A message from our CEO about the future of Stack Overflow and Stack Exchange. Read now.

Questions tagged [wireshark]

For questions about Wireshark, a packet analyzer

Filter by
Sorted by
Tagged with
0
votes
0answers
14 views

Server sending only ACK and not actual data [closed]

I am currently facing issue in my production environment where during heavy load injection from client to my server, they receive a 'connection reset' error. I tried investigating using wireshark and ...
0
votes
0answers
11 views

TLS handshake performed for every send [closed]

I have a legacy application which uses WinInet library to connect to server. It connects using TLS 1.2. However I am seeing a strange behavior that for every send request from my client, TLS handshake ...
0
votes
3answers
56 views

Analyzing TCP connection by running Wireshark in two endpoint

I am trying to find the number of lost packets in the network. I have 2 devices say DeviceA and DeviceB. IP addresses are respectively DeviceA : 192.168.0.104 and DeviceB: 192.168.0.105. In order ...
0
votes
0answers
12 views

How can we capture traffic under WiFi AP connected with an WAN router?

My PC is connected to the internet via an WiFi access point. The AP is connected to the router that provides global IP address. In our network, some of the PCs (Say PCs1) are directly connected to the ...
1
vote
0answers
41 views

Does Wireshark capture all Wi-Fi traffic under the same access point even with WPA encryption?

I know that free unencrypted-Wi-Fi is dangerous since all the traffic in the same AP is visible. Does Wireshark capture all Wi-Fi traffic under the same access point even with WPA encryption?
1
vote
1answer
33 views

How to find time duration of tracert command using wireshark?

I tried to execute a tracert command in cmd in Windows 10, specifically, tracert www.ieee.org. In the same time, I captured the packets with wireshark. How can I find the time duration of my tracert ...
3
votes
1answer
54 views

No packets showing up in Wireshark despite Client-Server communication

I am somewhat new to computer networking and I created a little project where I have two computers connected to an Ethernet switch, forming a small network. Computer server (192.168.1.1) has a mail-...
0
votes
1answer
40 views

How to extract destination MAC from PCAP? [closed]

I have PCAPs collected at the Raspberry Pi (from this paper). I want to extract the following headers: Ether header (3) IP header (12) TCP header (10) UDP header (4) Then convert the PCAP into csv....
1
vote
1answer
41 views

ARPs in WIFI Interface Monitor Mode

I set my WIFI interface to monitor mode. I did not expect to see any ARP requests. Can someone explain why there is ARP traffic?
1
vote
1answer
40 views

Packet analyze on router does not match client and server

thank you for your time. My (virtual) network has 3 objects : a client, a server and a router between them. I'm sniffing the traffic on the 3 machine with the command tcpdump -i any -s 0 -w [path] ...
1
vote
1answer
33 views

What's the word of a Transmission Control Protocol port in the Wireshark captured package?

What's the meaning of the dict there? why the port have the paraphrase? you see the Destination port 39578 (39578) do not have.
0
votes
1answer
46 views

Is it possible to re-transmit only the last packet at TCP flow?

I try to understand the TCP behavior, especially re-transmission. I did a small experiment and find the curious thing. The only last packet is re-transmitted. Why do this happen? I think if the ...
0
votes
2answers
63 views

While sniffing with Wireshark, i get lot of ICMP packets in my loop back interface with the word “CKAAAA..” in it, why is this happening? [closed]

So i have a parrot VM, and i tried to use wireshark on the lo interface of it just for fun, now I'm seeing loads of ICMP packets, which seems to be Netbios inside(not sure why is Wireshark naming the ...
1
vote
1answer
42 views

What's the hook and double hook meaning in wireshark?

What's the hook and double hook meaning in wireshark? you see the two snapshots up there, when I select #7 the #6 will be hooked. when I select the #8, the #5 will be double hooked. What's the ...
1
vote
1answer
90 views

Why a NIC in promiscuous mode and not will impact the capture packages?

I have a question about network interface Promiscuous mode, A NIC in promiscuous mode can receive all data passing through it regardless of whether the destination address of the data is it. If the ...
1
vote
1answer
24 views

What's the meaning of `[`, `<-` and `->` in wireshark?

