Questions tagged [wireshark]

The network protocol analyzer developed and maintained by the Wireshark Foundation

Filter by
Sorted by
Tagged with
0
votes
1answer
17 views

How can i compare two frames of a Wireshark capture?

I made a capture of the USB traffic with USBPcap and Wireshark to debug a HID touchscreen. Now i have identified the interesting URB_INTERRUPT packets, but how do i compare the HID Data of those? I ...
0
votes
1answer
7 views

Wireshark in windows 10 not showing “80211” header for Link Layer Header column

I am trying to capture Wi-Fi frames and check few parameters of 802.11. For that, I was trying to set the Link Layer Header of Capture Options in the wire shark. The drop down of the Interface WiFi is ...
0
votes
0answers
11 views

Data Flags…TC in Wireshark

Currently I am working on 802.11 Packet Extraction using scapy in python. I found strange character showing with the "IEEE 802.11 Data, Flags......TC" from Wireshark UDP packet. Can anyone ...
1
vote
1answer
54 views

VMWare Workstation: Which is the actual functioning of the VMnets: hub or switch?

I’m doing some experiments. I’m using VMWare Workstation 16 with 4 Windows 10 Pro 20H2 virtual machines. These machines are on the same VMnet (n.1) and on the same subnet (192.168.36.0/24) and I ...
0
votes
0answers
11 views

“Site can't be reached” when trying to query database from webapp page in IPSEC infrastructure

things are like this: VM with Windows Server 2012 for asp.net webapp - APPServer VM with Windows Server 2012 for sql server database(different from 1 - but same network) - DBServer CLient1 - Another ...
0
votes
0answers
30 views

Why does Wireshark Wi-Fi capture contain only Packets to STA. Packets from STA are missing (Chipset ralink 5370 under RaspOS)

I looked already round here. I know already Post Wireshark only captures packets to or from this device. It does not answer my question. My goal is to prepare a capture system for analyzing roaming ...
1
vote
1answer
53 views

Can't receive UDP data unless Wireshark is running

We have a computer system (Win10) that receives a variety of UDP data from a remote host at various rates (2-50Hz). The remote system is provided by our customer. While we're waiting for the customer ...
0
votes
1answer
12 views

How can I find the aplication layer protocol that is being used and shown in the Wireshark window

Hi everyone I'm trying to find the name of the application layer protocol that belongs to the frame 7 shown below. I'm trying to find it just by looking at the metric values and the routing info, that'...
0
votes
0answers
18 views

Too many Out-Of-Order and Retransmission TCP packets showing in WireShark capture

I captured packets of a session when trying to access an ESXi login page which is across a different network in a lab environment. The issue is the ESXi login page takes too long to load, nearly 2 ...
2
votes
2answers
40 views

I am having a difficult time reading Wireshark output

I am new to Wireshark and I am trying to determine if the recipient of this message will use an SMTP to retrieve an e-mail from the server.
0
votes
0answers
22 views

Wake on WLAN on GNU/Linux on two machines: one works, the other does not

I'm trying to set WoWLAN on two of my Linux machines, but I've only got it working in one of them. Following this tutorial, I've run: sudo iw phy0 wowlan enable magic-packet and also added it to /etc/...
0
votes
0answers
14 views

Network Traffic Security Wpa2

If my environment has connected to a wpa2 network, it is possible for another computer to capture my packages and have access to, for example, database connections without encryption.
0
votes
0answers
10 views

Wireshark 'bus error'

I have no idea what broke Wireshark in my Parrot OS. When I try to run or click on the launcher of Wireshark I get the message "bus error " on my cmd line. I do not know how to resolve this ...
0
votes
1answer
30 views

Wireshark - exports what it recognises as a jpeg but the jpeg doesn't open

I have a JPEG GET request in my PCAP as below but when I export it, it's not a valid JPEG file Any advice as to what I'm doing wrong?
1
vote
1answer
111 views

ttyUSBx data stalls, usbmon/wireshark shows data

I am working on developing a sensor platform based on a raspberry pi running raspbian and an analog/digital converter (ADC) connected via USB. The ADC should be providing data at 128Hz, and does so ...
0
votes
0answers
13 views

how can i capture wifi packets of a specific AP? i need to see the packets rssi

I need to catch packets of a specific AP in my range and display the rssi of this packets. I tried to use "airodump−ng −−bssid $1 −−write capture. pcap wlan0mon" and then analyze it with ...
1
vote
1answer
43 views

How do I monitor all packets flowing to and from a particular device on my home network?

