Questions tagged [wireshark]

For questions about Wireshark, a packet analyzer

Filter by
Sorted by
Tagged with
53 votes
2 answers
361k views

Why do I see a RST, ACK packet instead of a RST packet?

Looking in Wireshark, I often see TCP Streams end with a RST, ACK packet instead of a RST packet. Anyone know why this is? An example of what I see: SYN SYN, ACK ...data... RST, ACK Wireshark is ...
packetwrassler's user avatar
27 votes
4 answers
114k views

How can I capture traffic on Cisco IOS switches?

For investigating a problem in client to server communication, I need to capture packets for analysis. However it's not allowed to install a packet analyzer, such as Wireshark or tcpdump, on client or ...
Stefan's user avatar
  • 3,374
27 votes
2 answers
34k views

Difference between sniffer tools

I am unsure what the following networking tools do. They all seem to do a similar thing. First some background. I am familiar with cisco IOS. I am doing some linux networking experimentation with ...
s5s's user avatar
  • 373
19 votes
2 answers
31k views

Traceroute - every packet has TTL == 1

I'm working on Wireshark lab-IP in Computer networking - A top down approach and I don't understand why every packet that normally expired has a TTL of 1. Here is my Wireshark capture file. https://...
ksp0422's user avatar
  • 193
13 votes
2 answers
14k views

Why does Wireshark show Version TLS 1.2 here instead of TLS 1.3?

I'm accessing TLS 1.3 test server "https://tls13.pinterjann.is" via a java http client using TLS 1.3. Everything seems to work fine as the html response indicates: What I don't understand: Why does ...
user120513's user avatar
9 votes
1 answer
10k views

ARP request with unicast MAC?

Regarding ARP requests, I got to believe that the destination MAC address was in all situations the broadcast address. Yet I got across this Wireshark capture: I just cannot understand the 3rd ...
PesaThe's user avatar
  • 279
8 votes
2 answers
18k views

How can I capture traffic on a Brocade XMR, MLX, CER or CES?

How can I perform a packet analysis on traffic flowing through a Brocade XMR, MLX, CER or CES without having to install a specific software on any of the remote endpoints ?
Benjamin A.'s user avatar
  • 1,687
8 votes
1 answer
524 views

Will WireShark assume packets are DUP or Retransmitted?

I have a SPAN on two different switch ports which are going to the same sniffer. Host A's connecting port is SPANed, and host B's connecting port is SPANed as well. Because it's a router on a stick ...
LIK's user avatar
  • 258
8 votes
1 answer
2k views

Wireshark Filter - OSPF Database Description Link State ID

Within Wireshark, how would one write a display filter for the IP address of the Link State ID within an OSPF Database Description packet? The Link State ID addresses are found within the LSA Header ...
THE DOCTOR's user avatar
7 votes
2 answers
7k views

Why Don’t Probe Requests for Specific SSIDs include BSSIDs

I'm looking at WLAN traffic captured from wireshark on monitor mode and notice that out of the 67,000 probe requests, 99.08% have the destination set to FF:FF:FF:FF:FF:FF (Broadcast). The thing is, ...
JHAWN's user avatar
  • 71
7 votes
1 answer
26k views

tcp.length and tcp.data wireshark filters

I was playing with Wireshark and noticed two filters: tcp.len and tcp.data. What is the difference between the two? As far as I know, the tcp.len (length) field tells how many bytes of data travel ...
Matjaž's user avatar
  • 205
7 votes
2 answers
2k views

Monitoring without Port Mirroring

A quick overview of the problem We've been experiencing some issues with our bandwidth usage lately which I fear may be due to misuse (whether intentional or not) of our internet in the office. I ...
aaroncatlin's user avatar
7 votes
1 answer
44k views

Troubleshooting "TCP Zero Window" Issues

I'm currently having a problem troubleshooting a trading application. Let me give a simple diagram of the current network setup (Gov't Stock Exchange Network Router)X-->(256kbs Leased Line)<--X(...
Rufi's user avatar
  • 111
6 votes
3 answers
42k views

How to view MTU size in Wireshark?

I've been reading about maximum transmission unit (MTU) which is the size of the largest protocol data unit (PDU) that can be communicated in a single, network layer, transaction. I'm generating a ...
Sabrina's user avatar
  • 311
6 votes
1 answer
3k views

Wireshark TCP and window size

Can please someone explain me on the below screenshot why host 192.168.1.200 on packet 9 sends an ACK for the packets 6 - 7 - 8? The total packet size does not correspond to the window size agreed. If ...
user3249's user avatar
6 votes
1 answer
3k views

Don't fragment set, still being fragmented

Working with a network entirely consisting of Cisco router/switch, two devices (server and client) are talking to each other across a network, about 5 hops of routers including a nexus 7k. Server ...
eric's user avatar
  • 512
6 votes
1 answer
24k views

