Questions tagged [wireshark]

For questions about Wireshark, a packet analyzer

Filter by
Sorted by
Tagged with
0
votes
1answer
49 views

why doesn't WireShark show any traffic from invalid certificate https site? [closed]

i have tried mobile apps like HttpCanary and pc programs like wireshark still got nothing from the site !!
0
votes
1answer
49 views

TCP sequence numbers in Actual Transmission vs. in Wireshark Capture

Whenever, we do a wireshark capture and Follow--> TCP Stream, we see the sequence numbers as fixed values. In reality, if this were the case, the intruder can easily predict the transmission patterns....
1
vote
2answers
80 views

How to measure max bandwidth with Wireshark?

I'm trying to measure the max bandwidth usage of my LAN with Wireshark. I´ve done several packet captures but I don't know how to obtain the max bandwidth usage. Any Idea? Thank you in advance
0
votes
1answer
62 views

Weird Wireshark protocol list (eth:ethertype:ip:data where is the “udp”?)

I am capturing incoming and outgoing WAN to LAN data at a particular host on my LAN (i.e., the one actually receiving/sending the data). Sometimes I get anomalous captured frames that are missing the ...
0
votes
0answers
25 views

unable to capture http request on loopback using wireshark

I am running apache2 webserver on my machine. When I try to access a webpage locally through a webbrowser as locahost/index.html then i dont see any packets having protocol http in the capture ...
1
vote
0answers
44 views

Is this wireshark capture showing any issue?

I used Wireshark to capture the packets bellow: ... 350 18.942762436 d0:07:ca:0b:63:0c -> Broadcast ARP 60 Who has 13.210.32.75? Tell 13.210.32.78 351 18.947224197 d0:07:ca:0b:63:0c -> ...
0
votes
1answer
38 views

Wireshark captures TCP packet with no flag [closed]

In our network, I captured a TCP packet by Wireshark that has no flag set. What's that mean? Is it normal?
0
votes
0answers
25 views

Wireshark logging same error on client and server

I did some testing in Socket Programming with JAVA and analyzed my traffic with wireshark. SetUp: 1 Server running a new ServerSocket(PORT) and 1 Client running a new Socket(IP, PORT). Server and ...
1
vote
0answers
19 views

Hide/replace certain source and destination IP in Wireshark packet table

For demonstration purposes I need to show Wireshark packet table, but I need to hide some of the IP's there, like show 10.0.0.1 instead of 192.168.1.19. Very old threads suggest using Linux-only tools ...
1
vote
0answers
34 views

Why do I not see slow start in this TCP packet capture?

I am looking at the packet flow between a server and a client (which is downloading a file from the server). As you can see in the packet capture below (with IP addresses omitted), after the initial ...
0
votes
0answers
24 views

What do the multiple occurencies mean in a packet trace file?

I have a trace file and I used tshark to find out the number of duplicate ACKs, with the following command: tshark -r file.pcap -T fields -e frame.number -e tcp.analysis.duplicate_ack After some ...
1
vote
1answer
121 views

No DHCPOFFER message captured in Wireshark

I am looking for the answer why packet captures in Wireshark doesn't contain DHCP offer message. I was trying to capture packets directly on the computer with installed Wireshark and doing a SPAN ...
3
votes
1answer
85 views

IPv6 Wireshark filter for partial IP address

I would like to create a display filter with the last 4 octets of an IPv6 address. Basically, I have the mac address with me and I want to filter for the IP address xxxx:xxxx:xxxx:xxxx:113:5005:80:...
0
votes
0answers
50 views

Wireshark switch ping

I understand that a switch will broadcast to all ports if it doesn't have the destined destination in its mac address table but when I analysed a scenario in wireshark I got confused at what happened. ...
0
votes
1answer
57 views

Wireshark remote hosts

I configured a rip network. I connected two PCS to router 1, router 1 is connected to router 2 and PC 3 is connected to router 2. When I pinged PC 3 and looked at this in wireshark, in the source it ...
1
vote
1answer
48 views

switch wireshark arp

I connected 4 pcs to a switch, I used pc 1 to ping another pc(pc 3) and used wireshark on all the pc's. The one that sent the ping sent out an arp request and received 4 request and replies from the ...
0
votes
1answer
90 views

How to plot and benchmark UDP response time?

