Last call to make your voice heard! Our 2022 Developer Survey closes in less than a week. Take survey.

Questions tagged [wireshark]

For questions about Wireshark, a packet analyzer

Filter by
Sorted by
Tagged with
0 votes
1 answer
22 views

Determine network traffic on a switch port in bit/s from Wireshark

I am trying to understand how much data is flowing through a specific port on a Cisco (Stratix) switch. I have set up Port Mirroring so that I can capture the traffic on the target port via Wireshark. ...
user avatar
0 votes
1 answer
16 views

Despite pinging 172.16.0.2, the packet is asking for destination address 255.255.0.0? (Who has 255.255.0.0 Tell 192.168.0.2) [closed]

I have a GNS3 lab with two subnets. Subnet 1 is 192.168.0.0/16 and 172.16.0.0/16. There is a MikroTik router. On subnet 1, there is a PC with the IP 192.168.0.2 connected to the router's port 0. On ...
user avatar
  • 3
0 votes
1 answer
35 views

How does wireshark calculate the TCP length when there is no header indiciating such?

In wireshark, you have this field: [TCP Segment Len: 1380] # How is this calculated? My assumption is using the IP headers plus TCP's. TCP Segment Len = IP Total Length - IHL - TCP Header Length In ...
user avatar
  • 3
2 votes
2 answers
55 views

Loops in routers-same packet?

Considering a loop topology between a few routers with a host connected to one of them, when it's default routing directs to the cycle. Even when observing Wireshark, how can we know its the same ...
user avatar
0 votes
1 answer
42 views

Network packet loss and connection drop every hour [closed]

We experience a significant amount of retransmissions, duplicated ACKs and previous segment not captured when using our proprietary client/server application deployed in our client's network. A ...
user avatar
0 votes
1 answer
41 views

Wireshark: Cannot find frame type of packets

I am getting used to Wireshark operation and currently, I am investigating different frames (control, management, data frame) and using filter in these links (https://mrncciew.com/2014/10/02/cwap-802-...
user avatar
0 votes
1 answer
33 views

How to include in the filter http requests satisfying the given condition and the respective responses?

For example, I want to see all the http requests containing the given string in the http.host field and their respective responses. Right now my filter is frame.number < 61403 and http.host ...
user avatar
  • 101
0 votes
1 answer
39 views

What does this Wireshark capture filter do

I was reading through a guide where I saw the following Wireshark capture filter used. (tcp[2:2] > 1500 and tcp[2:2] < 1550) I had a brief look over Wireshark's website which listed their ...
user avatar
0 votes
0 answers
8 views

ARP Header's Mac Address set to 0 when broadcasting [duplicate]

I'm learning about Ethernet frames and networks and Wireshark has been very useful. I have a doubt regarding broadcasting and ARP request, since we don't know the Target MAC address, in the ARP's ...
user avatar
0 votes
1 answer
31 views

Wireshark on ProCurve 1810G - IEEE802a protocol

I have recently started a networking course and acquired an old HP ProCurve 1810G-24 Switch to play about with, which I have updated to the latest firmware. I'm using Wireshark to monitor the traffic, ...
user avatar
0 votes
1 answer
52 views

Wireshark -Protocol Hierarchy Omitting large amount of subprotocol traffic

Based on responses, I've repositioned this question to ask why the subprotocols under my TCP header are not accounting for the sum of packet transfer. (I.E TCP= 97.1%, remainder of packet content not ...
user avatar
  • 1
0 votes
1 answer
95 views

Probe Request getting\understanding Information Elements (IEs)

I'm trying to read Information Elements (IEs) from the probe request can't seem to understand the stracture of it as I undersatnd it size can be 0-2312 bytes but how do I know how many there are? I ...
user avatar
3 votes
1 answer
89 views

Wireshark Decrypting IKEv1 Text PSK to Hex

I'm trying to debug a Cisco VPN setup as part of a Uni Lab (so please don't worry about posting of keys etc. it's just a toy setup with no internet facing connection). I want to decrypt the IKEv1 ...
user avatar
  • 121
0 votes
1 answer
62 views

Unwanted Wireshark Optimizing Received 802.11 Channel for Frames

I am trying to run an experiment which involves monitoring 3 wireless channels simultaneously in Wireshark which would allow me to see a single frame captured 3 times on each channel. To do this, I ...
user avatar
0 votes
0 answers
176 views

How to prevent wireshark translating macsec protocol into the original protocol

I am trying macsec between computers. Currently, the encryption mode is disabled, the state of the exchanges is categorized as "protected" by macsec. I got a Wireshark capture from ubuntu to ...
user avatar
  • 11
0 votes
0 answers
14 views

Some random client requests fails with unexpected TCP [RST] packets [duplicate]

