the home network broadcasting ARP all the IPs on the network?

I'm using Shark to scan my home network, and i noticed that a tablet is broadcasting, ARP protocol to all available IP on my network. Would this be a malicious attack from an app that i installed?
-1
votes
1answer
98 views

Decrypting Captive Portal Data [duplicate]

My university has a captive portal login. Each user is given a username and a password. For Wpa, if you go to Edit-> Preferences and type IEEE 802.11, you can decrypt wireshark data. How can i decrypt ...
0
votes
0answers
144 views

Visualizing Packet Captures in Grafana

What is the best way to import a pcap into Grafana? Is there a particular data source or process that should be followed?
-4
votes
2answers
160 views

Decrypting WiFi packets on a public hotspot [closed]

To decrypt 802.11 header in Wireshark, you must know the WPA password. Now, for example, there is a network which when clicked takes you to a login page where every user on the network has a username ...
0
votes
1answer
76 views

What are the “line” numbers in Wireshark (and other hex editors/viewers)?

This is probably a really simple question that has an answer elsewhere, but I couldn't think of the right words to make an effective search, so here I am. Obviously, if this is a duplicate question, ...
0
votes
1answer
155 views

Can not trace the packets to a specific gateway ip

I try to make the OSX host-A to be a specific gateway for a Linux host-B. The default gateway entry of B has been deleted and add a specific gateway as below. Note: 98.136.144.138 is the ip address of ...
0
votes
1answer
613 views

TCP reset (RST) flag

I am trying to stream a video between 2 hosts also I am trying to simulate changing IP scenario, the client started listening to the server then I moved the client to the new switch and it is got 192....
0
votes
1answer
44 views

Capturing Link layer frames

I've been trying to capture link layer frames. I've tried using wireshark (also tcpdump and airmon-ng) both in monitor mode and managed mode (/promiscuous mode), yet have been unable to see them. Put ...
0
votes
1answer
86 views

How to fetch application specific url's by using wireshark in Windows-8/10?

Its my first time using wireshark and I am encountered with one major problem i.e How will i sniff url/api that a particular application/software is hitting which is installed in Windows-8/10 by using ...
2
votes
1answer
94 views

Wireless Adapter TCP Retransmissions

I'm on OSX High Sierra 10.13.4 and like to work from the park where there are wireless hotspots. My laptop's wireless can connect to these networks but the connection drops occasionally. I recently ...
2
votes
0answers
85 views

Automated webpage browsing [closed]

I want to find a way to open https websites in my browser (or any other script-based way??) while running tshark or wireshark. My goal is to collect the ssl dialogues and then via tshark I can export ...
0
votes
0answers
22 views

HTTP Video streaming failed because TCP re-transmission

I am trying to stream a video between 2 hosts but I am trying to simulate changing IP senario by listing to an IP (192.168.2.3) instead of the real IP(192.168.2.5), I am using mininet and Ryu ...
1
vote
0answers
118 views

How to read/decode/parse HTTP/2.0 capture decrypted by Wireshark?

I thought Wireshark successfully decrypted an encrypted HTTP/2.0 connection once it was pointed to pre-master secrets from Firefox after setting SSLKEYLOGFILE. It shows the header when following the ...
0
votes
1answer
379 views

Wireshark: interfaces refresh with monitor mode unchecked when I check it

Whenever I turn on the monitor mode for my wlan interface from the Capture interfaces dialog box, I can see for a moment that the text in Link layer header changes from Ethernet to 802.11 plus ...
0
votes
2answers
627 views

Wireshark - Only show specific protocol

I try to only show packages with a specific protocol, e.g. only show "TCP". Optional: I am also interested on how to exclude specific protocols, e.g. don't show SSDP and NBNS. But I can't figure out ...
0
votes
1answer
198 views

Decrypting Application Data with (Pre)-Master-Secret log file in Wireshark

I've read a few articles outlining a process for decrypting SSL/TLS traffic without a private key. Session keys are generated in a log file, which are then read from Wireshark by point to the log file....
0
votes
0answers
402 views

Hidden messages in the pcap file

I tried various ways of decoding or analyzing data using wirehark and tshark with cli, also suggested that the pcap data was intentionally damaged by someone and I used pcapfix to fix the sectors of ...