Questions tagged [wireshark]

For questions about Wireshark, a packet analyzer

Filter by
Sorted by
Tagged with
0
votes
0answers
3 views

No traffic on tun0 wireshark/tcpdump [closed]

I'm connected to a testing lab via openvpn and it's obviously created a tun interface. As part of this assessment I am supposed to analyze traffic on that network, however when I open wireshark there ...
0
votes
1answer
19 views

Wireshark display filter to hide Protocol = 802.11?

[Note: reposted here from SO...] I've set Wireshark's capture filter set to capture only packets from the MAC address of interest, but the result is dominated by zillions of packets whose Protocol is &...
1
vote
0answers
7 views

Learning wireshark RST frames [duplicate]

I recently got into Wireshark and I'm just trying to grasp the basics. I've watched a few videos and they say to look out for reset frames on your WiFi, so I saw a few. They are an exchange between my ...
1
vote
1answer
56 views

Suspicious flood of ARP requests [closed]

I'm trying to review a Wireshark capture and it seems the network is heavily flooded with ARP requests that make no sense to me. The destination is not "Broadcast", but some unknown DELL ...
0
votes
0answers
30 views

Man in the middle legitimate packet inspection

we're trying to debug a faulty Panasonic Mobile softphone SIP app (both Android & Apple versions), as many calls are randomly dropped unexpectedly. This is the conceptual connection diagram: We ...
1
vote
1answer
48 views

How do I set a display filter in wireshark that sorts by destination broadcast?

1 0.000000 Vmware_90:07:7b Broadcast ARP 60 Who has 192.168.185.144? Tell 192.168.185.7 27 0.995837 28.144.7.123 192.168.185.144 HTTP 1177 HTTP/1.1 200 OK (...
0
votes
1answer
32 views

Capture traffic flowing through a Brocade switch remotely

I am currently doing packet capture through mirroring with Wireshark as mentioned in this post I can mirror the traffic to a port physically jacked into and analyze the packets redirected there w/ ...
0
votes
0answers
15 views

Wireshark Openflow Parsing does not work

I am trying to read Openflow Messages with wireshark. So I use the mininet vm and start the standard topology with argument --mac. Then I started Wireshark on my Host computer and did a remote capture ...
0
votes
3answers
740 views

how to capture DHCP packets in wireshark

Hy! I want to capture DHCP packets in Wireshark but I did not receive any. Not my filter wrong, I don't get any. So I think I can't trigger the DHCP communications. my filters: dhcp bootp udp.port == ...
2
votes
1answer
82 views

IPv4 and UDP/TCP packets inside of ICMP packet?

A week ago, after opening wireshark, i was surprised by seing a storm of ICMP packets from different IP addresses. While deep analysing of thoses packets, i noticed that those ICMP packets contains ...
0
votes
1answer
36 views

When I send the ICMP packet with 4000B, but the IPv4 segment calculated 4008B

When I send the ICMP packet with data size as 4000B for testing the IP fragment. ping 192.168.2.1 -c1 -s4000 and the Wireshark captured it, Whether is is because of ICMP header? but we know ICMP ...
0
votes
2answers
45 views

What's the Destination unreachable ICMP packet(ICMP payload the UDP) usage? [closed]

In my Mac(192.168.2.228), it will send ICMP packet to my house's router (192.168.2.1). with the info Destination unreachable (Port unreachable) and in the Wireshark packet detail panel, there ...
1
vote
1answer
125 views

What is the difference between tshark, dumpcap and others for collecting/sniffing traffic?

Wireshark provides tshark and dumpcap, and I've also seen people using the wireshark binary or even tcpdump to collect/save network traffic. Online it is claimed that tshark or dumpcap hardly make a ...
1
vote
1answer
111 views

Why the different colours for SACK markers in Wireshark's tcptrace graph?

Wireshark's tcptrace time sequence graph shows a good deal of information, but I cannot find a document that spells out exactly what it all means. It's broadly similar to the original tcptrace except ...
0
votes
1answer
25 views

What type of attack could this be ? (Wireshark pcap) [closed]

If I understand it correctly the "client" sent an unencrypted password to the pop3 server consisting of a long string of As. Is this a type of attack and if yes, how does it work?
0
votes
1answer
76 views

how to send a number of TCP packets and capture only those packets using tshark?

