Stack Exchange Network

Stack Exchange network consists of 174 Q&A communities including Stack Overflow, the largest, most trusted online community for developers to learn, share their knowledge, and build their careers.

Visit Stack Exchange

Questions tagged [wireshark]

For questions about Wireshark, a packet analyzer

0
votes
0answers
15 views

How to detect A-MPDU and A-MSDU from sniffed 802.11 data with wireshark?

I was wondering if there is a way to find which frames use A-MPDU, and A-MSDU, from traffic sniffed over-the-air from a devices running in monitoring mode. I can "guess" by looking at some data: in ...
-1
votes
0answers
23 views

TCP reset after a 2 way FIN-ACK completed

In a TCP session I have observed that one host send a TCP-Reset after a complete FIN-ACK exchange. 4988 85.069226 10.37.1.49 → 10.37.1.42 TCP 60 54998 → 50000 [FIN, ACK] Seq=385 Ack=5479 Win=...
-1
votes
0answers
8 views

In wireshark what's a tcp stream? [duplicate]

I would like to understand in wireshark what's a tcp steam. 1 - Is it a stream of tcp packets? 2 - Is it a stream of data carried in tcp packetds (basically the tcp payloads)? Thank you in advance
6
votes
2answers
1k views

Why does Wireshark show Version TLS 1.2 here instead of TLS 1.3?

I'm accessing TLS 1.3 test server "https://tls13.pinterjann.is" via a java http client using TLS 1.3. Everything seems to work fine as the html response indicates: What I don't understand: Why does ...
0
votes
1answer
55 views

TCP Window Scaling on Wireshark

i am new to Wireshark and want to find the window scaling, which is the size of the received windows if i am not mistaken. I have a dump file of some 110mb that i use for my graphs. This is the ...
2
votes
1answer
42 views

IPV6 ping, the pinged address is different from the once caught by wireshark

I'm trying to ping an ECU, both PC and ECU have static IPV6 address the problem is that the target address (ECU) pinged is different from the one caught by Wireshark subnet : 64 ping command $ ...
1
vote
0answers
9 views

Remote monitoring using a non root user account with Sudo Privilege [closed]

I want to remotely take tcpdump on my server with a non root user account? I tried it but doesnt seems to be working? Can someone guide me on this? plink.exe -ssh -pw abc123 iamuser@192.168.1.1 "sudo ...
3
votes
1answer
165 views

How can a UDP Client and a packet sniffer run on the same machine?

In my understanding, if you have a UDP socket client that is bound to a particular port, then a second UDP client on the same machine can't bind to the same port. If this is the case, then how can a ...
2
votes
2answers
201 views

tcp connection and stream flow question

Could anyone explain the main principe of tcp flow when making a session ? I have take a tcp dump when i'm trying to browse a site. when I analyse the packet by wireshark, i have found many Three way ...
1
vote
1answer
28 views

Where I can find frame specification?

When I capture from wireshark traffic I can see data like this Where I can see the specification of each field? When I read wiki https://en.wikipedia.org/wiki/Ethernet_frame there is nothing like ...
2
votes
2answers
119 views

Calculating the throughput of a given TCP connection

Given a TCP session, is there a way to determine the throughput of the sender? I have a wireshark sniff, and I see that to calculate the throughput of the sender I can use the TCP-Window-Size-in-bits /...
0
votes
1answer
47 views

How to differentiate whether Data or QUIC protocol frame follows UDP header? [duplicate]

I am using Wireshark to analyze network traffic and I need to programmatically differentiate whether Data or QUIC protocol frame follows UDP header. So far, every packet which has source or ...
0
votes
1answer
38 views

Wireshark udp checksum errorI

I sniffing udp communication with 2 instance of wireshark , 1: 2.0.0 2: 2.2.1 . In version 2.0.0 I get valid udp.checksum , but with 2.2.1 I always get udp checksum = 0000 . Why is that? those ...
1
vote
1answer
74 views

How to filter a wireshark capture (pcapng) by source and destination IPv4 address

I have a bunch of wireshark captures I need to mine data from. Tshark seems to fit the bill but this doesn't support filtering (-f) by the look of it, I simply get: Using: tshark -x -r Run18....
1
vote
1answer
65 views

What does a “Frame” relate to in the WIreshark packet details pane?