When I use the WireShark check the packages: there have three place signs I don't understand. the [ means what? two IPs communicative to each other? but there have other IP in the range. you see the ...
1
vote
1answer
57 views

The reason a TCP connection generate retransmission

My question is why a TCP flow make a re-transmission when a network has enough link bandwidth. For finding a cause, I used a wireshark. I got the below captured at a host side (10.0.0.1) 85968 47....
0
votes
1answer
62 views

Filtering TCP connections with short duration in Wireshark

How can I filter packets for TCP connections with short duration (e.g. 3 seconds)? I guess there may be something like ip.addr == xxx.xxx.xxx.xxx && (time(tcp.flags.fin==1) - time(tcp.flags....
0
votes
1answer
62 views

why doesn't WireShark show any traffic from invalid certificate https site? [closed]

i have tried mobile apps like HttpCanary and pc programs like wireshark still got nothing from the site !!
0
votes
1answer
69 views

TCP sequence numbers in Actual Transmission vs. in Wireshark Capture

Whenever, we do a wireshark capture and Follow--> TCP Stream, we see the sequence numbers as fixed values. In reality, if this were the case, the intruder can easily predict the transmission patterns....
1
vote
2answers
351 views

How to measure max bandwidth with Wireshark?

I'm trying to measure the max bandwidth usage of my LAN with Wireshark. I´ve done several packet captures but I don't know how to obtain the max bandwidth usage. Any Idea? Thank you in advance
0
votes
1answer
157 views

Weird Wireshark protocol list (eth:ethertype:ip:data where is the “udp”?)

I am capturing incoming and outgoing WAN to LAN data at a particular host on my LAN (i.e., the one actually receiving/sending the data). Sometimes I get anomalous captured frames that are missing the ...
1
vote
0answers
48 views

Is this wireshark capture showing any issue? [closed]

I used Wireshark to capture the packets bellow: ... 350 18.942762436 d0:07:ca:0b:63:0c -> Broadcast ARP 60 Who has 13.210.32.75? Tell 13.210.32.78 351 18.947224197 d0:07:ca:0b:63:0c -> ...
0
votes
1answer
65 views

Wireshark captures TCP packet with no flag [closed]

In our network, I captured a TCP packet by Wireshark that has no flag set. What's that mean? Is it normal?
1
vote
0answers
27 views

Hide/replace certain source and destination IP in Wireshark packet table

For demonstration purposes I need to show Wireshark packet table, but I need to hide some of the IP's there, like show 10.0.0.1 instead of 192.168.1.19. Very old threads suggest using Linux-only tools ...
1
vote
0answers
43 views

Why do I not see slow start in this TCP packet capture? [closed]

I am looking at the packet flow between a server and a client (which is downloading a file from the server). As you can see in the packet capture below (with IP addresses omitted), after the initial ...
0
votes
0answers
29 views

What do the multiple occurencies mean in a packet trace file?

I have a trace file and I used tshark to find out the number of duplicate ACKs, with the following command: tshark -r file.pcap -T fields -e frame.number -e tcp.analysis.duplicate_ack After some ...
1
vote
1answer
220 views

No DHCPOFFER message captured in Wireshark

I am looking for the answer why packet captures in Wireshark doesn't contain DHCP offer message. I was trying to capture packets directly on the computer with installed Wireshark and doing a SPAN ...
3
votes
1answer
218 views

IPv6 Wireshark filter for partial IP address

I would like to create a display filter with the last 4 octets of an IPv6 address. Basically, I have the mac address with me and I want to filter for the IP address xxxx:xxxx:xxxx:xxxx:113:5005:80:...
0
votes
1answer
73 views

Wireshark remote hosts

I configured a rip network. I connected two PCS to router 1, router 1 is connected to router 2 and PC 3 is connected to router 2. When I pinged PC 3 and looked at this in wireshark, in the source it ...
1
vote
1answer
54 views

switch wireshark arp

I connected 4 pcs to a switch, I used pc 1 to ping another pc(pc 3) and used wireshark on all the pc's. The one that sent the ping sent out an arp request and received 4 request and replies from the ...
0
votes
1answer
223 views

How to plot and benchmark UDP response time?

Our application uses UDP protocol in the transport layer. I'm currently filtering the packet trace with the port and then manually checking the RTT by selecting the packet stream and by using " Set ...
1
vote
0answers
485 views

Modifying linux ping icmp payload [closed]

On analyzing ping request and reply from a windows system to Linux. It was observed that the windows ping request payload was "abcdefghijklmnopqrstuvwabcdefghi" with size 32 bytes Could this ...
0
votes
0answers
67 views

What is the Acknowledgement number in connection synchronisation between client and server? [duplicate]

I came across this article in an attempt to understand sequence and acknowledgment numbers better. Here is the excerpt: Connection set-up uses the SYN flags. They are not used except for ...
8
votes
2answers
3k views

Why does Wireshark show Version TLS 1.2 here instead of TLS 1.3?