Our application uses UDP protocol in the transport layer. I'm currently filtering the packet trace with the port and then manually checking the RTT by selecting the packet stream and by using " Set ...
1
vote
0answers
190 views

Modifying linux ping icmp payload [closed]

On analyzing ping request and reply from a windows system to Linux. It was observed that the windows ping request payload was "abcdefghijklmnopqrstuvwabcdefghi" with size 32 bytes Could this ...
0
votes
0answers
44 views

What is the Acknowledgement number in connection synchronisation between client and server?

I came across this article in an attempt to understand sequence and acknowledgment numbers better. Here is the excerpt: Connection set-up uses the SYN flags. They are not used except for ...
7
votes
2answers
2k views

Why does Wireshark show Version TLS 1.2 here instead of TLS 1.3?

I'm accessing TLS 1.3 test server "https://tls13.pinterjann.is" via a java http client using TLS 1.3. Everything seems to work fine as the html response indicates: What I don't understand: Why does ...
0
votes
1answer
376 views

TCP Window Scaling on Wireshark

i am new to Wireshark and want to find the window scaling, which is the size of the received windows if i am not mistaken. I have a dump file of some 110mb that i use for my graphs. This is the ...
2
votes
1answer
55 views

IPV6 ping, the pinged address is different from the once caught by wireshark

I'm trying to ping an ECU, both PC and ECU have static IPV6 address the problem is that the target address (ECU) pinged is different from the one caught by Wireshark subnet : 64 ping command $ ...
1
vote
0answers
24 views

Remote monitoring using a non root user account with Sudo Privilege [closed]

I want to remotely take tcpdump on my server with a non root user account? I tried it but doesnt seems to be working? Can someone guide me on this? plink.exe -ssh -pw abc123 iamuser@192.168.1.1 "sudo ...
3
votes
1answer
340 views

How can a UDP Client and a packet sniffer run on the same machine?

In my understanding, if you have a UDP socket client that is bound to a particular port, then a second UDP client on the same machine can't bind to the same port. If this is the case, then how can a ...
2
votes
2answers
234 views

tcp connection and stream flow question

Could anyone explain the main principe of tcp flow when making a session ? I have take a tcp dump when i'm trying to browse a site. when I analyse the packet by wireshark, i have found many Three way ...
1
vote
1answer
29 views

Where I can find frame specification?

When I capture from wireshark traffic I can see data like this Where I can see the specification of each field? When I read wiki https://en.wikipedia.org/wiki/Ethernet_frame there is nothing like ...
2
votes
2answers
508 views

Calculating the throughput of a given TCP connection

Given a TCP session, is there a way to determine the throughput of the sender? I have a wireshark sniff, and I see that to calculate the throughput of the sender I can use the TCP-Window-Size-in-bits /...
0
votes
1answer
154 views

How to differentiate whether Data or QUIC protocol frame follows UDP header? [duplicate]

I am using Wireshark to analyze network traffic and I need to programmatically differentiate whether Data or QUIC protocol frame follows UDP header. So far, every packet which has source or ...
0
votes
1answer
147 views

Wireshark udp checksum errorI

I sniffing udp communication with 2 instance of wireshark , 1: 2.0.0 2: 2.2.1 . In version 2.0.0 I get valid udp.checksum , but with 2.2.1 I always get udp checksum = 0000 . Why is that? those ...
1
vote
1answer
236 views

How to filter a wireshark capture (pcapng) by source and destination IPv4 address

I have a bunch of wireshark captures I need to mine data from. Tshark seems to fit the bill but this doesn't support filtering (-f) by the look of it, I simply get: Using: tshark -x -r Run18....
2
votes
1answer
628 views

What does a “Frame” relate to in the WIreshark packet details pane?

Currently learning to use Wireshark. When I take a capture and click on one of it's rows, I see the following breakdown in the "Packet Details" pane: Frame Linux Cooked Capture Internet Protocol ...
0
votes
1answer
200 views

ARP requests from outside the network [closed]

I need help understanding an ARP Storm PCAP I'm currently studying. My understating is that routers will strip layer 2 info. Therefore, an ARP request frame will not go through a layer 3 device (...
1
vote
1answer
509 views

How to capture ARP Reply packet from all hosts in the network?