Currently learning to use Wireshark. When I take a capture and click on one of it's rows, I see the following breakdown in the "Packet Details" pane: Frame Linux Cooked Capture Internet Protocol ...
0
votes
1answer
73 views

ARP requests from outside the network [closed]

I need help understanding an ARP Storm PCAP I'm currently studying. My understating is that routers will strip layer 2 info. Therefore, an ARP request frame will not go through a layer 3 device (...
1
vote
1answer
151 views

How to capture ARP Reply packet from all hosts in the network?

How can I capture ARP reply packets from all hosts that are connected in the network? I've tried wireshark premicious mode but it only capture ARP replies from gateway.
3
votes
2answers
70 views

Which tcpdump metrics reveal server connectivity problems vs client problems?

I am attempting to diagnose a ~45 sec drop (to 0 Kbps) in the reported RTMP streaming bitrate in OBS while publishing a live stream. I had been running a tcpdump the entire time using Apple's ...
0
votes
2answers
60 views

How can i monitor ARP packet on WiFi network?

I want to monitor packet in my network. It said that ARP packet request broadcasted all over network. But why i only see my arp request packet and reply packet to the gateway?
2
votes
1answer
61 views

How to emuate simple (telnet-like) network protocol with netcat or similar

I have a barcode sensor (Keyence SR-2000) which is able to talk a simple plaintext-based protocol. I could talk to it with the provided (windows-only) app called AutoID Terminal and ontained wireshark ...
1
vote
3answers
66 views

Can Ethernet II frame's Type be Layer1's or Layer4's protocol?

The Ethernet II frame's Type field can be IPv4, ARP, so it can be Layer2 and Layer3's protocol. This is a snapshot of frame captured by WireShark. But I have a question, whether it can be other ...
1
vote
1answer
25 views

Does the frame package, all are represent as hex data?

I use Wireshark for capturing packages, get many frames. You see the left light blue background space, all are hex data, and right are converted words we can identify. I mean whether the frame ...
1
vote
2answers
47 views

What kind packets of the Wireshark capture's package?

We know we can use Wireshark for capture packets, we know Wireshark is based on the network interface adapter. This is a list of packets captured by Wireshark: Is Wireshark based on the network ...
0
votes
1answer
130 views

Filter pcap file by layer and save to another format [closed]

I captured packets in wireshark, filtered for the protocol I'm interested in (DIS), then exported this to a pcap file. I'd like to do analysis on this data in Python. The only part I'm interested in ...
2
votes
2answers
264 views

What are the differences between TCP iRTT and ICMP Ping?

I’m attempting to estimate latency between my PC and any servers/clients it interacts with. I don’t want to use Ping for various reasons (requires both ends to allow it, would require additional ...
0
votes
2answers
418 views

How to determine whether files are downloaded serially or in parallel using Wireshark?

In the http-ethereal-trace provided in the link below there are three HTTP GET request.The 2nd and 3rd request downloads a GIF and JPG format image recpectively.How can we determine wether the two ...
2
votes
1answer
81 views

how to get RSSI information of WiFi users in wireshark?

If I'm able to get 802.11n traffic with my network adapter, would I be able to see the RSSI information? what should be the filter to see it?
1
vote
0answers
59 views

What is an SSL debug file

What is an SSL debug file in wireshark? I am following the below tutorial and I am stuck at step 4 of this set of Citrix Netscaler instructions
0
votes
0answers
51 views

Wireshark editcap create a tcp.payload file

I want a file of just the payloads from a 5min. tcp exchange between two hosts. I believe I can use Wireshark to just capture those packets which contain a tcp.payload. But after that, I believe I ...
3
votes
3answers
68 views

How does any program identify the protocol header next from TCP?

I need to know how does wireshark or any other program knows the protocol next from TCP. I mean, for instance: The Ethernet layer has a field named Type which carry the IPv04 The Internet protocol ...
0
votes
2answers
95 views

Wireshark expression filters for wireless capture

1) What Wireshark expression filter stack can I utilize to discover how many devices are transmitting in the 2GHz and 5GHz spectrum in a packet capture? 2) What Wireshark expression filter stack can ...
2
votes
1answer
117 views

Why would my router send an ARP request about a device that's already listed in its ARP cache?

I checked my Ubiquiti EdgeRouterX's ARP table and my laptop IP and MAC address were there. I then checked the DHCP lease and my laptop's IP address doesn't expire until tomorrow. I then ran ...
1
vote
1answer
162 views

Wireshark capture only TCP packets with the RST flag set

I'm quite new to networking and I got stuck while reading "Practical Packet Analysis: Using Wireshark to Solve...". On page 61 it is written: A common scenario is to capture only TCP packets ...
3
votes
3answers
187 views

How to tell which one is the source IP and MAC address of the data being received?

