Questions tagged [wireshark]
The network protocol analyzer developed and maintained by the Wireshark Foundation
885
questions
3
votes
5
answers
5k
views
Wireshark (Linux) captures only packet from and to my PC when in promiscuous mode
I've installed Wireshark and configured it to let my user run it with all needed privileges (I enabled dumpcap and added my user to wireshark group, then restarted).
Devices are shown and capture ...
1
vote
1
answer
987
views
Filtering sniffed logs using Wireshark
I'm experimenting with packet sniffing and log examination using Wireshark, and I'm quickly realizing that I'm not nearly as safe as I should be when using public hot spots. In efforts to better ...
0
votes
1
answer
589
views
What is fjappmgrbulk?
I captured a udp packet from wireshark which ones port is 2510 and destination ip is 81.64.155.202. What is that port for? I found this post) mentioning:
"it's for fjappmgrbulk, fjappmgrbulk which ...
1
vote
1
answer
2k
views
Trying convert webserver certificate to PEM file for wireshark to monitor ssl traffic in HTTP format
I am trying to monitor https traffic as readable HTML.
I have downloaded the certificate from the server.
"In Internet Explorer, I selected the certificate and copy to file, DER encoded binary X.509 ...
4
votes
1
answer
3k
views
Vista DPI Scaling: Cannot disable DPI Scaling for Wireshark
I'm trying to disable dpi scaling for Wireshark, except Windows won't let me:
Yet i pick any other random executable in the folder, uninstall.exe for instance, i can do it fine:
What gives?
i know ...
1
vote
2
answers
1k
views
WireShark: How do i use "Apply as filter"?
i'm seeing some packets in WireShark that i don't want to see:
No problem, right-click on SSDP and click
Apply as Filter
...and not Selected
Except i've never been able to get the Appy as Filter ...
0
votes
1
answer
3k
views
Wireshark sniffing "microsoft-ds [syn] seq=0.."
I'm new to wireshark. (installed it today)
I'm just looking at the traffic and noticed this kind of packages:
60261 microsoft-ds [syn] seq=0 Win=8192 Len=0 MSS=1460 SACK_PERM=1
its sent to ip: 132.72....
4
votes
4
answers
8k
views
MTU is 1500, why the first fragment length is 1496 in IPv6?
ping6 ipv6Address -s 1500
This command will result a fragment. Observed by wireshark, the 1st fragment packet's length is 1496 (from layer 3). Since the MTU is 1500, I am confused by this 1496 length....
2
votes
1
answer
3k
views
Why do I keep seeing "Wireshark Cookie Dump Ok Cancel" in my input forms within Firefox?
I've recently installed Wireshark on my Macbook Pro. Since doing so, whenever I head over to http://jsfiddle.net, all of the input fields are pre-populated with
Wireshark Cookie Dump:
OKCancel
So I ...
2
votes
3
answers
2k
views
Why do I have so many HTTP packets in Wireshark when I'm not doing anything?
Is it normal that I have huge amount of HTTP packets every second in Wireshark, even if I am not doing anything?
I would like to analyse some packets related to one website in particular, but how can ...
4
votes
2
answers
1k
views
My Mac trying to connect to a possible intruder's machine, that is not in the network anymore
I just asked a question I think someone else has access to my wireless network. What next?. I have changed wireless security to WPA2, changed the password, disabled file sharing etc as =suggested in ...
1
vote
3
answers
2k
views
Watching http in wireshark
Wireshark reassembles TCP Segments. For teaching purposes, I'd like to see the actual packets (not the reassembled TCP Segments) that flow on a network when you access a webpage.
Can I do that with ...
7
votes
5
answers
18k
views
How to test Bit Error Rates on Ethernet Networks?
I need a tool software or otherwise (preferably software) that will allow me to test Bit Error Rates on an Ethernet Network.
I am using a software tool that I did not write and do not have access to ...
3
votes
3
answers
9k
views
Wireshark filter for different interface
I know that before capturing packets, I can select specific interface.
I wonder is there any filter to distinguish different interfaces after I capture packets?
That is, at the beginning, I capture ...
32
votes
3
answers
49k
views
How to set up wireshark to run without root on Debian?
I'm trying to use wireshark on a Debian machine, but when I run it with my non-root user account, it doesn't detect any network interface.
I also tried running wireshark as root, but wireshark tells ...
