Questions tagged [wireshark]
For questions about Wireshark, a packet analyzer
294
questions
53
votes
2
answers
361k
views
Why do I see a RST, ACK packet instead of a RST packet?
Looking in Wireshark, I often see TCP Streams end with a RST, ACK packet instead of a RST packet. Anyone know why this is?
An example of what I see:
SYN
SYN, ACK
...data...
RST, ACK
Wireshark is ...
- 611
27
votes
4
answers
114k
views
How can I capture traffic on Cisco IOS switches?
For investigating a problem in client to server communication, I need to capture packets for analysis. However it's not allowed to install a packet analyzer, such as Wireshark or tcpdump, on client or ...
- 3,374
27
votes
2
answers
34k
views
Difference between sniffer tools
I am unsure what the following networking tools do. They all seem to do a similar thing.
First some background. I am familiar with cisco IOS. I am doing some linux networking experimentation with ...
- 373
19
votes
2
answers
31k
views
Traceroute - every packet has TTL == 1
I'm working on Wireshark lab-IP in Computer networking - A top down approach and I don't understand why every packet that normally expired has a TTL of 1.
Here is my Wireshark capture file.
https://...
- 193
13
votes
2
answers
14k
views
Why does Wireshark show Version TLS 1.2 here instead of TLS 1.3?
I'm accessing TLS 1.3 test server "https://tls13.pinterjann.is" via a java http client using TLS 1.3. Everything seems to work fine as the html response indicates:
What I don't understand: Why does ...
- 421
9
votes
1
answer
10k
views
ARP request with unicast MAC?
Regarding ARP requests, I got to believe that the destination MAC address was in all situations the broadcast address.
Yet I got across this Wireshark capture:
I just cannot understand the 3rd ...
- 279
8
votes
2
answers
18k
views
How can I capture traffic on a Brocade XMR, MLX, CER or CES?
How can I perform a packet analysis on traffic flowing through a Brocade XMR, MLX, CER or CES without having to install a specific software on any of the remote endpoints ?
- 1,687
8
votes
1
answer
524
views
Will WireShark assume packets are DUP or Retransmitted?
I have a SPAN on two different switch ports which are going to the same sniffer. Host A's connecting port is SPANed, and host B's connecting port is SPANed as well. Because it's a router on a stick ...
- 258
8
votes
1
answer
2k
views
Wireshark Filter - OSPF Database Description Link State ID
Within Wireshark, how would one write a display filter for the IP address of the Link State ID within an OSPF Database Description packet? The Link State ID addresses are found within the LSA Header ...
- 963
7
votes
2
answers
7k
views
Why Don’t Probe Requests for Specific SSIDs include BSSIDs
I'm looking at WLAN traffic captured from wireshark on monitor mode and notice that out of the 67,000 probe requests, 99.08% have the destination set to FF:FF:FF:FF:FF:FF (Broadcast).
The thing is, ...
- 71
7
votes
1
answer
26k
views
tcp.length and tcp.data wireshark filters
I was playing with Wireshark and noticed two filters: tcp.len and tcp.data. What is the difference between the two? As far as I know, the tcp.len (length) field tells how many bytes of data travel ...
- 205
7
votes
2
answers
2k
views
Monitoring without Port Mirroring
A quick overview of the problem
We've been experiencing some issues with our bandwidth usage lately which I fear may be due to misuse (whether intentional or not) of our internet in the office. I ...
- 173
7
votes
1
answer
44k
views
Troubleshooting "TCP Zero Window" Issues
I'm currently having a problem troubleshooting a trading application. Let me give a simple diagram of the current network setup
(Gov't Stock Exchange Network Router)X-->(256kbs Leased Line)<--X(...
- 111
6
votes
3
answers
42k
views
How to view MTU size in Wireshark?
I've been reading about maximum transmission unit (MTU) which is the size of the largest protocol data unit (PDU) that can be communicated in a single, network layer, transaction.
I'm generating a ...
- 311
6
votes
1
answer
3k
views
Wireshark TCP and window size
Can please someone explain me on the below screenshot why host 192.168.1.200 on packet 9 sends an ACK for the packets 6 - 7 - 8? The total packet size does not correspond to the window size agreed. If ...
- 63
6
votes
1
answer
3k
views
Don't fragment set, still being fragmented
Working with a network entirely consisting of Cisco router/switch, two devices (server and client) are talking to each other across a network, about 5 hops of routers including a nexus 7k.
Server ...