I'm accessing TLS 1.3 test server "https://tls13.pinterjann.is" via a java http client using TLS 1.3. Everything seems to work fine as the html response indicates: What I don't understand: Why does ...
0
votes
1answer
883 views

TCP Window Scaling on Wireshark

i am new to Wireshark and want to find the window scaling, which is the size of the received windows if i am not mistaken. I have a dump file of some 110mb that i use for my graphs. This is the ...
2
votes
1answer
65 views

IPV6 ping, the pinged address is different from the once caught by wireshark

I'm trying to ping an ECU, both PC and ECU have static IPV6 address the problem is that the target address (ECU) pinged is different from the one caught by Wireshark subnet : 64 ping command $ ...
1
vote
0answers
33 views

Remote monitoring using a non root user account with Sudo Privilege [closed]

I want to remotely take tcpdump on my server with a non root user account? I tried it but doesnt seems to be working? Can someone guide me on this? plink.exe -ssh -pw abc123 iamuser@192.168.1.1 "sudo ...
3
votes
1answer
395 views

How can a UDP Client and a packet sniffer run on the same machine?

In my understanding, if you have a UDP socket client that is bound to a particular port, then a second UDP client on the same machine can't bind to the same port. If this is the case, then how can a ...
2
votes
2answers
253 views

tcp connection and stream flow question

Could anyone explain the main principe of tcp flow when making a session ? I have take a tcp dump when i'm trying to browse a site. when I analyse the packet by wireshark, i have found many Three way ...
1
vote
1answer
32 views

Where I can find frame specification?

When I capture from wireshark traffic I can see data like this Where I can see the specification of each field? When I read wiki https://en.wikipedia.org/wiki/Ethernet_frame there is nothing like ...
2
votes
2answers
745 views

Calculating the throughput of a given TCP connection

Given a TCP session, is there a way to determine the throughput of the sender? I have a wireshark sniff, and I see that to calculate the throughput of the sender I can use the TCP-Window-Size-in-bits /...
0
votes
1answer
262 views

How to differentiate whether Data or QUIC protocol frame follows UDP header? [duplicate]

I am using Wireshark to analyze network traffic and I need to programmatically differentiate whether Data or QUIC protocol frame follows UDP header. So far, every packet which has source or ...
0
votes
1answer
230 views

Wireshark udp checksum errorI

I sniffing udp communication with 2 instance of wireshark , 1: 2.0.0 2: 2.2.1 . In version 2.0.0 I get valid udp.checksum , but with 2.2.1 I always get udp checksum = 0000 . Why is that? those ...
1
vote
1answer
329 views

How to filter a wireshark capture (pcapng) by source and destination IPv4 address

I have a bunch of wireshark captures I need to mine data from. Tshark seems to fit the bill but this doesn't support filtering (-f) by the look of it, I simply get: Using: tshark -x -r Run18....
2
votes
1answer
1k views

What does a “Frame” relate to in the WIreshark packet details pane?

Currently learning to use Wireshark. When I take a capture and click on one of it's rows, I see the following breakdown in the "Packet Details" pane: Frame Linux Cooked Capture Internet Protocol ...
0
votes
1answer
325 views

ARP requests from outside the network [closed]

I need help understanding an ARP Storm PCAP I'm currently studying. My understating is that routers will strip layer 2 info. Therefore, an ARP request frame will not go through a layer 3 device (...
1
vote
1answer
683 views

How to capture ARP Reply packet from all hosts in the network?

How can I capture ARP reply packets from all hosts that are connected in the network? I've tried wireshark premicious mode but it only capture ARP replies from gateway.
3
votes
2answers
179 views

Which tcpdump metrics reveal server connectivity problems vs client problems?

I am attempting to diagnose a ~45 sec drop (to 0 Kbps) in the reported RTMP streaming bitrate in OBS while publishing a live stream. I had been running a tcpdump the entire time using Apple's ...
1
vote
2answers
264 views

How can i monitor ARP packet on WiFi network?

I want to monitor packet in my network. It said that ARP packet request broadcasted all over network. But why i only see my arp request packet and reply packet to the gateway?