I have a service doing listen that serves clients over a TCP sockets connection with a raw binary protocol. The principle is basic: the connection is established, the client sends a request with data, ...
user avatar
  • 1
1 vote
1 answer
39 views

what are scenario where re-transmission packets can been seen in wireshark logs

While troubleshooting i came across this challenge ,able to see retransmission packets continuously in packet capture . please let me know in what scenarios this retransmission packets are seen.
user avatar
0 votes
1 answer
62 views

Homeplug av frame

I want to check differences between a frame sent by a pc connected to an homeplug and one pc connected directly with the gateway/router. When i sniff packets i cannot see any differences in the frame, ...
user avatar
0 votes
2 answers
122 views

Detecting Ethernet over power by packets

If someone plugs an Ethernet over power (EOP, Homeplug) into the switch and then connect elsewhere in the building, can I detect this device by sniffing the packets with tools like Wireshark or ...
user avatar
0 votes
1 answer
74 views

Wireshark, Bluetooth interface, identify errors in frames/re-transmissions

I'm using WireShark on Ubuntu 20.04.1 LTS. I listen to bluetooth0 interface while transferring a file from my laptop to my smartphone over Bluetooth(using Blueman). Without any transfer, I get packets ...
user avatar
0 votes
1 answer
184 views

Wireshark display filter to hide Protocol = 802.11?

[Note: reposted here from SO...] I've set Wireshark's capture filter set to capture only packets from the MAC address of interest, but the result is dominated by zillions of packets whose Protocol is &...
user avatar
1 vote
1 answer
203 views

Suspicious flood of ARP requests [closed]

I'm trying to review a Wireshark capture and it seems the network is heavily flooded with ARP requests that make no sense to me. The destination is not "Broadcast", but some unknown DELL ...
user avatar
  • 11
0 votes
0 answers
42 views

Man in the middle legitimate packet inspection

we're trying to debug a faulty Panasonic Mobile softphone SIP app (both Android & Apple versions), as many calls are randomly dropped unexpectedly. This is the conceptual connection diagram: We ...
user avatar
  • 161
1 vote
1 answer
1k views

How do I set a display filter in wireshark that sorts by destination broadcast?

1 0.000000 Vmware_90:07:7b Broadcast ARP 60 Who has 192.168.185.144? Tell 192.168.185.7 27 0.995837 28.144.7.123 192.168.185.144 HTTP 1177 HTTP/1.1 200 OK (...
user avatar
0 votes
1 answer
266 views

Capture traffic flowing through a Brocade switch remotely

I am currently doing packet capture through mirroring with Wireshark as mentioned in this post I can mirror the traffic to a port physically jacked into and analyze the packets redirected there w/ ...
user avatar
0 votes
3 answers
8k views

how to capture DHCP packets in wireshark

Hy! I want to capture DHCP packets in Wireshark but I did not receive any. Not my filter wrong, I don't get any. So I think I can't trigger the DHCP communications. my filters: dhcp bootp udp.port == ...
user avatar
2 votes
1 answer
286 views

IPv4 and UDP/TCP packets inside of ICMP packet?

A week ago, after opening wireshark, i was surprised by seing a storm of ICMP packets from different IP addresses. While deep analysing of thoses packets, i noticed that those ICMP packets contains ...
user avatar
  • 23
0 votes
1 answer
49 views

When I send the ICMP packet with 4000B, but the IPv4 segment calculated 4008B

When I send the ICMP packet with data size as 4000B for testing the IP fragment. ping 192.168.2.1 -c1 -s4000 and the Wireshark captured it, Whether is is because of ICMP header? but we know ICMP ...
user avatar
  • 1,737
0 votes
2 answers
1k views

What's the Destination unreachable ICMP packet(ICMP payload the UDP) usage? [closed]

In my Mac(192.168.2.228), it will send ICMP packet to my house's router (192.168.2.1). with the info Destination unreachable (Port unreachable) and in the Wireshark packet detail panel, there ...
user avatar
  • 1,737
1 vote
1 answer
2k views

What is the difference between tshark, dumpcap and others for collecting/sniffing traffic?

Wireshark provides tshark and dumpcap, and I've also seen people using the wireshark binary or even tcpdump to collect/save network traffic. Online it is claimed that tshark or dumpcap hardly make a ...
user avatar
  • 113
1 vote
1 answer
410 views

Why the different colours for SACK markers in Wireshark's tcptrace graph?

Wireshark's tcptrace time sequence graph shows a good deal of information, but I cannot find a document that spells out exactly what it all means. It's broadly similar to the original tcptrace except ...
user avatar
0 votes
1 answer
140 views

What type of attack could this be ? (Wireshark pcap) [closed]

If I understand it correctly the "client" sent an unencrypted password to the pop3 server consisting of a long string of As. Is this a type of attack and if yes, how does it work?
user avatar
0 votes
1 answer
416 views

how to send a number of TCP packets and capture only those packets using tshark?