Filter ARP packets with specific "Who has" and "Tell" IP

Here is an ARP packet: 192.168.1.3 ARP 62 Who has 192.168.1.1? Tell 192.168.1.2 How to display only ARP packets with 1) specific "Who has" IP (192.168.1.1 here)? 2) specific "Tell" IP (192....
user207114's user avatar
6 votes
2 answers
622 views

TCP Flow-control questions that drives me mad

This is a capture of a TCP session when I was downloading the 10Mb file from an FTP server. The server has an ICW of 10x MSS, so this means that the server can initially send 10 segments without ...
mohmkamal's user avatar
6 votes
1 answer
3k views

Wireshark tcp.len and data.len missmatch

What is the difference between tcp.len and data.len filters? I thought that both mean data size traveling in the segment (not including TCP header). I have a problem related to MTU issue and I'm ...
MABC's user avatar
  • 238
5 votes
2 answers
6k views

What is the difference between tshark, dumpcap and others for collecting/sniffing traffic?

Wireshark provides tshark and dumpcap, and I've also seen people using the wireshark binary or even tcpdump to collect/save network traffic. Online it is claimed that tshark or dumpcap hardly make a ...
rugk's user avatar
  • 153
5 votes
2 answers
20k views

Wireshark, extract all http headers

I have some .pcap from which I would like to extract all http headers. By using the filters I'm able to display only Http requests but what I would like is to be able to extract/display/print/export ...
gervais.b's user avatar
  • 153
5 votes
2 answers
18k views

Ethernet padding

I'm using Wireshark for my project. I sent a ping over to Google.com and Wireshark said that the length was 57 bytes(when I received the reply it was 60 bytes long and it contained 6 bits of padding. ...
user35754's user avatar
5 votes
1 answer
4k views

Decode with known PSK in DTLS

I have a wireshark capture of implementations of DTLS protocol. I have the PSK and I have converted it to corresponding hex.DTLS uses TLS_PSK_WITH_AES_128_CCM_8 cipher suite. How can I decrypt the ...
Kalu's user avatar
  • 181
5 votes
1 answer
3k views

IPv6 Wireshark filter for partial IP address

I would like to create a display filter with the last 4 octets of an IPv6 address. Basically, I have the mac address with me and I want to filter for the IP address xxxx:xxxx:xxxx:xxxx:113:5005:80:...
Maverick's user avatar
  • 1,412
5 votes
1 answer
1k views

How to disable TCP window scaling in Wireshark?

I am currently using Wireshark version 1.12.2. When I searched the internet I found this result (source: wireshark.org) But, this option is not available in my version. I could see only the "...
Ezio's user avatar
  • 379
5 votes
1 answer
6k views

Calculating 3 way TCP Handshake Duration

I want to calculate the time that the 3 way TCP handshake occupies through wireshark between a server and a client. I get something like: Time Source Destination Info 0.00 ...
baskon1's user avatar
  • 165
5 votes
1 answer
298 views

Capture first packets with Wireshark

If I start capturing on an interface (e.g. wlan0) with Wireshark while it's down, and then bring the interface up, Wireshark stops the capture and I have to restart it. This way I can't see packets ...
Nesa's user avatar
  • 165
4 votes
2 answers
314 views

Why are there no packets for PC on the same network in Wireshark?

I'm trying to isolate SQL commands sent from another PC on the same subnet using WireShark. I know the PC's local IP address (first three numbers are the same as my PC's) but when I start the capture ...
ScottyB's user avatar
  • 143
4 votes
3 answers
9k views

Why do i only see QUIC and not UDP during capture in wireshark?

I've been using wireshark and noticed that I no longer see UDP but QUIC, why is this the case?
夢のの夢's user avatar
4 votes
3 answers
251 views

How does any program identify the protocol header next from TCP?

I need to know how does wireshark or any other program knows the protocol next from TCP. I mean, for instance: The Ethernet layer has a field named Type which carry the IPv04 The Internet protocol ...
Luis A's user avatar
  • 43
4 votes
5 answers
16k views

Packet sniffing promiscuously on MacBook Air [closed]

I'm on a MacBook air, and I got a book form the library about wireless network security. I've been following pretty diligently, but it seems like no matter what I do I cannot capture packets of other ...
OneChillDude's user avatar
4 votes
1 answer
4k views

Creating a Network Diagram with .pcap

I have a Wireshark .pcap Capture of around 500k packets and I would like to enumerate a Network Diagram with all the Routers, Switches, PCs etc. Is Wireshark capable of such procedure or is there any ...
Jonathan Davies's user avatar
4 votes
2 answers
2k views

Decoding wpa-psk traffic with Wireshark

I want to plot how much data each client is using from a wpa-psk protected access point (that I control). For that I intend to monitor all traffic for a couple of days. However I can't decode the TCP ...
MasterScrat's user avatar
4 votes
1 answer
4k views

Why is the FCS not included in most ethernet frames?

