Questions tagged [wireshark]

For questions about Wireshark, a packet analyzer

Filter by
Sorted by
Tagged with
45
votes
2answers
268k views

Why do I see a RST, ACK packet instead of a RST packet?

Looking in Wireshark, I often see TCP Streams end with a RST, ACK packet instead of a RST packet. Anyone know why this is? An example of what I see: SYN SYN, ACK ...data... RST, ACK Wireshark is ...
26
votes
4answers
107k views

How can I capture traffic on Cisco IOS switches?

For investigating a problem in client to server communication, I need to capture packets for analysis. However it's not allowed to install a packet analyzer, such as Wireshark or tcpdump, on client or ...
26
votes
2answers
31k views

Difference between sniffer tools

I am unsure what the following networking tools do. They all seem to do a similar thing. First some background. I am familiar with cisco IOS. I am doing some linux networking experimentation with ...
17
votes
2answers
27k views

Traceroute - every packet has TTL == 1

I'm working on Wireshark lab-IP in Computer networking - A top down approach and I don't understand why every packet that normally expired has a TTL of 1. Here is my Wireshark capture file. https://...
9
votes
2answers
5k views

Why does Wireshark show Version TLS 1.2 here instead of TLS 1.3?

I'm accessing TLS 1.3 test server "https://tls13.pinterjann.is" via a java http client using TLS 1.3. Everything seems to work fine as the html response indicates: What I don't understand: Why does ...
8
votes
1answer
506 views

Will WireShark assume packets are DUP or Retransmitted?

I have a SPAN on two different switch ports which are going to the same sniffer. Host A's connecting port is SPANed, and host B's connecting port is SPANed as well. Because it's a router on a stick ...
8
votes
1answer
2k views

Wireshark Filter - OSPF Database Description Link State ID

Within Wireshark, how would one write a display filter for the IP address of the Link State ID within an OSPF Database Description packet? The Link State ID addresses are found within the LSA Header ...
7
votes
1answer
21k views

tcp.length and tcp.data wireshark filters

I was playing with Wireshark and noticed two filters: tcp.len and tcp.data. What is the difference between the two? As far as I know, the tcp.len (length) field tells how many bytes of data travel ...
7
votes
2answers
1k views

Monitoring without Port Mirroring

A quick overview of the problem We've been experiencing some issues with our bandwidth usage lately which I fear may be due to misuse (whether intentional or not) of our internet in the office. I ...
7
votes
2answers
17k views

How can I capture traffic on a Brocade XMR, MLX, CER or CES?

How can I perform a packet analysis on traffic flowing through a Brocade XMR, MLX, CER or CES without having to install a specific software on any of the remote endpoints ?
6
votes
2answers
6k views

Why Don’t Probe Requests for Specific SSIDs include BSSIDs

I'm looking at WLAN traffic captured from wireshark on monitor mode and notice that out of the 67,000 probe requests, 99.08% have the destination set to FF:FF:FF:FF:FF:FF (Broadcast). The thing is, ...
6
votes
1answer
6k views

ARP request unicast MAC?

I would like to ask, with ARP request I got to believe that the destination MAC address was in all situations a broadcast address. Yet I got across a wireshark capture: I just cannot understand the ...
6
votes
1answer
3k views

Wireshark TCP and window size

Can please someone explain me on the below screenshot why host 192.168.1.200 on packet 9 sends an ACK for the packets 6 - 7 - 8? The total packet size does not correspond to the window size agreed. If ...
6
votes
1answer
2k views

Don't fragment set, still being fragmented

Working with a network entirely consisting of Cisco router/switch, two devices (server and client) are talking to each other across a network, about 5 hops of routers including a nexus 7k. Server ...
6
votes
2answers
429 views

TCP Flow-control questions that drives me mad

This is a capture of a TCP session when I was downloading the 10Mb file from an FTP server. The server has an ICW of 10x MSS, so this means that the server can initially send 10 segments without ...
6
votes
1answer
2k views

Wireshark tcp.len and data.len missmatch

What is the difference between tcp.len and data.len filters? I thought that both mean data size traveling in the segment (not including TCP header). I have a problem related to MTU issue and I'm ...
5
votes
1answer
12k views