I want to use wireshark to capture packets flowing to and from an ip camera on my home network? Would I somehow route all its traffic through my alfa network adapter? The camera is controlled via ...
0
votes
0answers
42 views

Many Neighbor Solicitation packets in Wireshark

While sniffing my Ethernet traffic via Wireshark, I noticed a lot of traffic even when seemingly no programs were running and using the internet. Around 10 packets per second, 86 bytes each: [ICMPv6] ...
0
votes
1answer
58 views

What does Wireshark do to the network configuration when it starts monitoring

I frequently have to connect to industrial controllers, more often than not these are on networks with no DHCP where all devices are assigned a static IP. I have found recently I have been having ...
0
votes
1answer
45 views

How can I capture network request made internally from Chrome

Chrome can autofill credit card information based on saved credit cards in Google Pay. As far as I know, when the Chrome alert asks you for the CVC of the credit card it sends a request to google ...
0
votes
0answers
42 views

Wireshark install on macOS catalina shows multiple issues

I installed Wireshark on my macbook air running catalina and i am getting this box showing the errors saying permission denied along with a lot of other errors. What should i do? plz help.
0
votes
1answer
47 views

How to capture wireless packets over Ethernet port along with Wired

I am trying to capture and analyze my network traffic. We have a wireless router and it have clients as both wired and wireless. My Kali computer which is connected to the router over Ethernet port ...
0
votes
1answer
100 views

Is Chromium a Linux spyware?

I've an Ubuntu 20.04.1 LTS machine and I've installed some application including Chromium and Wireshark. During PC inactivity Wireshark revealed TCP and HTTP connections to a Google LLC server. Is ...
0
votes
0answers
52 views

No traffice on tun0 with wireshark/tcpdump

I'm connected to a testing lab via openvpn and it's obviously created a tun interface. As part of this assessment I am supposed to analyze traffic on that network, however when I open wireshark there ...
1
vote
1answer
236 views

Is it possible to increase the packet size while using tracert (for traceroute) in windows cmd?

I am looking to increasing the packet size while using the tracert (traceroute) command in Windows CMD. But in the windows options, it does not give an option for increasing the packet size and uses ...
3
votes
2answers
290 views

How does the Client Hello message choose the Record Layer version?

I have two Client Hello messages from the same client to different servers, my client supports TLS 1.2 and TLS 1.3 as seen in the client hello supported versions. In the first message the client ...
1
vote
1answer
59 views

What is default wireless cards mode using Wireshark?

So, I think when I run Wireshark the wireless card works using promiscuous mode because if it is managed mode the wireless card will capture only packages directed to its. Monitor mode also cannot be ...
12
votes
1answer
663 views

Is my connection really encrypted through VPN?

I am checking that my VPN is really encrypting connection, using wireshark. When I capture from the WiFi interface the data is encrypted by openvpn protocol, but when I capture Local Area Connection (...
0
votes
0answers
30 views

wireshark with virtualbox not capturing any packets

I have a windows 10 host on my laptop and a guest with ubuntu server 14.04. I'm using virtualbox 6.1.16 r140961 for the vm. My question is my wireshark can't capture any packets of the vm, before you ...
0
votes
0answers
11 views

Wireshark: Long-Term Capture with Applied Display Filters

I want to do a long-term capture with Wireshark (or any other tool which runs on Windows and outputs pcap files) in order to diagnose some network errors. I am only interested in IPv4 TCP ...
0
votes
0answers
104 views

using wireshark to capture data sent through openvpn on local machine

I'm using OpenVPN to connect to select IP addresses and would like to see the packets that my system is sending and receiving prior to being encrypted by the VPN. Here's the dialog I'm seeing in ...
0
votes
0answers
16 views

Local FTP server not connectable outside computer unless I run wireshark once

I setup a Filezilla FTP server. I cannot connect to it from another computer on the same lan unless I run wireshark and monitor the ethernet adapter at least once. I've tried to figure out what is ...
0
votes
0answers
41 views

UDP packets sent to wrong IP?