How can I capture ARP reply packets from all hosts that are connected in the network? I've tried wireshark premicious mode but it only capture ARP replies from gateway.
3
votes
2answers
125 views

Which tcpdump metrics reveal server connectivity problems vs client problems?

I am attempting to diagnose a ~45 sec drop (to 0 Kbps) in the reported RTMP streaming bitrate in OBS while publishing a live stream. I had been running a tcpdump the entire time using Apple's ...
0
votes
2answers
211 views

How can i monitor ARP packet on WiFi network?

I want to monitor packet in my network. It said that ARP packet request broadcasted all over network. But why i only see my arp request packet and reply packet to the gateway?
2
votes
1answer
113 views

How to emuate simple (telnet-like) network protocol with netcat or similar

I have a barcode sensor (Keyence SR-2000) which is able to talk a simple plaintext-based protocol. I could talk to it with the provided (windows-only) app called AutoID Terminal and ontained wireshark ...
1
vote
3answers
100 views

Can Ethernet II frame's Type be Layer1's or Layer4's protocol?

The Ethernet II frame's Type field can be IPv4, ARP, so it can be Layer2 and Layer3's protocol. This is a snapshot of frame captured by WireShark. But I have a question, whether it can be other ...
1
vote
1answer
28 views

Does the frame package, all are represent as hex data?

I use Wireshark for capturing packages, get many frames. You see the left light blue background space, all are hex data, and right are converted words we can identify. I mean whether the frame ...
1
vote
2answers
57 views

What kind packets of the Wireshark capture's package?

We know we can use Wireshark for capture packets, we know Wireshark is based on the network interface adapter. This is a list of packets captured by Wireshark: Is Wireshark based on the network ...
1
vote
1answer
369 views

Filter pcap file by layer and save to another format [closed]

I captured packets in wireshark, filtered for the protocol I'm interested in (DIS), then exported this to a pcap file. I'd like to do analysis on this data in Python. The only part I'm interested in ...
2
votes
2answers
664 views

What are the differences between TCP iRTT and ICMP Ping?

I’m attempting to estimate latency between my PC and any servers/clients it interacts with. I don’t want to use Ping for various reasons (requires both ends to allow it, would require additional ...
0
votes
2answers
1k views

How to determine whether files are downloaded serially or in parallel using Wireshark?

In the http-ethereal-trace provided in the link below there are three HTTP GET request.The 2nd and 3rd request downloads a GIF and JPG format image recpectively.How can we determine wether the two ...
2
votes
1answer
188 views

how to get RSSI information of WiFi users in wireshark?

If I'm able to get 802.11n traffic with my network adapter, would I be able to see the RSSI information? what should be the filter to see it?
1
vote
0answers
79 views

What is an SSL debug file

What is an SSL debug file in wireshark? I am following the below tutorial and I am stuck at step 4 of this set of Citrix Netscaler instructions
3
votes
3answers
87 views

How does any program identify the protocol header next from TCP?

I need to know how does wireshark or any other program knows the protocol next from TCP. I mean, for instance: The Ethernet layer has a field named Type which carry the IPv04 The Internet protocol ...
1
vote
2answers
205 views

Wireshark expression filters for wireless capture

1) What Wireshark expression filter stack can I utilize to discover how many devices are transmitting in the 2GHz and 5GHz spectrum in a packet capture? 2) What Wireshark expression filter stack can ...
2
votes
1answer
246 views

Why would my router send an ARP request about a device that's already listed in its ARP cache?

I checked my Ubiquiti EdgeRouterX's ARP table and my laptop IP and MAC address were there. I then checked the DHCP lease and my laptop's IP address doesn't expire until tomorrow. I then ran ...
1
vote
1answer
309 views

Wireshark capture only TCP packets with the RST flag set

I'm quite new to networking and I got stuck while reading "Practical Packet Analysis: Using Wireshark to Solve...". On page 61 it is written: A common scenario is to capture only TCP packets ...
3
votes
3answers
279 views

How to tell which one is the source IP and MAC address of the data being received?

I have to work with an FPGA module already running a code written by someone else. I have no access to the FPGA code. Now the setup is something like this:- FPGA is connected to the pc via ethernet ...
0
votes
1answer
341 views

Wireshark capture on LoopBack interface [closed]

We have two applications running on same machine, both of them are listening on the loopback interface on two different ports. Client Application is sending data to server, but receiving Application ...