Questions tagged [wireshark]

For questions about Wireshark, a packet analyzer

Filter by
Sorted by
Tagged with
0
votes
0answers
28 views

Throughput oscillating in speedtest with iPerf3 [closed]

I have to test my network speed using iPerf3. I'm using a Virtual Machine running Ubuntu 18.04 connected to a smartphone through WiFi. I'm using HE.NET on my smartphone, which allows me to run an ...
0
votes
1answer
36 views

How do I interpret this Wireshark log file?

I'm new to using Wireshark and I'd like some help with analyzing the log shown in the image. I also ran a nmap scan of the ports on my computer, but I'm not able to identify which of these lines are ...
0
votes
1answer
22 views

re transmission happened before receiving Three ACKs packets

In the following wireshark trace, the packet with seq=41030 was sent, after some time the packet before it got acknowledged. after that a retransmission happened the packet seq=41030, then 3 ACKs ...
0
votes
1answer
23 views

How do I use the wireshark I/O graph to plot the value of an arbitrary bit in the data layer?

I have a number of UDP packets that are using a protocol that is not implemented in wireshark. I would like to use the I/O graph to plot the value of the data packet byte at index 3. Is this possible? ...
1
vote
1answer
61 views

what's the difference between trailer and padding field in ethernet frame captured by wireshark?

The Ethernet minimum length should be 64 Bytes, so when the data is less than 46B, there would be some extra bytes padding to the end of data, make sure the frame size up to 64B. When I capture the ...
0
votes
1answer
26 views

Capture and display filters in wireshark (limit destination IP)?

In Wireshark I can successfully create this display filter that will only show traffic going to x.x.x.x ip.dst==x.x.x.x But how do I create a corresponding capture filter? E.g. if I remove all ...
0
votes
0answers
28 views

Wireshark packet read starting from a custom protocol

Pardon the badly-framed question title, I am struggling with it but could not find the best way to frame it. I have a program in which I use libpcap for dumping packets at various points in the ...
-1
votes
1answer
32 views

What is the packet protocol used for communicating switch configuration changes over the network? [closed]

I am trying to isolate the packets used to communicate a switch's configuration changes. More specifically, whenever I use the online tool on my laptop and configure the switch (and hit save) I want ...
0
votes
1answer
30 views

Wireshark filter to display al packets which have traveled through switch

I am trying to filter my packets based on whether or not they went through specific switch. This router has the ip address of 192.168.1.235. Is their a way to do this using Wireshark filters?
0
votes
0answers
31 views

How to analyze traffic made by device on local Wifi network

I have a device (Air quality sensor) that is sending data to a preconfigured server. I would like to access the data that is being sent. Device connects to local Wifi (WPA Secured) and presumably ...
1
vote
1answer
37 views

Can you gather only a summary of network traffic via Wireshark (or similar)?

Something on my network is using an enormous amount of data and I need to track it down. Its not constant or predictable. I have had a go with Wireshark and I am sure that it could tell me what I ...
2
votes
1answer
60 views

Wireshark not showing Frequency/Channel

I am using Ubuntu 18, and wireshark-gtk. I followed this and this tutorials to create a column named/showing frequency/channel. But all the packets I captured have no frequency/channel showing.I tried ...
0
votes
0answers
17 views

Import Embedded Packet Capture output into Wireshark

I did packet capturing with cisco's Embedded Packet Capture and I would like to view the output in Wireshark. The problem is that I only have CLI access to the device, so exporting via TFTP is not an ...
0
votes
1answer
480 views

Filtering out abnormal connection termination packets in wireshark

I am trying to find out a way to filter out packets specifying abnormal connection termination in wireshark. I mean is there any tcp.connection.terminated filter in wireshark??
1
vote
1answer
45 views

Meaning of A and B in Wireshark Conversation View

In Wireshark's conversation view, do A and B map to source and destination?
1
vote
0answers
60 views

ICMP No Reply Found Issue [closed]

Currently working on a Go based NAT router and when translating ICMP traffic and am seeing some interesting behavior. The clients request is forwarded to the server, the server keeps track of the ...
0
votes
3answers
126 views

Analyzing TCP connection by running Wireshark in two endpoint

I am trying to find the number of lost packets in the network. I have 2 devices say DeviceA and DeviceB. IP addresses are respectively DeviceA : 192.168.0.104 and DeviceB: 192.168.0.105. In order ...
0
votes
0answers
21 views

How can we capture traffic under WiFi AP connected with an WAN router?

