Questions tagged [wireshark]
For questions about Wireshark, a packet analyzer
287
questions
0
votes
1
answer
73
views
How to determine which TCP payloads should be combined to form a complete PDU?
I understand that the TCP itself provides a byte stream connection, but has no idea nor does it care what its payload is and how it is segmented to fit into individual packets that travel on the wire.
...
- 81.5k
1
vote
1
answer
3k
views
Wireshark not capturing packets?
I am trying to use Wireshark, but for some reason it won't capture packets. I've used it once before and it worked just fine, so I can't understand why it's not working right now. The only thing I've ...
0
votes
2
answers
65
views
Does ARP play any role when we try to access a website?
I was looking to find the role of ARP whenever say we want to access a website like google.com. I found some answers here.
But, when I tried to use Wireshark to check the ARP request I wasn't able to ...
- 81.5k
3
votes
1
answer
49
views
Wireshark - how to merge packets of Data of a bin file which was sent over the LAN?
I tried to send a ~80k dat file over the LAN from one device to another and then combine the captured packets back to the original file, for testing and learning purposes.
I couldn't find any way to ...
- 73
1
vote
1
answer
102
views
Does Wireshark capture all Wi-Fi traffic under the same access point even with WPA encryption?
I know that free unencrypted-Wi-Fi is dangerous since all the traffic in the same AP is visible.
Does Wireshark capture all Wi-Fi traffic under the same access point even with WPA encryption?
0
votes
2
answers
172
views
How to include in the filter http requests satisfying the given condition and the respective responses?
For example, I want to see all the http requests containing the given string in the http.host field and their respective responses. Right now my filter is frame.number < 61403 and http.host ...
- 81.5k
2
votes
0
answers
50
views
Average bits/s report in tshark
Does tshark has an option to report average bit/s statistics of the capture which appear in Wireshark at the end of Statistics > Capture File Properties?
I'm trying to automate a load test and need ...
- 121
3
votes
2
answers
6k
views
What is the difference between tshark, dumpcap and others for collecting/sniffing traffic?
Wireshark provides tshark and dumpcap, and I've also seen people using the wireshark binary or even tcpdump to collect/save network traffic.
Online it is claimed that tshark or dumpcap hardly make a ...
2
votes
1
answer
691
views
Wireshark capture showing a TCP packet with no flags [closed]
In our network, I captured a TCP packet by Wireshark that has no flag set.
What is the meaning of such packet ? Here is the dissection in text format :
Frame 1: 54 bytes on wire (432 bits), 54 bytes ...
- 103
2
votes
1
answer
70
views
Is there a way to precompile data from pcap to speed up booting wireshark?
Is there a way to precompile/precalculate the data from a pcap file to speed up booting wireshark?
I have a big pcap file and wireshark is crashing when I try to open it.
I know it sums and computes a ...
- 141
1
vote
3
answers
121
views
UDP encrypted packets
I am analysing a Wireshark capture as part of understanding UDP/TCP, DNS and HTTP concepts and how packets are sent.
I found an interesting sequence of messages in the Wireshark file, but I am not ...
- 1,931
9
votes
1
answer
10k
views
ARP request with unicast MAC?
Regarding ARP requests, I got to believe that the destination MAC address was in all situations the broadcast address.
Yet I got across this Wireshark capture:
I just cannot understand the 3rd ...
- 165
0
votes
0
answers
41
views
TLS decryption with wireshark
I know there are many similar articles about how to do this, but I cant seem to get any of them to work, and I cant get any info to tell me what the problem might be.
I am following this: https://www....
- 101
5
votes
1
answer
1k
views
How to disable TCP window scaling in Wireshark?
I am currently using Wireshark version 1.12.2.
When I searched the internet I found this result
(source: wireshark.org)
But, this option is not available in my version. I could see only the "...
- 205
0
votes
1
answer
99
views
Wireshark -Protocol Hierarchy Omitting large amount of subprotocol traffic
Based on responses, I've repositioned this question to ask why the subprotocols under my TCP header are not accounting for the sum of packet transfer. (I.E TCP= 97.1%, remainder of packet content not ...
CommunityBot
- 1
0
votes
1
answer
98
views
Where are the characters in Wireshark's Packet Bytes pane?
I've just updated my Wireshark to version 4.0.1, and now, while investigating a TCP communication, I don't see any textual information anymore in the Packet Bytes pane, as you can see from this ...
- 131
0
votes
0
answers
245
views
Monitor UDP packet in wireshark
I am trying to monitor udp packets from server to client in Wireshark at both end. Can I get any clue in Wireshark with which I find out that ok this specific udp packet is what I sent and received at ...