4
votes
1
answer
11k
views
tcpdump filter for given bytes on given position
I'm searching for a way to filter traffic for specific bytes.
What I have is a stream that I capture with wireshark or tcpdump. Now it logs way too much, so I want to drop every packet that has 0x23 ...
4
votes
2
answers
2k
views
Unable to capture outgoing traffic with Wireshark on wi-fi network
I'm trying to use Wireshark on Backtrack 5 to capture packets that are transmitted through my home wi-fi network.
I'm perfectly able to capture outgoing traffic from localhost and, it seems, incoming ...
13
votes
4
answers
36k
views
Why do I see "The NPF driver isn't running. You may have trouble capturing or listing interfaces." when starting Wireshark?
When I start up Wireshark, why do I see this message?
"The NPF driver isn't running. You may have trouble capturing or listing interfaces."
3
votes
2
answers
6k
views
tcpdump - just packet data
When using tcpdump, how can I print just the packet data?
For example (anonymized):
sudo tcpdump -X 'tcp port 80 and (((ip[2:2] - ((ip[0]&0xf)<<2)) - ((tcp[12]&0xf0)>>2)) != 0)'
...
10
votes
3
answers
17k
views
Chrome browser sending Keep-Alive packets?
I ran Wireshark on my PC and found that my chrome browser was sending LOTS of Keep-alive packets even when there are no sites loaded in the browser, and even when there are no extensions installed!! ...
1
vote
2
answers
3k
views
Networking packet sniffer for Linux that captures the application names?
I tried Wireshark. It shows the source and destination IP address, port number, and packet contents, but nothing about which application is using the packets.
Apparently tcpdump is similar; network ...
0
votes
1
answer
7k
views
How to monitor traffic passing through my Wi-Fi access point
I know how to monitor the network interfaces on my local computer with Wireshark. But, how do I monitor the traffic flowing through my wireless access point from connected computers?
It seems like ...
13
votes
5
answers
61k
views
Wireshark cannot see traffic from a VirtualBox guest on Windows 7
I have been trying to use Wireshark to capture some traffic that comes from a virtual machine.
The setup is:
Windows 7 host
Ubuntu guest
VirtualBox 4
I send some packets from the guest to the host ...
0
votes
3
answers
5k
views
Using nc (netcat) to emulate NTP server response
I want to test some security on an NTP client developed in-house and would like to use netcat to do it. I have packets captured with Wireshark from previous NTP exchanges that I tried to feed to the ...
2
votes
1
answer
884
views
Linux alternative to Fiddler2 (different use! Not same question!)
I am aware that this question has been asked before; but my use for fiddler is completely different; Fiddler2 is my example.
In Fiddler2 I can download streams from websites; for example if I stream ...
1
vote
1
answer
646
views
Network being flooded with TCP Junk
I've been using Wireshark to check out the traffic on my home network. Fairly recently, I started getting a bunch of junk generated constantly. I've been unable to find out the cause, as virus/spyware ...
5
votes
1
answer
6k
views
why still dns lookup when using proxy?
I've configured my browser(firefox) to use proxy ,but I find that it's still looking up the dns when I visit http://domain.name, why is that still necessary?
0
votes
1
answer
819
views
VirtualBox and missing packets in wireshark
I've been using virtualbox for some time for development purposes.
Under the latest version of virtualbox 4.04 where Linux is the host, I'm noticing that I cannot see packets sent to the virtual ...
11
votes
2
answers
14k
views
How can I diff two network dumps from tcpdump or Wireshark?
I'm having a problem with one of our customers' embedded computers. They seem to discard some network packets which they should not. I can capture the TCP communication from a managed switch outside ...
4
votes
3
answers
288
views
Is there a file format equivalent of Wireshark?
I love how Wireshark breaks down every packet by protocol section, explaining what every single bit and byte is for. What I would also love is a program that does the same thing for regular files: ...
7
votes
2
answers
29k
views
TCP segment of a reassembled PDU
In wireshark sometimes I see this:
478195 5738.896809 192.168.1.79 61.213.44.124 TCP [TCP segment of a reassembled PDU]
What is a PDU? Was it reassembled? What does this mean?
8
votes
1
answer
34k
views
How to find HTTP GETs in Wireshark
How can I use the filter in Wireshark to find only those lines that have HTTP GET in them?