I have to work with an FPGA module already running a code written by someone else. I have no access to the FPGA code. Now the setup is something like this:- FPGA is connected to the pc via ethernet ...
0
votes
1answer
243 views

Wireshark capture on LoopBack interface [closed]

We have two applications running on same machine, both of them are listening on the loopback interface on two different ports. Client Application is sending data to server, but receiving Application ...
0
votes
1answer
37 views

How to show all data (bitstream with preamble, SFD) on Ubuntu with an Intel Ethernet Interface?

On my PC I have an Intel Ethernet Connection I217-LM with e1000e driver. If I receive packets in Wireshark or any libpcap based tool, the received ethernet frames start with Ethernet II frame and end ...
1
vote
0answers
24 views

How to fetch application specific url's by using wireshark in Windows-8/10? [closed]

Its my first time using wireshark and I am encountered with one major problem i.e How will i sniff url/api that a particular application/software is hitting which is installed in Windows-8/10 by using ...
3
votes
1answer
574 views

How can I plot the TCP RTT graph in Wireshark?

I'm suspecting one of our Host is not performing well in the TCP protocol Level.I have tried to plot the TCP RTT graph using tcp.analysis option in the IO graph.However,I'm not finding the right ...
1
vote
1answer
46 views

what the meaning displayed value in statistic capture wireshark

i have capture some packet with wireshark, in statistic capture windows there is value named Displayed like this then I was figure out that i can count the Capture value (109) from the capure ...
-1
votes
1answer
141 views

What is “cflow” in ipfix?

I am learning ipfix and found a cmd like this: tshark -r ipfix.cap -n -d udp.port==4379,cflow -O cflow What does the cflow part mean here? I was also told to filter cflow if I use Wireshark in ...
1
vote
1answer
158 views

Probe Request Channel Information

I have used wireshark to capture Wi-fi frames, and have configured my AP to operate on Channel 1. Now in one of the transactions that occur, I find my mobile device sending a probe request in the ...
0
votes
0answers
118 views

TCP SYN packet to change port during established connection

I am looking a wireshark log, and i can see that while data is being transfered from the server, the client is sending a SYN request. Data continues to come in (probably because the SYN packet has not ...
1
vote
1answer
137 views

Delayed Ack every 3 segments

I was studying some wireshark captures. I noticed that though Ack's are sent every other packet like i was expecting due to delayed TCP ack, i noticed that at some times it is acking every 3 segments. ...
4
votes
1answer
495 views

Calculating 3 way TCP Handshake Duration

I want to calculate the time that the 3 way TCP handshake occupies through wireshark between a server and a client. I get something like: Time Source Destination Info 0.00 ...
1
vote
1answer
687 views

Npcap Loopback Adapter not showing PING results in Wireshark

I've a server process and a client process running on my machine. To capture the packets transmitted between them, I've installed the Npcap Loopback Adapter as suggested in the ever-so-famous ...
3
votes
2answers
6k views

How to view MTU size in Wireshark?

I've been reading about maximum transmission unit (MTU) which is the size of the largest protocol data unit (PDU) that can be communicated in a single, network layer, transaction. I'm generating a ...
1
vote
2answers
939 views

Can not capture DHCP offer with wireshark?

I'd like to capture DHCP packets with wireshark. When I use the filter: "udp.port == 67 or udp.port == 68" I only see the Discover and Request broadcasts. While I thought the DHCP offer also gets ...
3
votes
3answers
186 views

tcp handshake on a http response. which frame is actually the payload?

I am capturing/trying to understand a http response capture in wireshark. On packet capture row 78,79, i am seeing the HTTP headers (no 78) and body (no 79) in the capture's payload. On packet ...
4
votes
1answer
105 views

Capture first packets with Wireshark

If I start capturing on an interface (e.g. wlan0) with Wireshark while it's down, and then bring the interface up, Wireshark stops the capture and I have to restart it. This way I can't see packets ...
1
vote
2answers
107 views

Method in wireshark to filter for any in a set of mac addresses but no others

I am sniffing for several devices in a congested environment. I'm wondering if there is an easy way to accomplish filtering that I don't know of. I have two APs that things are connecting to so I ...