My PC is connected to the internet via an WiFi access point. The AP is connected to the router that provides global IP address. In our network, some of the PCs (Say PCs1) are directly connected to the ...
1
vote
0answers
48 views

Does Wireshark capture all Wi-Fi traffic under the same access point even with WPA encryption?

I know that free unencrypted-Wi-Fi is dangerous since all the traffic in the same AP is visible. Does Wireshark capture all Wi-Fi traffic under the same access point even with WPA encryption?
1
vote
1answer
41 views

How to find time duration of tracert command using wireshark?

I tried to execute a tracert command in cmd in Windows 10, specifically, tracert www.ieee.org. In the same time, I captured the packets with wireshark. How can I find the time duration of my tracert ...
3
votes
1answer
57 views

No packets showing up in Wireshark despite Client-Server communication

I am somewhat new to computer networking and I created a little project where I have two computers connected to an Ethernet switch, forming a small network. Computer server (192.168.1.1) has a mail-...
0
votes
1answer
48 views

How to extract destination MAC from PCAP? [closed]

I have PCAPs collected at the Raspberry Pi (from this paper). I want to extract the following headers: Ether header (3) IP header (12) TCP header (10) UDP header (4) Then convert the PCAP into csv....
1
vote
1answer
56 views

ARPs in WIFI Interface Monitor Mode

I set my WIFI interface to monitor mode. I did not expect to see any ARP requests. Can someone explain why there is ARP traffic?
1
vote
1answer
43 views

Packet analyze on router does not match client and server

thank you for your time. My (virtual) network has 3 objects : a client, a server and a router between them. I'm sniffing the traffic on the 3 machine with the command tcpdump -i any -s 0 -w [path] ...
1
vote
1answer
41 views

What's the word of a Transmission Control Protocol port in the Wireshark captured package?

What's the meaning of the dict there? why the port have the paraphrase? you see the Destination port 39578 (39578) do not have.
0
votes
1answer
50 views

Is it possible to re-transmit only the last packet at TCP flow?

I try to understand the TCP behavior, especially re-transmission. I did a small experiment and find the curious thing. The only last packet is re-transmitted. Why do this happen? I think if the ...
0
votes
2answers
103 views

While sniffing with Wireshark, i get lot of ICMP packets in my loop back interface with the word “CKAAAA..” in it, why is this happening? [closed]

So i have a parrot VM, and i tried to use wireshark on the lo interface of it just for fun, now I'm seeing loads of ICMP packets, which seems to be Netbios inside(not sure why is Wireshark naming the ...
1
vote
1answer
47 views

What's the hook and double hook meaning in wireshark?

What's the hook and double hook meaning in wireshark? you see the two snapshots up there, when I select #7 the #6 will be hooked. when I select the #8, the #5 will be double hooked. What's the ...
1
vote
1answer
163 views

Why a NIC in promiscuous mode and not will impact the capture packages?

I have a question about network interface Promiscuous mode, A NIC in promiscuous mode can receive all data passing through it regardless of whether the destination address of the data is it. If the ...
1
vote
1answer
29 views

What's the meaning of `[`, `<-` and `->` in wireshark?

When I use the WireShark check the packages: there have three place signs I don't understand. the [ means what? two IPs communicative to each other? but there have other IP in the range. you see the ...
1
vote
1answer
78 views

The reason a TCP connection generate retransmission

My question is why a TCP flow make a re-transmission when a network has enough link bandwidth. For finding a cause, I used a wireshark. I got the below captured at a host side (10.0.0.1) 85968 47....
0
votes
1answer
65 views

Filtering TCP connections with short duration in Wireshark

How can I filter packets for TCP connections with short duration (e.g. 3 seconds)? I guess there may be something like ip.addr == xxx.xxx.xxx.xxx && (time(tcp.flags.fin==1) - time(tcp.flags....
0
votes
1answer
64 views

why doesn't WireShark show any traffic from invalid certificate https site? [closed]

i have tried mobile apps like HttpCanary and pc programs like wireshark still got nothing from the site !!
0
votes
1answer
70 views

TCP sequence numbers in Actual Transmission vs. in Wireshark Capture

Whenever, we do a wireshark capture and Follow--> TCP Stream, we see the sequence numbers as fixed values. In reality, if this were the case, the intruder can easily predict the transmission patterns....
1
vote
2answers
914 views

How to measure max bandwidth with Wireshark?

