Questions tagged [wireshark]

For questions about Wireshark, a packet analyzer

Filter by
Sorted by
Tagged with
0 votes
0 answers
15 views

Implementing Video streaming restrictions based on hourly usage at home [closed]

I'm new at networking, so my question might be basic or naive. I want to implement restrictions for mobile devices if it is being used to view videos for more than an hour continuously then its ...
Trying Tobemyself's user avatar
0 votes
0 answers
19 views

Unable to preserve HTTP/2 headers list when extracting frame using editcap. Hex Dump Matches [closed]

When I used editcap to extract a HTTP/2 Frame from a Captured PCAP using tcpdump, the HTTP/2 headers don't show up in extracted frame, but the Hex dump matches. I am using the below editcap command to ...
Devavrat Agnihotri's user avatar
0 votes
0 answers
31 views

TCP blocked until the acknowledgment received

I am currently facing an issue in my application where the TCP messages seem to be blocked until an acknowledgment received. Specifically, the subsequent messages wait for the acknowledgment of the ...
myprogramistoobusywitherrors's user avatar
0 votes
0 answers
18 views

RPCAP active mode usage or deployment example

This is in reference to https://www.winpcap.org/docs/docs_40_2/html/group__remote.html, the RPCAP protocol. Wireshark (on Windows) has support for connecting to passive mode deployment. And the RPCAP ...
David's user avatar
  • 101
0 votes
1 answer
101 views

Wireshark filter for specific SYN packet which never received a SYN/ACK

Is there a way in wireshark to find out a single SYN that does not get answered by SYN/ACK?
fsociety's user avatar
  • 893
0 votes
0 answers
31 views

Can TCP seq number increment after sending a FIN?

I have an embedded device connecting to a server (on AWS Application ELB if that matters). Both the server and the client are instructed to close the connection after one request. I noticed that the ...
xxljob's user avatar
  • 1
0 votes
1 answer
118 views

Why am I not capturing any ICMP packets on wireshark?

I am doing a lab where we are meant to ping an address and use wireshark to capture ICMP packets when we ping that address. WHen I run the wireshark capture with the ICMP filter on and ping my address,...
Garrett LaCoste's user avatar
0 votes
2 answers
78 views

Does ARP play any role when we try to access a website?

I was looking to find the role of ARP whenever say we want to access a website like google.com. I found some answers here. But, when I tried to use Wireshark to check the ARP request I wasn't able to ...
Vedanta Mohapatra's user avatar
3 votes
1 answer
60 views

Wireshark - how to merge packets of Data of a bin file which was sent over the LAN?

I tried to send a ~80k dat file over the LAN from one device to another and then combine the captured packets back to the original file, for testing and learning purposes. I couldn't find any way to ...
Nikita 웃's user avatar
0 votes
1 answer
184 views

How to determine which TCP payloads should be combined to form a complete PDU?

I understand that the TCP itself provides a byte stream connection, but has no idea nor does it care what its payload is and how it is segmented to fit into individual packets that travel on the wire. ...
miran80's user avatar
  • 103
2 votes
0 answers
62 views

Average bits/s report in tshark

Does tshark has an option to report average bit/s statistics of the capture which appear in Wireshark at the end of Statistics > Capture File Properties? I'm trying to automate a load test and need ...
jackhab's user avatar
  • 121
2 votes
1 answer
87 views

Is there a way to precompile data from pcap to speed up booting wireshark?

Is there a way to precompile/precalculate the data from a pcap file to speed up booting wireshark? I have a big pcap file and wireshark is crashing when I try to open it. I know it sums and computes a ...
Bruno Lebtag's user avatar
1 vote
3 answers
174 views

UDP encrypted packets

I am analysing a Wireshark capture as part of understanding UDP/TCP, DNS and HTTP concepts and how packets are sent. I found an interesting sequence of messages in the Wireshark file, but I am not ...
Tita's user avatar
  • 123
1 vote
1 answer
6k views

Wireshark not capturing packets?

I am trying to use Wireshark, but for some reason it won't capture packets. I've used it once before and it worked just fine, so I can't understand why it's not working right now. The only thing I've ...
Tita's user avatar
  • 123
0 votes
0 answers
43 views

TLS decryption with wireshark

I know there are many similar articles about how to do this, but I cant seem to get any of them to work, and I cant get any info to tell me what the problem might be. I am following this: https://www....
Alan's user avatar
  • 101
0 votes
1 answer
124 views

Where are the characters in Wireshark's Packet Bytes pane?