I'm using iperf3 to send 1005 TCP packets with the commands: iperf3 -s -i 1 -f m -p 5200 -D iperf3 -c 10.60.0.113 -k 1005 -bitrate 0 --reverse --omit 2 -p 5200 In server, client respectively. The ...
0
votes
1answer
96 views

Capturing dot1q packets with Wireshark on a PC

I have spent the last few hours trying to capture some trunk packets so I can see and examine the dot1q VLAN field. I have tried mirroring the trunk port to my PC using the following commands on Cisco ...
1
vote
1answer
59 views

How do I interpret this Wireshark log file?

I'm new to using Wireshark and I'd like some help with analyzing the log shown in the image. I also ran a nmap scan of the ports on my computer, but I'm not able to identify which of these lines are ...
0
votes
1answer
24 views

re transmission happened before receiving Three ACKs packets

In the following wireshark trace, the packet with seq=41030 was sent, after some time the packet before it got acknowledged. after that a retransmission happened the packet seq=41030, then 3 ACKs ...
0
votes
1answer
55 views

How do I use the wireshark I/O graph to plot the value of an arbitrary bit in the data layer?

I have a number of UDP packets that are using a protocol that is not implemented in wireshark. I would like to use the I/O graph to plot the value of the data packet byte at index 3. Is this possible? ...
2
votes
1answer
587 views

what's the difference between trailer and padding field in ethernet frame captured by wireshark?

The Ethernet minimum length should be 64 Bytes, so when the data is less than 46B, there would be some extra bytes padding to the end of data, make sure the frame size up to 64B. When I capture the ...
0
votes
1answer
39 views

Capture and display filters in wireshark (limit destination IP)?

In Wireshark I can successfully create this display filter that will only show traffic going to x.x.x.x ip.dst==x.x.x.x But how do I create a corresponding capture filter? E.g. if I remove all ...
0
votes
0answers
30 views

Wireshark packet read starting from a custom protocol

Pardon the badly-framed question title, I am struggling with it but could not find the best way to frame it. I have a program in which I use libpcap for dumping packets at various points in the ...
-1
votes
1answer
34 views

What is the packet protocol used for communicating switch configuration changes over the network? [closed]

I am trying to isolate the packets used to communicate a switch's configuration changes. More specifically, whenever I use the online tool on my laptop and configure the switch (and hit save) I want ...
0
votes
1answer
37 views

Wireshark filter to display al packets which have traveled through switch

I am trying to filter my packets based on whether or not they went through specific switch. This router has the ip address of 192.168.1.235. Is their a way to do this using Wireshark filters?
0
votes
0answers
33 views

How to analyze traffic made by device on local Wifi network

I have a device (Air quality sensor) that is sending data to a preconfigured server. I would like to access the data that is being sent. Device connects to local Wifi (WPA Secured) and presumably ...
1
vote
1answer
40 views

Can you gather only a summary of network traffic via Wireshark (or similar)?

Something on my network is using an enormous amount of data and I need to track it down. Its not constant or predictable. I have had a go with Wireshark and I am sure that it could tell me what I ...
2
votes
1answer
102 views

Wireshark not showing Frequency/Channel

I am using Ubuntu 18, and wireshark-gtk. I followed this and this tutorials to create a column named/showing frequency/channel. But all the packets I captured have no frequency/channel showing.I tried ...
0
votes
0answers
18 views

Import Embedded Packet Capture output into Wireshark

I did packet capturing with cisco's Embedded Packet Capture and I would like to view the output in Wireshark. The problem is that I only have CLI access to the device, so exporting via TFTP is not an ...
0
votes
1answer
637 views

Filtering out abnormal connection termination packets in wireshark

I am trying to find out a way to filter out packets specifying abnormal connection termination in wireshark. I mean is there any tcp.connection.terminated filter in wireshark??
1
vote
1answer
49 views

Meaning of A and B in Wireshark Conversation View

In Wireshark's conversation view, do A and B map to source and destination?
1
vote
0answers
98 views

ICMP No Reply Found Issue [closed]

Currently working on a Go based NAT router and when translating ICMP traffic and am seeing some interesting behavior. The clients request is forwarded to the server, the server keeps track of the ...
0
votes
3answers
247 views

Analyzing TCP connection by running Wireshark in two endpoint

I am trying to find the number of lost packets in the network. I have 2 devices say DeviceA and DeviceB. IP addresses are respectively DeviceA : 192.168.0.104 and DeviceB: 192.168.0.105. In order ...
1
vote
0answers
26 views

How can we capture traffic under WiFi AP connected with an WAN router?