I'm trying to measure the max bandwidth usage of my LAN with Wireshark. I´ve done several packet captures but I don't know how to obtain the max bandwidth usage. Any Idea? Thank you in advance
0
votes
1answer
298 views

Weird Wireshark protocol list (eth:ethertype:ip:data where is the “udp”?)

I am capturing incoming and outgoing WAN to LAN data at a particular host on my LAN (i.e., the one actually receiving/sending the data). Sometimes I get anomalous captured frames that are missing the ...
1
vote
0answers
67 views

Is this wireshark capture showing any issue? [closed]

I used Wireshark to capture the packets bellow: ... 350 18.942762436 d0:07:ca:0b:63:0c -> Broadcast ARP 60 Who has 13.210.32.75? Tell 13.210.32.78 351 18.947224197 d0:07:ca:0b:63:0c -> ...
1
vote
1answer
107 views

Wireshark captures TCP packet with no flag [closed]

In our network, I captured a TCP packet by Wireshark that has no flag set. What's that mean? Is it normal?
1
vote
0answers
29 views

Hide/replace certain source and destination IP in Wireshark packet table

For demonstration purposes I need to show Wireshark packet table, but I need to hide some of the IP's there, like show 10.0.0.1 instead of 192.168.1.19. Very old threads suggest using Linux-only tools ...
1
vote
0answers
51 views

Why do I not see slow start in this TCP packet capture? [closed]

I am looking at the packet flow between a server and a client (which is downloading a file from the server). As you can see in the packet capture below (with IP addresses omitted), after the initial ...
1
vote
1answer
365 views

No DHCPOFFER message captured in Wireshark

I am looking for the answer why packet captures in Wireshark doesn't contain DHCP offer message. I was trying to capture packets directly on the computer with installed Wireshark and doing a SPAN ...
3
votes
1answer
263 views

IPv6 Wireshark filter for partial IP address

I would like to create a display filter with the last 4 octets of an IPv6 address. Basically, I have the mac address with me and I want to filter for the IP address xxxx:xxxx:xxxx:xxxx:113:5005:80:...
0
votes
1answer
86 views

Wireshark remote hosts

I configured a rip network. I connected two PCS to router 1, router 1 is connected to router 2 and PC 3 is connected to router 2. When I pinged PC 3 and looked at this in wireshark, in the source it ...
1
vote
1answer
55 views

switch wireshark arp

I connected 4 pcs to a switch, I used pc 1 to ping another pc(pc 3) and used wireshark on all the pc's. The one that sent the ping sent out an arp request and received 4 request and replies from the ...
0
votes
1answer
364 views

How to plot and benchmark UDP response time?

Our application uses UDP protocol in the transport layer. I'm currently filtering the packet trace with the port and then manually checking the RTT by selecting the packet stream and by using " Set ...
1
vote
0answers
879 views

Modifying linux ping icmp payload [closed]

On analyzing ping request and reply from a windows system to Linux. It was observed that the windows ping request payload was "abcdefghijklmnopqrstuvwabcdefghi" with size 32 bytes Could this ...
0
votes
0answers
67 views

What is the Acknowledgement number in connection synchronisation between client and server? [duplicate]

I came across this article in an attempt to understand sequence and acknowledgment numbers better. Here is the excerpt: Connection set-up uses the SYN flags. They are not used except for ...
8
votes
2answers
4k views

Why does Wireshark show Version TLS 1.2 here instead of TLS 1.3?

I'm accessing TLS 1.3 test server "https://tls13.pinterjann.is" via a java http client using TLS 1.3. Everything seems to work fine as the html response indicates: What I don't understand: Why does ...
0
votes
1answer
1k views

TCP Window Scaling on Wireshark

i am new to Wireshark and want to find the window scaling, which is the size of the received windows if i am not mistaken. I have a dump file of some 110mb that i use for my graphs. This is the ...
2
votes
1answer
82 views

IPV6 ping, the pinged address is different from the once caught by wireshark

I'm trying to ping an ECU, both PC and ECU have static IPV6 address the problem is that the target address (ECU) pinged is different from the one caught by Wireshark subnet : 64 ping command $ ...

1
2 3 4 5