I have an IPTV box connected to my only router that assigned it a local IP 192.168.1.165. I tapped the LAN cable right next to tv box and recorded traffic in Wireshark. There I saw a remote IP from my ...
0
votes
0answers
19 views

Log a TCP stream so it can be opened in Wireshark

I have an application that opens a TCP socket and sends and receives some data binary data. I would like the application to be able to log the sent and recieved data into a format that can be opened ...
1
vote
1answer
152 views

Wireshark / tshark print MAC address list of BLE Advertising Report

I have started sudo hcitool lescan --passive --duplicate and sudo tcpdump -i bluetooth0 -w cap.pcap Now viewing this in Wireshark I get a lot of LE Advertising Repots However in the colums I can't ...
0
votes
1answer
30 views

Can only see MDNS packets when I look for DNS packets

I'm playing with Wireshark and want to inspect some DNS packets so I flush my dns using ipconfig /flushdns and entering a url in my browser (Google Chrome). While I expect for a DNS packets and only ...
0
votes
1answer
19 views

How to capture API requests before they are routed through VPN?

When my computer is connected to VPN, the only traffic I see in Wireshark is the VPN ESP packets. Is it possible to capture traffic before it is routed through VPN such as API requests?
0
votes
0answers
26 views

Allow NIC card to accept unknown multicast frames in Windows 10

I want to sniff multicast frames between two devices. So I brought a tiny hub and connected the link that I want to sniff in two ports and to the third port a cable from my NIC card. I can see all the ...
0
votes
0answers
76 views

Kali linux, wireshark isn't working

I have everything downloaded but it keeps erroring to wireshark: error while loading shared libraries: libQt5Core.so.5: cannot open shared object file: No such file or directory I've tried sudo strip ...
0
votes
1answer
39 views

Understanding the 802.11 frame structure and Android probe request different?

I have read here and on Google a lot about the 802.11 Frames but something doesn't add up. this is what I see when I scan using ESP12 wifi Byte 00-11 : a7 10 75 50 00 00 00 00 00 00 0c 00 ...
1
vote
1answer
133 views

Ignore outbound conversations in Wireshark/tcpdump

I'm collecting pcap data on servers, and I'd like to only collect packets corresponding to inbound connections. Note that I am not looking to filter to inbound packets, but remove both outbound and ...
0
votes
1answer
47 views

Which application initiates network requests? Local DNS reports reqs to non-existing domains. [wireshark, macos, dns]

Summary: I see dozens of requests to non-existing domains and I suspect it slows down my network. Can't find the source. Full description: I use pihole as a DNS server, and both Wireshark and Little ...
0
votes
1answer
110 views

Setup wireshark to run as non root not working on Ubuntu 20.04

I am pretty new to wireshark and I read that wireshark shouldn't be run as root because of security issues. Anyway I did the following as mentioned in several places such as this post: sudo dpkg-...
0
votes
0answers
47 views

Wireshark cannot capture my pings

I cannot see my pings in wireshark. I opened wireshark. Started capturing on all interfaces. Put filter to arp or icmp and pinged an address for virtualbox. Wireshark snapshot Howerver, I can ping a ...
0
votes
0answers
23 views

Checking all connections on Windows 7

I want to check all outbound/inbound connections when my pc is (apparently) idle and possibly permit/deny selectively each of them as soon as they occur. Unfortunately it seems not possible on Windows ...
2
votes
1answer
32 views

Using Wireshark to understand layering and Ethernet MAC Frames

Wireshark Screenshot I have to fill out some information for a project and I am not sure where to find the information requested. I believe I have the destination and source MAC address correct. But ...
1
vote
1answer
148 views

Using Wireshark with remote interface

I have a remote containter that I log on into using SSH, and want to capture its traffic with Wireshark. In mac or linux environemts I could write ssh remote-ssh-host 'sudo tcpdump -U -i eth1 -w -' | ...
1
vote
1answer
45 views

Wireshark crashes before opening

I am running a 64-bit Windows 7 Dell laptop, and just installed Wireshark 3.2.6. Whenever I tried to open Wireshark, it would crash with the error message below. I've restarted my laptop, reinstalled ...
0
votes
1answer
108 views

Why does wireshark show only local destination ip adresses while connecting to remote website on company network

I am trying to capture packets on company network. The problem is that I can only see local destination packets while capturing. You can see the result in the following picture: What do you think is ...
1
vote
1answer
377 views

How do I configure PolarProxy on Ubuntu 20.04?

Problem I followed the instructions on PolarProxys website, but could not get any traffic to pass through (not from the same computer nor a remote one). Steps to reproduce Commands run on Ubuntu 20.04 ...

1
2 3 4 5
16