Questions tagged [wireshark]

For questions about Wireshark, a packet analyzer

Filter by
Sorted by
Tagged with
18
votes
2answers
29k views

Traceroute - every packet has TTL == 1

I'm working on Wireshark lab-IP in Computer networking - A top down approach and I don't understand why every packet that normally expired has a TTL of 1. Here is my Wireshark capture file. https://...
26
votes
4answers
110k views

How can I capture traffic on Cisco IOS switches?

For investigating a problem in client to server communication, I need to capture packets for analysis. However it's not allowed to install a packet analyzer, such as Wireshark or tcpdump, on client or ...
48
votes
2answers
314k views

Why do I see a RST, ACK packet instead of a RST packet?

Looking in Wireshark, I often see TCP Streams end with a RST, ACK packet instead of a RST packet. Anyone know why this is? An example of what I see: SYN SYN, ACK ...data... RST, ACK Wireshark is ...
8
votes
1answer
9k views

ARP request unicast MAC?

I would like to ask, with ARP request I got to believe that the destination MAC address was in all situations a broadcast address. Yet I got across a wireshark capture: I just cannot understand the ...
8
votes
2answers
18k views

How can I capture traffic on a Brocade XMR, MLX, CER or CES?

How can I perform a packet analysis on traffic flowing through a Brocade XMR, MLX, CER or CES without having to install a specific software on any of the remote endpoints ?
26
votes
2answers
33k views

Difference between sniffer tools

I am unsure what the following networking tools do. They all seem to do a similar thing. First some background. I am familiar with cisco IOS. I am doing some linux networking experimentation with ...
7
votes
2answers
6k views

Why Don’t Probe Requests for Specific SSIDs include BSSIDs

I'm looking at WLAN traffic captured from wireshark on monitor mode and notice that out of the 67,000 probe requests, 99.08% have the destination set to FF:FF:FF:FF:FF:FF (Broadcast). The thing is, ...
7
votes
1answer
41k views

Troubleshooting "TCP Zero Window" Issues

I'm currently having a problem troubleshooting a trading application. Let me give a simple diagram of the current network setup (Gov't Stock Exchange Network Router)X-->(256kbs Leased Line)<--X(...
4
votes
3answers
8k views

Why do i only see QUIC and not UDP during capture in wireshark?

I've been using wireshark and noticed that I no longer see UDP but QUIC, why is this the case?
7
votes
2answers
2k views

Monitoring without Port Mirroring

A quick overview of the problem We've been experiencing some issues with our bandwidth usage lately which I fear may be due to misuse (whether intentional or not) of our internet in the office. I ...
4
votes
1answer
3k views

Creating a Network Diagram with .pcap

I have a Wireshark .pcap Capture of around 500k packets and I would like to enumerate a Network Diagram with all the Routers, Switches, PCs etc. Is Wireshark capable of such procedure or is there any ...
1
vote
1answer
84 views

Get Avarage network trafic data in MB [closed]

Currently i am using a MiroTik router, that has build in a data trafic graph. Its werry well working, but it cant be saved and it shows only last 24h/ last week/ mounth /year. I would like to have ...
0
votes
1answer
1k views

Unable to capture http request in Wireshark [closed]

I am working in wireshark. I am monitoring the wifi traffic on the same network. We have 6 pc's there and one machine was installed on wireshark to capture wifi traffic. I got my team mates Ip ...