My PC is connected to the internet via an WiFi access point. The AP is connected to the router that provides global IP address. In our network, some of the PCs (Say PCs1) are directly connected to the ...
2
votes
0answers
53 views

Does Wireshark capture all Wi-Fi traffic under the same access point even with WPA encryption?

I know that free unencrypted-Wi-Fi is dangerous since all the traffic in the same AP is visible. Does Wireshark capture all Wi-Fi traffic under the same access point even with WPA encryption?
1
vote
1answer
68 views

How to find time duration of tracert command using wireshark?

I tried to execute a tracert command in cmd in Windows 10, specifically, tracert www.ieee.org. In the same time, I captured the packets with wireshark. How can I find the time duration of my tracert ...
3
votes
1answer
60 views

No packets showing up in Wireshark despite Client-Server communication

I am somewhat new to computer networking and I created a little project where I have two computers connected to an Ethernet switch, forming a small network. Computer server (192.168.1.1) has a mail-...
0
votes
1answer
76 views

How to extract destination MAC from PCAP? [closed]

I have PCAPs collected at the Raspberry Pi (from this paper). I want to extract the following headers: Ether header (3) IP header (12) TCP header (10) UDP header (4) Then convert the PCAP into csv....
1
vote
1answer
115 views

ARPs in WIFI Interface Monitor Mode

I set my WIFI interface to monitor mode. I did not expect to see any ARP requests. Can someone explain why there is ARP traffic?
1
vote
1answer
46 views

Packet analyze on router does not match client and server

thank you for your time. My (virtual) network has 3 objects : a client, a server and a router between them. I'm sniffing the traffic on the 3 machine with the command tcpdump -i any -s 0 -w [path] ...
1
vote
1answer
52 views

What's the word of a Transmission Control Protocol port in the Wireshark captured package?

What's the meaning of the dict there? why the port have the paraphrase? you see the Destination port 39578 (39578) do not have.
0
votes
1answer
54 views

Is it possible to re-transmit only the last packet at TCP flow?

I try to understand the TCP behavior, especially re-transmission. I did a small experiment and find the curious thing. The only last packet is re-transmitted. Why do this happen? I think if the ...
0
votes
2answers
208 views

While sniffing with Wireshark, i get lot of ICMP packets in my loop back interface with the word “CKAAAA..” in it, why is this happening? [closed]

So i have a parrot VM, and i tried to use wireshark on the lo interface of it just for fun, now I'm seeing loads of ICMP packets, which seems to be Netbios inside(not sure why is Wireshark naming the ...
1
vote
1answer
59 views

What's the hook and double hook meaning in wireshark?

What's the hook and double hook meaning in wireshark? you see the two snapshots up there, when I select #7 the #6 will be hooked. when I select the #8, the #5 will be double hooked. What's the ...
1
vote
1answer
290 views

Why a NIC in promiscuous mode and not will impact the capture packages?

I have a question about network interface Promiscuous mode, A NIC in promiscuous mode can receive all data passing through it regardless of whether the destination address of the data is it. If the ...
1
vote
1answer
31 views

What's the meaning of `[`, `<-` and `->` in wireshark?

When I use the WireShark check the packages: there have three place signs I don't understand. the [ means what? two IPs communicative to each other? but there have other IP in the range. you see the ...
1
vote
1answer
287 views

The reason a TCP connection generate retransmission

My question is why a TCP flow make a re-transmission when a network has enough link bandwidth. For finding a cause, I used a wireshark. I got the below captured at a host side (10.0.0.1) 85968 47....
0
votes
1answer
72 views

Filtering TCP connections with short duration in Wireshark

How can I filter packets for TCP connections with short duration (e.g. 3 seconds)? I guess there may be something like ip.addr == xxx.xxx.xxx.xxx && (time(tcp.flags.fin==1) - time(tcp.flags....
0
votes
1answer
68 views

why doesn't WireShark show any traffic from invalid certificate https site? [closed]

i have tried mobile apps like HttpCanary and pc programs like wireshark still got nothing from the site !!
0
votes
1answer
78 views

TCP sequence numbers in Actual Transmission vs. in Wireshark Capture

Whenever, we do a wireshark capture and Follow--> TCP Stream, we see the sequence numbers as fixed values. In reality, if this were the case, the intruder can easily predict the transmission patterns....

1
2 3 4 5 6