Filter ARP packets with specific “Who has” and “Tell” IP

Here is an ARP packet: 192.168.1.3 ARP 62 Who has 192.168.1.1? Tell 192.168.1.2 How to display only ARP packets with 1) specific "Who has" IP (192.168.1.1 here)? 2) specific "Tell" IP (192....
5
votes
1answer
197 views

Capture first packets with Wireshark

If I start capturing on an interface (e.g. wlan0) with Wireshark while it's down, and then bring the interface up, Wireshark stops the capture and I have to restart it. This way I can't see packets ...
5
votes
1answer
36k views

Troubleshooting “TCP Zero Window” Issues

I'm currently having a problem troubleshooting a trading application. Let me give a simple diagram of the current network setup (Gov't Stock Exchange Network Router)X-->(256kbs Leased Line)<--X(...
4
votes
2answers
266 views

Why are there no packets for PC on the same network in Wireshark?

I'm trying to isolate SQL commands sent from another PC on the same subnet using WireShark. I know the PC's local IP address (first three numbers are the same as my PC's) but when I start the capture ...
4
votes
2answers
10k views

Wireshark, extract all http headers

I have some .pcap from which I would like to extract all http headers. By using the filters I'm able to display only Http requests but what I would like is to be able to extract/display/print/export ...
4
votes
2answers
15k views

How to view MTU size in Wireshark?

I've been reading about maximum transmission unit (MTU) which is the size of the largest protocol data unit (PDU) that can be communicated in a single, network layer, transaction. I'm generating a ...
4
votes
3answers
7k views

Why do i only see QUIC and not UDP during capture in wireshark?

I've been using wireshark and noticed that I no longer see UDP but QUIC, why is this the case?
4
votes
5answers
14k views

Packet sniffing promiscuously on MacBook Air [closed]

I'm on a MacBook air, and I got a book form the library about wireless network security. I've been following pretty diligently, but it seems like no matter what I do I cannot capture packets of other ...
4
votes
1answer
2k views

Decode with known PSK in DTLS

I have a wireshark capture of implementations of DTLS protocol. I have the PSK and I have converted it to corresponding hex.DTLS uses TLS_PSK_WITH_AES_128_CCM_8 cipher suite. How can I decrypt the ...
4
votes
1answer
3k views

Creating a Network Diagram with .pcap

I have a Wireshark .pcap Capture of around 500k packets and I would like to enumerate a Network Diagram with all the Routers, Switches, PCs etc. Is Wireshark capable of such procedure or is there any ...
4
votes
2answers
2k views

Decoding wpa-psk traffic with Wireshark

I want to plot how much data each client is using from a wpa-psk protected access point (that I control). For that I intend to monitor all traffic for a couple of days. However I can't decode the TCP ...
4
votes
1answer
871 views

How to disable TCP window scaling in Wireshark?

I am currently using Wireshark version 1.12.2. When I searched the internet I found this result But, this option is not available in my version. I could see only the "Relative sequence numbers" check ...
4
votes
1answer
147 views

Copying bytes from Wireshark

Should it be possible for someone to export the binary payload (say from a UDP packet) captured from Wireshark and later send this stream as a "valid" UDP packet? Longer story: I've captured a DNS ...
3
votes
3answers
383 views

How to tell which one is the source IP and MAC address of the data being received?

I have to work with an FPGA module already running a code written by someone else. I have no access to the FPGA code. Now the setup is something like this:- FPGA is connected to the pc via ethernet ...
3
votes
3answers
4k views

Computer booting due to (I guess) untraceable wake-on-lan packet

There is a desktop computer in our LAN that keeps booting almost every time seconds after it has been turned off manually. I suspected it was a Wake-on-LAN issue since the beginning, and it looks ...
3
votes
1answer
437 views

How can a UDP Client and a packet sniffer run on the same machine?

In my understanding, if you have a UDP socket client that is bound to a particular port, then a second UDP client on the same machine can't bind to the same port. If this is the case, then how can a ...
3
votes
3answers
99 views

How does any program identify the protocol header next from TCP?

I need to know how does wireshark or any other program knows the protocol next from TCP. I mean, for instance: The Ethernet layer has a field named Type which carry the IPv04 The Internet protocol ...
3
votes
3answers
362 views

tcp handshake on a http response. which frame is actually the payload?