I turned on the calculatin of the FCS Checksum in wireshark. There wasn't a single correct checksum in the whole 500MB packet dump. I asume the reason for this is that the field is simply not used for ...
davidb's user avatar
  • 239
4 votes
1 answer
206 views

Copying bytes from Wireshark

Should it be possible for someone to export the binary payload (say from a UDP packet) captured from Wireshark and later send this stream as a "valid" UDP packet? Longer story: I've captured a DNS ...
Jmoney38's user avatar
  • 163
3 votes
2 answers
23k views

Ethernet frame IG/LG bit explanation - Wireshark

I have a screenshot of an ethernet packet frame from Wireshark. I need to explain what is the meaning of these marked lines (with dots and zeros). I searched in web, but still I don't have an answer. ...
Jakub's user avatar
  • 31
3 votes
3 answers
523 views

How to tell which one is the source IP and MAC address of the data being received?

I have to work with an FPGA module already running a code written by someone else. I have no access to the FPGA code. Now the setup is something like this:- FPGA is connected to the pc via ethernet ...
simarmannsingh's user avatar
3 votes
1 answer
372 views

Why my computer is making this ARP requests to external (Gov) IP addresses?

I am posting here because I randomly installed Wireshark and I found that for 2 minutes or so (later it stopped) my computer started making ARP requests to IP addresses outside my local network, and ...
Jokin's user avatar
  • 33
3 votes
3 answers
4k views

Computer booting due to (I guess) untraceable wake-on-lan packet

There is a desktop computer in our LAN that keeps booting almost every time seconds after it has been turned off manually. I suspected it was a Wake-on-LAN issue since the beginning, and it looks ...
karmapolice's user avatar
3 votes
1 answer
555 views

How can a UDP Client and a packet sniffer run on the same machine?

In my understanding, if you have a UDP socket client that is bound to a particular port, then a second UDP client on the same machine can't bind to the same port. If this is the case, then how can a ...
Fred's user avatar
  • 133
3 votes
1 answer
8k views

What does a "Frame" relate to in the WIreshark packet details pane?

Currently learning to use Wireshark. When I take a capture and click on one of it's rows, I see the following breakdown in the "Packet Details" pane: Frame Linux Cooked Capture Internet Protocol ...
MarkMark's user avatar
  • 175
3 votes
3 answers
828 views

tcp handshake on a http response. which frame is actually the payload?

I am capturing/trying to understand a http response capture in wireshark. On packet capture row 78,79, i am seeing the HTTP headers (no 78) and body (no 79) in the capture's payload. On packet ...
Noob's user avatar
  • 529
3 votes
3 answers
850 views

What more information can I get from filtering by MAC address rather than IP?

I want to do some very simple traffic analysis for a single device. I'm using tcpdump to collect this data. Is there an advantage to using a MAC address capture filter over a (static) IP address for ...
Yousef Amar's user avatar
3 votes
3 answers
14k views

Wireshark shows SSDP protocol for HTTP request, and not TCP protocol

I have been learning ICND1 through CBTNuggets.com course online, I have recently started a video where the instructor is guiding on how to use Wireshark to trace the communication. He first used DNS ...
Sufiyan Ghori's user avatar
3 votes
2 answers
5k views

What are the differences between TCP iRTT and ICMP Ping?

I’m attempting to estimate latency between my PC and any servers/clients it interacts with. I don’t want to use Ping for various reasons (requires both ends to allow it, would require additional ...
Matthew Dunlop's user avatar
3 votes
4 answers
5k views

Why does Wireshark not show all traffic (especially GVSP data)

This discussion reveals that Wireshark may not capture every packet on a network. In that case, the reason pertains to TCP data. I am specifically interested in seeing (extremely bulky) GVSP data. As ...
omatai's user avatar
  • 133
3 votes
1 answer
2k views

Spurious restransmission to a server behind pfsense NAT

i'm trying to connect to my ssh test server that i setup behind a pfsense firewall via nat on port 22. When I sniff packet on my laptop (WAN side of pfsense) trying to connect to the server, SYN is ...
aurel's user avatar
  • 81
3 votes
1 answer
244 views

Wireshark Decrypting IKEv1 Text PSK to Hex

I'm trying to debug a Cisco VPN setup as part of a Uni Lab (so please don't worry about posting of keys etc. it's just a toy setup with no internet facing connection). I want to decrypt the IKEv1 ...
DavidM's user avatar
  • 171
3 votes
1 answer
430 views

Is it possible to capture packets between two devices in a wifi

I have little knowledge of how wifis work. I have these: A device which creates a wifi network when turned on. (Lets call this DeviceA) A mobile app, when connected to the above wifi network, ...
nakiya's user avatar
  • 133
3 votes
1 answer
8k views

How can I filter out particular MAC addresses when running tshark on a pcap trace?

I've tried a number of things, but none of them seem to do the trick. I want to run this command: tshark -r data.pcap -T fields -e frame.time_epoch -e frame.len but to have it ignore any packets ...
Yousef Amar's user avatar

1
2 3 4 5 6