I'm using iperf3 to send 1005 TCP packets with the commands: iperf3 -s -i 1 -f m -p 5200 -D iperf3 -c 10.60.0.113 -k 1005 -bitrate 0 --reverse --omit 2 -p 5200 In server, client respectively. The ...
user avatar
  • 121
1 vote
1 answer
299 views

Capturing dot1q packets with Wireshark on a PC

I have spent the last few hours trying to capture some trunk packets so I can see and examine the dot1q VLAN field. I have tried mirroring the trunk port to my PC using the following commands on Cisco ...
user avatar
1 vote
1 answer
102 views

How do I interpret this Wireshark log file?

I'm new to using Wireshark and I'd like some help with analyzing the log shown in the image. I also ran a nmap scan of the ports on my computer, but I'm not able to identify which of these lines are ...
user avatar
  • 11
0 votes
1 answer
28 views

re transmission happened before receiving Three ACKs packets

In the following wireshark trace, the packet with seq=41030 was sent, after some time the packet before it got acknowledged. after that a retransmission happened the packet seq=41030, then 3 ACKs ...
user avatar
0 votes
1 answer
665 views

How do I use the wireshark I/O graph to plot the value of an arbitrary bit in the data layer?

I have a number of UDP packets that are using a protocol that is not implemented in wireshark. I would like to use the I/O graph to plot the value of the data packet byte at index 3. Is this possible? ...
user avatar
1 vote
1 answer
2k views

what's the difference between trailer and padding field in ethernet frame captured by wireshark?

The Ethernet minimum length should be 64 Bytes, so when the data is less than 46B, there would be some extra bytes padding to the end of data, make sure the frame size up to 64B. When I capture the ...
user avatar
  • 13
0 votes
1 answer
63 views

Capture and display filters in wireshark (limit destination IP)?

In Wireshark I can successfully create this display filter that will only show traffic going to x.x.x.x ip.dst==x.x.x.x But how do I create a corresponding capture filter? E.g. if I remove all ...
user avatar
  • 111
0 votes
0 answers
52 views

Wireshark packet read starting from a custom protocol

Pardon the badly-framed question title, I am struggling with it but could not find the best way to frame it. I have a program in which I use libpcap for dumping packets at various points in the ...
user avatar
-1 votes
1 answer
35 views

What is the packet protocol used for communicating switch configuration changes over the network? [closed]

I am trying to isolate the packets used to communicate a switch's configuration changes. More specifically, whenever I use the online tool on my laptop and configure the switch (and hit save) I want ...
user avatar
0 votes
1 answer
71 views

Wireshark filter to display al packets which have traveled through switch

I am trying to filter my packets based on whether or not they went through specific switch. This router has the ip address of 192.168.1.235. Is their a way to do this using Wireshark filters?
user avatar
0 votes
0 answers
39 views

How to analyze traffic made by device on local Wifi network

I have a device (Air quality sensor) that is sending data to a preconfigured server. I would like to access the data that is being sent. Device connects to local Wifi (WPA Secured) and presumably ...
user avatar
  • 101
1 vote
1 answer
47 views

Can you gather only a summary of network traffic via Wireshark (or similar)?

Something on my network is using an enormous amount of data and I need to track it down. Its not constant or predictable. I have had a go with Wireshark and I am sure that it could tell me what I ...
user avatar
  • 113
2 votes
1 answer
312 views

Wireshark not showing Frequency/Channel

I am using Ubuntu 18, and wireshark-gtk. I followed this and this tutorials to create a column named/showing frequency/channel. But all the packets I captured have no frequency/channel showing.I tried ...
user avatar
0 votes
0 answers
24 views

Import Embedded Packet Capture output into Wireshark

I did packet capturing with cisco's Embedded Packet Capture and I would like to view the output in Wireshark. The problem is that I only have CLI access to the device, so exporting via TFTP is not an ...
user avatar
  • 383
0 votes
1 answer
931 views

Filtering out abnormal connection termination packets in wireshark

I am trying to find out a way to filter out packets specifying abnormal connection termination in wireshark. I mean is there any tcp.connection.terminated filter in wireshark??
user avatar
1 vote
1 answer
63 views

Meaning of A and B in Wireshark Conversation View

In Wireshark's conversation view, do A and B map to source and destination?
user avatar
  • 113
1 vote
0 answers
380 views

ICMP No Reply Found Issue [closed]

Currently working on a Go based NAT router and when translating ICMP traffic and am seeing some interesting behavior. The clients request is forwarded to the server, the server keeps track of the ...
user avatar
0 votes
3 answers
402 views

Analyzing TCP connection by running Wireshark in two endpoint

I am trying to find the number of lost packets in the network. I have 2 devices say DeviceA and DeviceB. IP addresses are respectively DeviceA : 192.168.0.104 and DeviceB: 192.168.0.105. In order ...
user avatar
  • 111

1
2 3 4 5 6