I am capturing/trying to understand a http response capture in wireshark. On packet capture row 78,79, i am seeing the HTTP headers (no 78) and body (no 79) in the capture's payload. On packet ...
3
votes
3answers
11k views

Wireshark shows SSDP protocol for HTTP request, and not TCP protocol

I have been learning ICND1 through CBTNuggets.com course online, I have recently started a video where the instructor is guiding on how to use Wireshark to trace the communication. He first used DNS ...
3
votes
1answer
2k views

Calculating 3 way TCP Handshake Duration

I want to calculate the time that the 3 way TCP handshake occupies through wireshark between a server and a client. I get something like: Time Source Destination Info 0.00 ...
3
votes
1answer
200 views

Is it possible to capture packets between two devices in a wifi

I have little knowledge of how wifis work. I have these: A device which creates a wifi network when turned on. (Lets call this DeviceA) A mobile app, when connected to the above wifi network, ...
3
votes
1answer
4k views

How can I filter out particular MAC addresses when running tshark on a pcap trace?

I've tried a number of things, but none of them seem to do the trick. I want to run this command: tshark -r data.pcap -T fields -e frame.time_epoch -e frame.len but to have it ignore any packets ...
3
votes
1answer
1k views

Spurious restransmission to a server behind pfsense NAT

i'm trying to connect to my ssh test server that i setup behind a pfsense firewall via nat on port 22. When I sniff packet on my laptop (WAN side of pfsense) trying to connect to the server, SYN is ...
3
votes
2answers
2k views

Determine protocol decode for non-standard ports in Wireshark

I'm wondering if there is a heuristic plug-in, software or other process for determining protocol when a non-standard TCP port is used. Wireshark will decode packets based on the well-known port ...
3
votes
1answer
1k views

What Does ICMP Code 9 Mean For a Type 8 Packet?

I am currently doing an assignment that requires us to generate ICMP packet with various types and codes. I have consulted the RFCs as well as various other place. Many of the types and codes I get ...
3
votes
1answer
10k views

Wireshark Etherent II Trailer field?

What does Trailer field stand for in Ethernet II frame? Can you explain this on following cases (length of ARP packet is 28 bits)? Case #1: Ethernet II Destination: Broadcast (ff:ff:ff:ff:ff:ff) ...
3
votes
1answer
2k views

Wireshark Protocol Hierarchy explanation

I'm trying to calculate how much bandwidth is utilised for a particular protocol, at the different layers. Wireshark Protocol Hierarchy gives something like this: Protocol %Bytes Bytes Frame ...
3
votes
1answer
279 views

IPv6 Wireshark filter for partial IP address

I would like to create a display filter with the last 4 octets of an IPv6 address. Basically, I have the mac address with me and I want to filter for the IP address xxxx:xxxx:xxxx:xxxx:113:5005:80:...
3
votes
2answers
261 views

Which tcpdump metrics reveal server connectivity problems vs client problems?

I am attempting to diagnose a ~45 sec drop (to 0 Kbps) in the reported RTMP streaming bitrate in OBS while publishing a live stream. I had been running a tcpdump the entire time using Apple's ...
3
votes
1answer
2k views

How can I plot the TCP RTT graph in Wireshark?

I'm suspecting one of our Host is not performing well in the TCP protocol Level.I have tried to plot the TCP RTT graph using tcp.analysis option in the IO graph.However,I'm not finding the right ...
3
votes
1answer
2k views

Why is the FCS not included in most ethernet frames?

I turned on the calculatin of the FCS Checksum in wireshark. There wasn't a single correct checksum in the whole 500MB packet dump. I asume the reason for this is that the field is simply not used for ...
3
votes
2answers
7k views

Ethernet padding

I'm using Wireshark for my project. I sent a ping over to Google.com and Wireshark said that the length was 57 bytes(when I received the reply it was 60 bytes long and it contained 6 bits of padding. ...
3
votes
1answer
479 views

Convert BFR to PCAP without loosing nano-second resolution

i have a BFR file from a customer that contains nano-second resolution. OI can convert it via tshark, but it does not retain the nano-second resolution on the end pcap file. Is there a way to convert ...
3
votes
1answer
4k views

Why should one server repeatedly ARP for the same host?

I am trying to use Wireshark to find the root cause of a particularly slow network, and started by examining Broadcast traffic. Not only does Broadcast traffic represent over 25% of total traffic (at ...

1
2 3 4 5