0
votes
2
answers
5k
views
How to filter out information in Wireshark
I am not interested in any information about network activity from any address that starts with 192.168. How can I make Wireshark hide those?
0
votes
1
answer
263
views
How to get information out of Wireshark
I need to make a program that makes use of information that Wireshark collects from the network. Is there a way to get that information from Wireshark and into the program?
0
votes
1
answer
70
views
What is an application for "web site recognition"?
This explanation isn't clear to me.
Let me describe an application for web
site recognition. Suppose that we
want to know what everyone is doing
with the web at starbuck. We can use
...
1
vote
3
answers
4k
views
Wireshark can see outside of the virtual machine?
I'm running Windows in a VM inside of OSX. If I start Wireshark inside Windows, then a message from OSX pops up saying that Wireshark is trying to monitor all network traffic. If I accept, then ...
0
votes
2
answers
332
views
Is this normal Wireshark behavior?
I'm running Wireshark in Windows inside a virtual machine. Wireshark keeps reporting network activity, even though I don't have anything running in there that's accessing the network.
3
votes
2
answers
2k
views
How do I trace HTTP packets with Wireshark?
What can I do in order to see packets that come from different sessions in a web page?
For example when I open yahoo.com there are different sessions in yahoo; I dont know how to see which packet is ...
0
votes
1
answer
81
views
I need a 802.11 caputure of the full wpa authentcation process
I cant seem to get wireshark to work with my NIC to capture the raw 802.11 packets. I need just a screenshot, showing this exchange.
0
votes
2
answers
9k
views
How can I capture other computers traffic in Wireshark on a WiFi-network?
I run Wireshark on a MacBook Air and I also have a Android phone on the same WiFi-network. If I visit a website with the Android phone I can't see that DNS-traffic (or other traffic) in Wireshark on ...
1
vote
2
answers
2k
views
How to measure network traffic on a port
I am using fiddler to monitor what is going on. Though I cant see total traffic over time for a session.
Any tools that can do that easily
(If I could export the statistics to a spreadsheet from ...
1
vote
1
answer
2k
views
Using (embedding?) wireshark in a C application for sniffing [closed]
I'm writing a C/C++ application which needs (among other things) to sniff packets and save the output in a file. This file will be read and processed by wireshark after a few days, using a LUA script ...
1
vote
0
answers
353
views
Need to know who is hogging my bandwidth? [duplicate]
Possible Duplicate:
On Mac OS X how can I monitor what is using my internet connection?
I have an ethernet connection to my iMac and with Internet sharing I am broadcasting the wireless network ...
2
votes
3
answers
12k
views
Filtering non-local IP traffic with Wireshark
If I capture traffic through my wireless card, I get a ton of different kinds of packets showing up. I'd only like to see traffic that is destined for the internet, i.e., no network stuff that is ...
2
votes
1
answer
519
views
Forwarding wifi traffic to wired pc
I'm trying to play around with Wireshark on my home network, and was wondering if there is a way to create a new connection on my PC that receives all wifi packets on the network. The PC is a wired ...
1
vote
0
answers
481
views
Booting with nfs just prints some weird character
Problem
I have an embedded system which I am unable to boot via NFS using an Embedded Linux Kernel Image and rootfs both placed on my laptop (which serves as the NFS server as well as a TFTP server)...
5
votes
4
answers
17k
views
promiscuous mode with Intel Centrino Advanced-N 6200 AGN wireless card
I'm trying to solve this problem for a long time, googling, reading and trying with no help.
I have laptop with Intel Centrino Advanced-N 6200 AGN wireless card which suppose to support promiscuous ...
3
votes
1
answer
175
views
Interactive network sniffing
I'm looking for what essentially amounts to an "interactive" Wireshark.
I am looking for a tool that allows me to view network traffic on a given port and allow/deny/modify traffic on a per-packet ...
2
votes
3
answers
6k
views
Finding the external (PPPoE, WAN) MAC address of an ADSL router
My ISP is Orange Internet, I have recently ditched my crummy "livebox" and moved to a more stable BT Business Hub with the firmware flashed back to the original SingTel ROM. The thing works great ...
2
votes
1
answer
1k
views
Excessive "name query" and "standard query" activity on Wireshark?
I started using Wireshark on some class at university and decided to look at my home wireless network with it, just out of curiosity. But now I'm noticing excessive activity to what it looks like a ...