- 512
6
votes
1
answer
24k
views
Filter ARP packets with specific "Who has" and "Tell" IP
Here is an ARP packet:
192.168.1.3 ARP 62 Who has 192.168.1.1? Tell 192.168.1.2
How to display only ARP packets with
1) specific "Who has" IP (192.168.1.1 here)?
2) specific "Tell" IP (192....
- 63
6
votes
2
answers
622
views
TCP Flow-control questions that drives me mad
This is a capture of a TCP session when I was downloading the 10Mb file from an FTP server. The server has an ICW of 10x MSS, so this means that the server can initially send 10 segments without ...
- 61
6
votes
1
answer
3k
views
Wireshark tcp.len and data.len missmatch
What is the difference between tcp.len and data.len filters? I thought that both mean data size traveling in the segment (not including TCP header). I have a problem related to MTU issue and I'm ...
- 238
5
votes
2
answers
6k
views
What is the difference between tshark, dumpcap and others for collecting/sniffing traffic?
Wireshark provides tshark and dumpcap, and I've also seen people using the wireshark binary or even tcpdump to collect/save network traffic.
Online it is claimed that tshark or dumpcap hardly make a ...
- 153
5
votes
2
answers
20k
views
Wireshark, extract all http headers
I have some .pcap from which I would like to extract all http headers.
By using the filters I'm able to display only Http requests but what I would like is to be able to extract/display/print/export ...
- 153
5
votes
2
answers
18k
views
Ethernet padding
I'm using Wireshark for my project. I sent a ping over to Google.com and Wireshark said that the length was 57 bytes(when I received the reply it was 60 bytes long and it contained 6 bits of padding.
...
- 51
5
votes
1
answer
4k
views
Decode with known PSK in DTLS
I have a wireshark capture of implementations of DTLS protocol. I have the PSK and I have converted it to corresponding hex.DTLS uses TLS_PSK_WITH_AES_128_CCM_8 cipher suite.
How can I decrypt the ...
- 181
5
votes
1
answer
3k
views
IPv6 Wireshark filter for partial IP address
I would like to create a display filter with the last 4 octets of an IPv6 address. Basically, I have the mac address with me and I want to filter for the IP address xxxx:xxxx:xxxx:xxxx:113:5005:80:...
- 1,412
5
votes
1
answer
1k
views
How to disable TCP window scaling in Wireshark?
I am currently using Wireshark version 1.12.2.
When I searched the internet I found this result
(source: wireshark.org)
But, this option is not available in my version. I could see only the "...
- 379
5
votes
1
answer
6k
views
Calculating 3 way TCP Handshake Duration
I want to calculate the time that the 3 way TCP handshake occupies through wireshark between a server and a client.
I get something like:
Time Source Destination Info
0.00 ...
- 165
5
votes
1
answer
298
views
Capture first packets with Wireshark
If I start capturing on an interface (e.g. wlan0) with Wireshark while it's down, and then bring the interface up, Wireshark stops the capture and I have to restart it. This way I can't see packets ...
- 165
4
votes
2
answers
314
views
Why are there no packets for PC on the same network in Wireshark?
I'm trying to isolate SQL commands sent from another PC on the same subnet using WireShark. I know the PC's local IP address (first three numbers are the same as my PC's) but when I start the capture ...
- 143
4
votes
3
answers
9k
views
Why do i only see QUIC and not UDP during capture in wireshark?
I've been using wireshark and noticed that I no longer see UDP but QUIC, why is this the case?
- 151
4
votes
3
answers
251
views
How does any program identify the protocol header next from TCP?
I need to know how does wireshark or any other program knows the protocol next from TCP. I mean, for instance:
The Ethernet layer has a field named Type which carry the IPv04
The Internet protocol ...
- 43
4
votes
5
answers
16k
views
Packet sniffing promiscuously on MacBook Air [closed]
I'm on a MacBook air, and I got a book form the library about wireless network security. I've been following pretty diligently, but it seems like no matter what I do I cannot capture packets of other ...
- 183
4
votes
1
answer
4k
views
Creating a Network Diagram with .pcap
I have a Wireshark .pcap Capture of around 500k packets and I would like to enumerate a Network Diagram with all the Routers, Switches, PCs etc.
Is Wireshark capable of such procedure or is there any ...
- 143
4
votes
2
answers
2k
views
Decoding wpa-psk traffic with Wireshark
I want to plot how much data each client is using from a wpa-psk protected access point (that I control). For that I intend to monitor all traffic for a couple of days. However I can't decode the TCP ...
- 161
4
votes
1
answer
4k
views
Why is the FCS not included in most ethernet frames?
