49

The file is actually /usr/share/doc/wireshark-common/README.Debian. What you need to do is: sudo dpkg-reconfigure wireshark-common Choose the "yes" option. usermod -a -G wireshark your-user-name Logout and log back in to pick up the new group membership and you can now run wireshark as a non-root user.


34

In the filter field, type http (lowercase!). Tested with WireShark Portable 1.10.7 Some basic filters !http shows all traffic which is NOT http ip.src != 196.168.1.1 shows traffic which is NOT from this IP source ip.dst == 196.168.1.1 shows traffic to this IP destination ip.addr == 196.168.1.1 shows all traffic which has the specific IP as source OR ...


21

If you are trying to this on a Windows computer, unfortunately it is not possible out of the box. You will need to install some additional software that will capture data on the loopback interface. On a Linux computer, you will need to capture from the loopback interface which is lo most of the time. Most other Unix operating systems use lo0.


15

Akamai run a content distributions system used by major websites to provide fast web response on a global scale. Port 443 is used for HTTPS - the encrypted version of HTTP web-page access. It is quite normal to see a lot of traffic directed through Akamai. At the time this question was asked, Apple used Akamai as their primary content delivery network. ...


12

A USB URB is like an IP packet and a USB endpoint is like an IP port. USB endpoints 0x00-0x7F are on the host, and the endpoints 0x80-0xFF are on the device (I think). Therefore, the endpoint encodes the direction of the transfer. lsusb will show you what endpoints and which transfer types a device supports. I'll use "packets" in quotes to mean the unit of ...


11

ssl.handshake.extensions_server_name


11

step1: goto Resource Monitor Then press on the network TAB Is that what you're looking for?


9

The new approach is to use brew install wireshark --with-qt. The --with-x option no longer works. More details on the switch to QT: https://blog.wireshark.org/2013/10/switching-to-qt/


9

Shawn E's answer is probably the correct answer but my wireshark version doesnt have that filter. Following filters do exists, however: To check if the SNI field exists: ssl.handshake.extension.type == 0 or ssl.handshake.extension.type == "server_name" To check if an extension contains certain domain: ssl.handshake.extension.data contains "twitter.com"


9

The SSL protocol (SSLv2 and SSLv3) hasn't been in use for several years, having been superseded by TLSv1. While some programs still start with SSLv2-compatible handshakes or occassionally use the SSLv2-style record format, they all generally use TLS nowadays and the Wireshark configuration page has been renamed accordingly. The display filter is tls. (Yes, ...


8

Sounds like you're using telnet when you should be using ssh. I'm not sure if ssh is supported by router. It may not be if it is running an old IOS version. You could also try logging into the serial console directly and disabling telnet access entirely by commenting out any vty lines in your running configuration.


8

It turns out I can actually just use tail for this. It isn't ideal since it's probably looking for \n in the data before outputting, but there is enough data in packet captures to make this work it seems. Here's what I did: Install UnixUtilities to get a port of tail for Win32. Install RawCap Install Wireshark rawcap -f 127.0.0.1 localhost.pcap tail -c +1 ...


8

As per the official Wireshark wiki page: By default Wireshark and TShark will keep track of all TCP sessions and convert all Sequence Numbers (SEQ numbers) and Acknowledge Numbers (ACK Numbers) into relative numbers. This means that instead of displaying the real/absolute SEQ and ACK numbers in the display, Wireshark will display a SEQ and ACK ...


8

These are multicast packets, in particular Simple Service Discovery Protocol (SSDP) and Multicast Domain Name Service (MDNS) packets that are used for configurationless discovery in one single LAN or WLAN segment. Your home router broadcasts these to all devices, including your PC. So it's perfectly normal that you see those, this is as it should be. Edit ...


7

The process id doesn't make it onto the stream that Wireshark is reading. Netmon is better suited for this task on Windows.


7

Re-install XQuartz 2.7.4 (the latest version as of this writing). I saw the same problem. I already had XQuartz 2.7.4 installed and working with Wireshark before I installed Mavericks. After installing Mavericks and trying to launch Wireshark, I got the same dialog you did. Re-installing XQuartz 2.7.4 solved the problem for me.


7

Capture filters cannot do what you want. Display filters however, can. Using the HTTP filters, you can do this: http.host == "example.com".


7

What does a sequence of retransmissions with PSH,ACK flags mean (and a spurious retransmission back)? What is usually the cause of such behaviour? (if there is a "usual" cause). PSH ACK Wireshark Trace (Also See ServerFault - PHA ACK During My Connection) ACK means that the machine sending the packet with ACK is acknowledging data that it ...


6

Yes, you just need to add another capability to the dumpcap utility. CAP_DAC_OVERRIDE gives the ability to override permission checks on files, and allows dumpcap to access the files necessary for the USB capture. It's not a beautiful solution, but it's far better than running the entire Wireshark as root. Since you've already done most of the work, you just ...


6

To keep this current, as hsluoyz said, install npcap http://wiki.wireshark.org/CaptureSetup/Loopback When installed on Windows Vista or later (including Win7, Win8 and Win10) with option "Support loopback traffic ("Npcap Loopback Adapter" will be created)" selected, it will create an Npcap Loopback Adapter that can be selected in Wireshark so as to ...


6

I solved this by creating a group for the users which should be able to use usbmon and then let udev change the ownership of the device. So just create a group, add your user to the group and place a udev rule into "/etc/udev/rules.d": addgroup usbmon gpasswd -a $USER usbmon echo 'SUBSYSTEM=="usbmon", GROUP="usbmon", MODE="640"' > /etc/udev/rules.d/99-...


6

Presumably you have a NATted network, so your errant user appears to your email host as the same address as all your users. The solution depends very much on the topology of the network. The best bet is to find the switch that's connected to your external connection (but before the NAT takes place), configure a mirror port, connect a computer to that port ...


6

I had this same error with version 2.2.5, I ended up completely removing wireshark sudo apt-get remove wireshark I then reinstall the qt version which seemed to fix it, though I am not sure why sudo apt-get install wireshark-qt I think it is something in the current version that is messing things up, but I cannot say for certain


6

It really is about monitor mode. Read on. 802.11 was designed to be "wireless Ethernet", and 802.11 interfaces have traditionally presented themselves to the OS as Ethernet interfaces so the OS only sees the packets after they've been translated back into familiar Ethernet II or 802.3 frames. This was necessary to make 802.11 work without requiring OSes to ...


5

It is possible to capture all network traffic for a given application by intercepting Windows Sockets API calls. These are the tools that may help. Proxocket written by Luigi Auriemma. It intercepts API calls and saves captured traffic as Wireshark-ready .cap file in tcpdump format. Nothing is more explanatory than an image provided by Luigi himself: ...


5

In fact you can! All previous answers were very close. All you need is -O flag which filters out all the information but HTTP. tshark -O http -R http.request tcp port 80 or tcp port 443


5

Although you found the answer before I could respond, you can also use Socket Sniffer, which looks at Winsock calls and monitors network sockets; the download link is at the bottom of the page.


Only top voted, non community-wiki answers of a minimum length are eligible