- 13
0
votes
1
answer
44
views
Wireshark: Internet Control Message Protocol
I've installed Wireshark on my Windows machine, and to my knowledge, the section at the bottom represents the packets in their octal and ASCII form. When I click on the IP version & the header ...
- 81.5k
1
vote
1
answer
39
views
troubleshoot pcaps for BACnet industrial protocol in OT/IoT
I have a test bench that I am trying to learn how to take pcaps with WireShark for BACnet UDP traffic of building automation devices.
4 devices in total on test bench:
Windows 10 OS running ...
- 81.5k
0
votes
1
answer
250
views
Wireshark: Cannot find frame type of packets
I am getting used to Wireshark operation and currently, I am investigating different frames (control, management, data frame) and using filter in these links (https://mrncciew.com/2014/10/02/cwap-802-...
CommunityBot
- 1
0
votes
2
answers
475
views
Monitoring comms between 2 devices on a switch using Wireshark
I am new to networking and now learning wireshark now and unable to capture comms between 2 devices. This is my setup.
When I connect to "Ethernet" (Ethernet is the Ethernet port at my PC) ...
- 81.5k
1
vote
1
answer
402
views
Does Ethernet have a header and a trailer?
I have read that Ethernet have a header and a trailer, but in Wireshark I can only see an Ethernet header and no Ethernet trailer.
- 81.5k
1
vote
1
answer
734
views
What is "cflow" in ipfix？
I am learning ipfix and found a cmd like this:
tshark -r ipfix.cap -n -d udp.port==4379，cflow -O cflow
What does the cflow part mean here?
I was also told to filter cflow if I use Wireshark in ...
CommunityBot
- 1
0
votes
1
answer
141
views
Wireshark only shows single HTTP request instead of its constituent TCP packets and ACKs
To my understanding, in packet no.39, the post request actually consists of multiple tcp packets getting sent, and they all get acked once by no.40. The server has received it. Now, the server sends ...
- 81.5k
0
votes
2
answers
247
views
Determine network traffic on a switch port in bit/s from Wireshark
I am trying to understand how much data is flowing through a specific port on a Cisco (Stratix) switch. I have set up Port Mirroring so that I can capture the traffic on the target port via Wireshark. ...
- 81.5k
2
votes
2
answers
92
views
Loops in routers-same packet?
Considering a loop topology between a few routers with a host connected to one of them, when it's default routing directs to the cycle.
Even when observing Wireshark, how can we know its the same ...
- 1,568
1
vote
1
answer
1k
views
How does wireshark calculate the TCP length when there is no header indiciating such?
In wireshark, you have this field:
[TCP Segment Len: 1380] # How is this calculated?
My assumption is using the IP headers plus TCP's.
TCP Segment Len = IP Total Length - IHL - TCP Header Length
In ...
- 81.5k
0
votes
1
answer
55
views
What does this Wireshark capture filter do
I was reading through a guide where I saw the following Wireshark capture filter used.
(tcp[2:2] > 1500 and tcp[2:2] < 1550)
I had a brief look over Wireshark's website which listed their ...
- 81.5k
0
votes
0
answers
10
views
ARP Header's Mac Address set to 0 when broadcasting [duplicate]
I'm learning about Ethernet frames and networks and Wireshark has been very useful.
I have a doubt regarding broadcasting and ARP request, since we don't know the Target MAC address, in the ARP's ...
- 1
0
votes
1
answer
56
views
Wireshark on ProCurve 1810G - IEEE802a protocol
I have recently started a networking course and acquired an old HP ProCurve 1810G-24 Switch to play about with, which I have updated to the latest firmware.
I'm using Wireshark to monitor the traffic, ...
- 81.5k
0
votes
1
answer
74
views
Unwanted Wireshark Optimizing Received 802.11 Channel for Frames
I am trying to run an experiment which involves monitoring 3 wireless channels simultaneously in Wireshark which would allow me to see a single frame captured 3 times on each channel.
To do this, I ...
CommunityBot
- 1
0
votes
1
answer
335
views
Probe Request getting\understanding Information Elements (IEs)
I'm trying to read Information Elements (IEs) from the probe request
can't seem to understand the stracture of it
as I undersatnd it size can be 0-2312 bytes
but how do I know how many there are?
I ...
2
votes
1
answer
535
views
Wireshark not showing Frequency/Channel
I am using Ubuntu 18, and wireshark-gtk. I followed this and this tutorials to create a column named/showing frequency/channel.
But all the packets I captured have no frequency/channel showing.I tried ...