I've just updated my Wireshark to version 4.0.1, and now, while investigating a TCP communication, I don't see any textual information anymore in the Packet Bytes pane, as you can see from this ...
Dominique's user avatar
  • 131
0 votes
0 answers
315 views

Monitor UDP packet in wireshark

I am trying to monitor udp packets from server to client in Wireshark at both end. Can I get any clue in Wireshark with which I find out that ok this specific udp packet is what I sent and received at ...
Nifty's user avatar
  • 13
0 votes
1 answer
48 views

Wireshark: Internet Control Message Protocol

I've installed Wireshark on my Windows machine, and to my knowledge, the section at the bottom represents the packets in their octal and ASCII form. When I click on the IP version & the header ...
oussama101's user avatar
1 vote
1 answer
44 views

troubleshoot pcaps for BACnet industrial protocol in OT/IoT

I have a test bench that I am trying to learn how to take pcaps with WireShark for BACnet UDP traffic of building automation devices. 4 devices in total on test bench: Windows 10 OS running ...
bbartling's user avatar
  • 113
0 votes
2 answers
675 views

Monitoring comms between 2 devices on a switch using Wireshark

I am new to networking and now learning wireshark now and unable to capture comms between 2 devices. This is my setup. When I connect to "Ethernet" (Ethernet is the Ethernet port at my PC) ...
GeneCode's user avatar
  • 103
1 vote
1 answer
527 views

Does Ethernet have a header and a trailer?

I have read that Ethernet have a header and a trailer, but in Wireshark I can only see an Ethernet header and no Ethernet trailer.
user85108's user avatar
0 votes
1 answer
154 views

Wireshark only shows single HTTP request instead of its constituent TCP packets and ACKs

To my understanding, in packet no.39, the post request actually consists of multiple tcp packets getting sent, and they all get acked once by no.40. The server has received it. Now, the server sends ...
JohnDoeyyy's user avatar
0 votes
2 answers
287 views

Determine network traffic on a switch port in bit/s from Wireshark

I am trying to understand how much data is flowing through a specific port on a Cisco (Stratix) switch. I have set up Port Mirroring so that I can capture the traffic on the target port via Wireshark. ...
Greg Smith's user avatar
1 vote
1 answer
1k views

How does wireshark calculate the TCP length when there is no header indiciating such?

In wireshark, you have this field: [TCP Segment Len: 1380] # How is this calculated? My assumption is using the IP headers plus TCP's. TCP Segment Len = IP Total Length - IHL - TCP Header Length In ...
jerry's user avatar
  • 13
2 votes
2 answers
101 views

Loops in routers-same packet?

Considering a loop topology between a few routers with a host connected to one of them, when it's default routing directs to the cycle. Even when observing Wireshark, how can we know its the same ...
Danny Blozrov's user avatar
0 votes
1 answer
310 views

Wireshark: Cannot find frame type of packets

I am getting used to Wireshark operation and currently, I am investigating different frames (control, management, data frame) and using filter in these links (https://mrncciew.com/2014/10/02/cwap-802-...
Nguyen Huy's user avatar
0 votes
2 answers
216 views

How to include in the filter http requests satisfying the given condition and the respective responses?

For example, I want to see all the http requests containing the given string in the http.host field and their respective responses. Right now my filter is frame.number < 61403 and http.host ...
mark's user avatar
  • 101
0 votes
1 answer
58 views

What does this Wireshark capture filter do

I was reading through a guide where I saw the following Wireshark capture filter used. (tcp[2:2] > 1500 and tcp[2:2] < 1550) I had a brief look over Wireshark's website which listed their ...
questioner's user avatar
0 votes
0 answers
10 views

ARP Header's Mac Address set to 0 when broadcasting [duplicate]

I'm learning about Ethernet frames and networks and Wireshark has been very useful. I have a doubt regarding broadcasting and ARP request, since we don't know the Target MAC address, in the ARP's ...
ad_valle's user avatar
0 votes
1 answer
69 views

Wireshark on ProCurve 1810G - IEEE802a protocol

I have recently started a networking course and acquired an old HP ProCurve 1810G-24 Switch to play about with, which I have updated to the latest firmware. I'm using Wireshark to monitor the traffic, ...
Paul Smith's user avatar
0 votes
1 answer
107 views

Wireshark -Protocol Hierarchy Omitting large amount of subprotocol traffic

Based on responses, I've repositioned this question to ask why the subprotocols under my TCP header are not accounting for the sum of packet transfer. (I.E TCP= 97.1%, remainder of packet content not ...
N S's user avatar
  • 3
0 votes
1 answer
377 views

Probe Request getting\understanding Information Elements (IEs)

I'm trying to read Information Elements (IEs) from the probe request can't seem to understand the stracture of it as I undersatnd it size can be 0-2312 bytes but how do I know how many there are? I ...
Afik_Android's user avatar
3 votes
1 answer
245 views

Wireshark Decrypting IKEv1 Text PSK to Hex

I'm trying to debug a Cisco VPN setup as part of a Uni Lab (so please don't worry about posting of keys etc. it's just a toy setup with no internet facing connection). I want to decrypt the IKEv1 ...
DavidM's user avatar
  • 171
0 votes
1 answer
75 views

Unwanted Wireshark Optimizing Received 802.11 Channel for Frames

I am trying to run an experiment which involves monitoring 3 wireless channels simultaneously in Wireshark which would allow me to see a single frame captured 3 times on each channel. To do this, I ...
Taylor Artunian's user avatar
0 votes
0 answers
16 views

