3

I have been learning ICND1 through CBTNuggets.com course online, I have recently started a video where the instructor is guiding on how to use Wireshark to trace the communication.

He first used DNS to show how User Datagram Protocol is shown in the Wireshark when i do nslookup of any website.

then he started the Wire Shark Capture and visited a website CBTNuggets.com and suddenly his Wireshark window started to show protocols like TCP, HTTP etc.

But when I tried the same process, and visited google.com or any other website while my Wireshark capture is on, All i could see is SSDP protocol in my wireshark window.

I know the difference between UDP and TCP, and that TCP is a reliable communication and HTTP is TCP based protocol.

But why my Wireshark is not showing any TCP protocol when I visit any website ?

P.S: I am use Wireless Network Device

enter image description here

Improve this question

3 Answers 3

Reset to default
4

Clear the expression ip.addr==192.168.0.1 filter. This is probably whats filtering out what you want to see. You can tell by the very first column in WireShark, Look at the No. jumps at DNS No.94 to SSDP No. 680 --- So about 500 entries you arent seeing. You can also turn off the ssdp discovery service in windows to eliminate that ssdp mess.

Improve this answer
1
  • 1
    As user3150 mentioned, you have a Display Filter that tells Wireshark that you only want to see IP packets which have 192.168.0.1 either Source or Destination IP (ip.addr match source OR destination) In this case it seems to be displaying packets only to and from the network's router, not your PC
    – Remi Letourneau
    Jun 18, 2014 at 16:34
1

SSDP is the Simple Service Discovery Protocol. As that Wikipedia article says, it is "a text-based protocol based on HTTPU" and "uses the User Datagram Protocol (UDP) as the underlying transport protocol."

So, yes, it's an HTTP-based protocol, and, yes, it runs atop UDP rather than TCP.

But it's not what's used for normal Web site access. That traffic will be shown by Wireshark as "HTTP", not "SSDP", and will run over TCP, if it's not "secure HTTP" ("https") traffic. If it's "secure HTTP", it'll show as "SSL" (Secure Sockets Layer, although the current versions of that protocol are called Transport Layer Security, or TLS), and won't show up as HTTP unless Wireshark can decrypt it.

And your display filter "ip.addr == 192.168.0.1" will show that traffic only if it's HTTP traffic to or from 192.168.0.1; if that's not the address of the machine on which you're running Wireshark, and not the address of the site to which you're browsing, the traffic between your machine and that site will not have 192.168.0.1 as an IP address (not even if the traffic is being routed through 192.168.0.1) and thus won't be matched by that filter.

Improve this answer
1

To answer your question as to why your Wireshark is not showing any TCP protocol when you visit any website is because of your enabled filter "ip.addr==192.168.0.1". Your wireshark capture is all about your transaction with "ip.addr==192.168.0.1" which I believe is your gateway.

Your initial capture clearly shows that your device is looking for a DNS server as it needs to translate as to what is the IP address of "twitter.com".

Once your machine couldn't find a DNS server, it goes on to search for devices that offer DNS services thus SSDP was triggered. SSDP is expertly defined by user2373 above.

Therefore, the reason why you cannot see any TCP or HTTP packets is because your filter captures your machine looking for a DNS service.

Hope this helps.

Improve this answer

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.