- 151
3
votes
1
answer
218
views
Wireshark Decrypting IKEv1 Text PSK to Hex
I'm trying to debug a Cisco VPN setup as part of a Uni Lab (so please don't worry about posting of keys etc. it's just a toy setup with no internet facing connection).
I want to decrypt the IKEv1 ...
- 278
6
votes
3
answers
40k
views
How to view MTU size in Wireshark?
I've been reading about maximum transmission unit (MTU) which is the size of the largest protocol data unit (PDU) that can be communicated in a single, network layer, transaction.
I'm generating a ...
- 81.5k
6
votes
2
answers
603
views
TCP Flow-control questions that drives me mad
This is a capture of a TCP session when I was downloading the 10Mb file from an FTP server. The server has an ICW of 10x MSS, so this means that the server can initially send 10 segments without ...
- 186
0
votes
0
answers
14
views
Some random client requests fails with unexpected TCP [RST] packets [duplicate]
I have a service doing listen that serves clients over a TCP sockets connection with a raw binary protocol.
The principle is basic: the connection is established, the client sends a request with data, ...
- 1
1
vote
1
answer
44
views
what are scenario where re-transmission packets can been seen in wireshark logs
While troubleshooting i came across this challenge ,able to see retransmission packets continuously in packet capture . please let me know in what scenarios this retransmission packets are seen.
- 850
0
votes
1
answer
117
views
Homeplug av frame
I want to check differences between a frame sent by a pc connected to an homeplug and one pc connected directly with the gateway/router. When i sniff packets i cannot see any differences in the frame, ...
- 81.5k
0
votes
2
answers
183
views
Detecting Ethernet over power by packets
If someone plugs an Ethernet over power (EOP, Homeplug) into the switch and then connect elsewhere in the building, can I detect this device by sniffing the packets with tools like Wireshark or ...
- 5
1
vote
1
answer
523
views
Capturing dot1q packets with Wireshark on a PC
I have spent the last few hours trying to capture some trunk packets so I can see and examine the dot1q VLAN field. I have tried mirroring the trunk port to my PC using the following commands on Cisco ...
CommunityBot
- 1
4
votes
3
answers
226
views
How does any program identify the protocol header next from TCP?
I need to know how does wireshark or any other program knows the protocol next from TCP. I mean, for instance:
The Ethernet layer has a field named Type which carry the IPv04
The Internet protocol ...
CommunityBot
- 1
0
votes
1
answer
111
views
Wireshark, Bluetooth interface, identify errors in frames/re-transmissions
I'm using WireShark on Ubuntu 20.04.1 LTS.
I listen to bluetooth0 interface while transferring a file from my laptop to my smartphone over Bluetooth(using Blueman).
Without any transfer, I get packets ...
- 111
0
votes
1
answer
584
views
Wireshark display filter to hide Protocol = 802.11?
[Note: reposted here from SO...]
I've set Wireshark's capture filter set to capture only packets from the MAC address of interest, but the result is dominated by zillions of packets whose Protocol is &...
- 66.9k
0
votes
1
answer
173
views
Wireshark filter to display al packets which have traveled through switch
I am trying to filter my packets based on whether or not they went through specific switch. This router has the ip address of 192.168.1.235. Is their a way to do this using Wireshark filters?
- 81.5k
1
vote
1
answer
103
views
Five consequtive SYN-messages from client to server
the 5 packages 333 -> 337. What are those and why does the client do this? More generally, why does the client send five SYN-messages to the server?
- 98.4k
1
vote
1
answer
476
views
Suspicious flood of ARP requests [closed]
I'm trying to review a Wireshark capture and it seems the network is heavily flooded with ARP requests that make no sense to me.
The destination is not "Broadcast", but some unknown DELL ...
- 81.5k
26
votes
2
answers
34k
views
Difference between sniffer tools
I am unsure what the following networking tools do. They all seem to do a similar thing.
First some background. I am familiar with cisco IOS. I am doing some linux networking experimentation with ...
- 98.4k
0
votes
0
answers
104
views
Man in the middle legitimate packet inspection
we're trying to debug a faulty Panasonic Mobile softphone SIP app (both Android & Apple versions), as many calls are randomly dropped unexpectedly.
This is the conceptual connection diagram:
We ...
- 163
0
votes
3
answers
16k
views
how to capture DHCP packets in wireshark
Hy!
I want to capture DHCP packets in Wireshark but I did not receive any. Not my filter wrong, I don't get any. So I think I can't trigger the DHCP communications.
my filters:
dhcp
bootp
udp.port == ...
- 191