I turned on the calculatin of the FCS Checksum in wireshark. There wasn't a single correct checksum in the whole 500MB packet dump. I asume the reason for this is that the field is simply not used for ...
- 239
4
votes
1
answer
206
views
Copying bytes from Wireshark
Should it be possible for someone to export the binary payload (say from a UDP packet) captured from Wireshark and later send this stream as a "valid" UDP packet?
Longer story:
I've captured a DNS ...
- 163
3
votes
2
answers
23k
views
Ethernet frame IG/LG bit explanation - Wireshark
I have a screenshot of an ethernet packet frame from Wireshark.
I need to explain what is the meaning of these marked lines (with dots and zeros).
I searched in web, but still I don't have an answer.
...
- 31
3
votes
3
answers
523
views
How to tell which one is the source IP and MAC address of the data being received?
I have to work with an FPGA module already running a code written by someone else. I have no access to the FPGA code.
Now the setup is something like this:-
FPGA is connected to the pc via ethernet ...
3
votes
1
answer
372
views
Why my computer is making this ARP requests to external (Gov) IP addresses?
I am posting here because I randomly installed Wireshark and I found that for 2 minutes or so (later it stopped) my computer started making ARP requests to IP addresses outside my local network, and ...
- 33
3
votes
3
answers
4k
views
Computer booting due to (I guess) untraceable wake-on-lan packet
There is a desktop computer in our LAN that keeps booting almost every time seconds after it has been turned off manually.
I suspected it was a Wake-on-LAN issue since the beginning, and it looks ...
- 191
3
votes
1
answer
555
views
How can a UDP Client and a packet sniffer run on the same machine?
In my understanding, if you have a UDP socket client that is bound to a particular port, then a second UDP client on the same machine can't bind to the same port.
If this is the case, then how can a ...
- 133
3
votes
1
answer
8k
views
What does a "Frame" relate to in the WIreshark packet details pane?
Currently learning to use Wireshark.
When I take a capture and click on one of it's rows, I see the following breakdown in the "Packet Details" pane:
Frame
Linux Cooked Capture
Internet Protocol ...
- 175
3
votes
3
answers
828
views
tcp handshake on a http response. which frame is actually the payload?
I am capturing/trying to understand a http response capture in wireshark.
On packet capture row 78,79, i am seeing the HTTP headers (no 78) and body (no 79) in the capture's payload.
On packet ...
- 529
3
votes
3
answers
850
views
What more information can I get from filtering by MAC address rather than IP?
I want to do some very simple traffic analysis for a single device. I'm using tcpdump to collect this data. Is there an advantage to using a MAC address capture filter over a (static) IP address for ...
- 163
3
votes
3
answers
14k
views
Wireshark shows SSDP protocol for HTTP request, and not TCP protocol
I have been learning ICND1 through CBTNuggets.com course online,
I have recently started a video where the instructor is guiding on how to use Wireshark to trace the communication.
He first used DNS ...
- 449
3
votes
2
answers
5k
views
What are the differences between TCP iRTT and ICMP Ping?
I’m attempting to estimate latency between my PC and any servers/clients it interacts with. I don’t want to use Ping for various reasons (requires both ends to allow it, would require additional ...
3
votes
4
answers
5k
views
Why does Wireshark not show all traffic (especially GVSP data)
This discussion reveals that Wireshark may not capture every packet on a network. In that case, the reason pertains to TCP data.
I am specifically interested in seeing (extremely bulky) GVSP data. As ...
- 133
3
votes
1
answer
2k
views
Spurious restransmission to a server behind pfsense NAT
i'm trying to connect to my ssh test server that i setup behind a pfsense firewall via nat on port 22.
When I sniff packet on my laptop (WAN side of pfsense) trying to connect to the server, SYN is ...
- 81
3
votes
1
answer
244
views
Wireshark Decrypting IKEv1 Text PSK to Hex
I'm trying to debug a Cisco VPN setup as part of a Uni Lab (so please don't worry about posting of keys etc. it's just a toy setup with no internet facing connection).
I want to decrypt the IKEv1 ...
- 171
3
votes
1
answer
430
views
Is it possible to capture packets between two devices in a wifi
I have little knowledge of how wifis work.
I have these:
A device which creates a wifi network when turned on. (Lets call this DeviceA)
A mobile app, when connected to the above wifi network, ...
- 133
3
votes
1
answer
8k
views
How can I filter out particular MAC addresses when running tshark on a pcap trace?
I've tried a number of things, but none of them seem to do the trick. I want to run this command:
tshark -r data.pcap -T fields -e frame.time_epoch -e frame.len
but to have it ignore any packets ...
- 163