Some random client requests fails with unexpected TCP [RST] packets [duplicate]

I have a service doing listen that serves clients over a TCP sockets connection with a raw binary protocol. The principle is basic: the connection is established, the client sends a request with data, ...
Ariel's user avatar
  • 1
1 vote
1 answer
46 views

what are scenario where re-transmission packets can been seen in wireshark logs

While troubleshooting i came across this challenge ,able to see retransmission packets continuously in packet capture . please let me know in what scenarios this retransmission packets are seen.
user avatar
0 votes
1 answer
127 views

Homeplug av frame

I want to check differences between a frame sent by a pc connected to an homeplug and one pc connected directly with the gateway/router. When i sniff packets i cannot see any differences in the frame, ...
claudio's user avatar
0 votes
2 answers
204 views

Detecting Ethernet over power by packets

If someone plugs an Ethernet over power (EOP, Homeplug) into the switch and then connect elsewhere in the building, can I detect this device by sniffing the packets with tools like Wireshark or ...
claudio's user avatar
0 votes
1 answer
120 views

Wireshark, Bluetooth interface, identify errors in frames/re-transmissions

I'm using WireShark on Ubuntu 20.04.1 LTS. I listen to bluetooth0 interface while transferring a file from my laptop to my smartphone over Bluetooth(using Blueman). Without any transfer, I get packets ...
Aviel Fedida's user avatar
0 votes
1 answer
687 views

Wireshark display filter to hide Protocol = 802.11?

[Note: reposted here from SO...] I've set Wireshark's capture filter set to capture only packets from the MAC address of interest, but the result is dominated by zillions of packets whose Protocol is &...
fearless_fool's user avatar
1 vote
1 answer
521 views

Suspicious flood of ARP requests [closed]

I'm trying to review a Wireshark capture and it seems the network is heavily flooded with ARP requests that make no sense to me. The destination is not "Broadcast", but some unknown DELL ...
Guest's user avatar
  • 11
0 votes
0 answers
118 views

Man in the middle legitimate packet inspection

we're trying to debug a faulty Panasonic Mobile softphone SIP app (both Android & Apple versions), as many calls are randomly dropped unexpectedly. This is the conceptual connection diagram: We ...
Riccardo's user avatar
  • 163
1 vote
1 answer
2k views

How do I set a display filter in wireshark that sorts by destination broadcast?

1 0.000000 Vmware_90:07:7b Broadcast ARP 60 Who has 192.168.185.144? Tell 192.168.185.7 27 0.995837 28.144.7.123 192.168.185.144 HTTP 1177 HTTP/1.1 200 OK (...
Dr. Suess Official's user avatar
0 votes
1 answer
596 views

Capture traffic flowing through a Brocade switch remotely

I am currently doing packet capture through mirroring with Wireshark as mentioned in this post I can mirror the traffic to a port physically jacked into and analyze the packets redirected there w/ ...
Frankie Guzikowski's user avatar
0 votes
3 answers
17k views

how to capture DHCP packets in wireshark

Hy! I want to capture DHCP packets in Wireshark but I did not receive any. Not my filter wrong, I don't get any. So I think I can't trigger the DHCP communications. my filters: dhcp bootp udp.port == ...
Finaria's user avatar
2 votes
1 answer
808 views

IPv4 and UDP/TCP packets inside of ICMP packet?

A week ago, after opening wireshark, i was surprised by seing a storm of ICMP packets from different IP addresses. While deep analysing of thoses packets, i noticed that those ICMP packets contains ...
Yazid's user avatar
  • 23
0 votes
1 answer
71 views

When I send the ICMP packet with 4000B, but the IPv4 segment calculated 4008B

When I send the ICMP packet with data size as 4000B for testing the IP fragment. ping 192.168.2.1 -c1 -s4000 and the Wireshark captured it, Whether is is because of ICMP header? but we know ICMP ...
244boy's user avatar
  • 1,747
0 votes
2 answers
3k views

What's the Destination unreachable ICMP packet(ICMP payload the UDP) usage? [closed]

In my Mac(192.168.2.228), it will send ICMP packet to my house's router (192.168.2.1). with the info Destination unreachable (Port unreachable) and in the Wireshark packet detail panel, there ...
244boy's user avatar
  • 1,747
5 votes
2 answers
6k views

What is the difference between tshark, dumpcap and others for collecting/sniffing traffic?

Wireshark provides tshark and dumpcap, and I've also seen people using the wireshark binary or even tcpdump to collect/save network traffic. Online it is claimed that tshark or dumpcap hardly make a ...
rugk's user avatar
  • 153
1 vote
1 answer
720 views

Why the different colours for SACK markers in Wireshark's tcptrace graph?

Wireshark's tcptrace time sequence graph shows a good deal of information, but I cannot find a document that spells out exactly what it all means. It's broadly similar to the original tcptrace except ...
Dave Turner's user avatar

1
2 3 4 5 6