Questions tagged [wireshark]

For questions about Wireshark, a packet analyzer

Filter by
Sorted by
Tagged with
1
vote
0answers
32 views

How to fetch application specific url's by using wireshark in Windows-8/10? [closed]

Its my first time using wireshark and I am encountered with one major problem i.e How will i sniff url/api that a particular application/software is hitting which is installed in Windows-8/10 by using ...
3
votes
1answer
3k views

How can I plot the TCP RTT graph in Wireshark?

I'm suspecting one of our Host is not performing well in the TCP protocol Level.I have tried to plot the TCP RTT graph using tcp.analysis option in the IO graph.However,I'm not finding the right ...
1
vote
1answer
101 views

what the meaning displayed value in statistic capture wireshark

i have capture some packet with wireshark, in statistic capture windows there is value named Displayed like this then I was figure out that i can count the Capture value (109) from the capure ...
0
votes
1answer
557 views

What is "cflow" in ipfix?

I am learning ipfix and found a cmd like this: tshark -r ipfix.cap -n -d udp.port==4379,cflow -O cflow What does the cflow part mean here? I was also told to filter cflow if I use Wireshark in ...
2
votes
1answer
552 views

Probe Request Channel Information

I have used wireshark to capture Wi-fi frames, and have configured my AP to operate on Channel 1. Now in one of the transactions that occur, I find my mobile device sending a probe request in the ...
1
vote
1answer
355 views

Delayed Ack every 3 segments

I was studying some wireshark captures. I noticed that though Ack's are sent every other packet like i was expecting due to delayed TCP ack, i noticed that at some times it is acking every 3 segments. ...
3
votes
1answer
4k views

Calculating 3 way TCP Handshake Duration

I want to calculate the time that the 3 way TCP handshake occupies through wireshark between a server and a client. I get something like: Time Source Destination Info 0.00 ...
2
votes
1answer
1k views

Npcap Loopback Adapter not showing PING results in Wireshark

I've a server process and a client process running on my machine. To capture the packets transmitted between them, I've installed the Npcap Loopback Adapter as suggested in the ever-so-famous ...
5
votes
2answers
24k views

How to view MTU size in Wireshark?

I've been reading about maximum transmission unit (MTU) which is the size of the largest protocol data unit (PDU) that can be communicated in a single, network layer, transaction. I'm generating a ...
1
vote
2answers
5k views

Can not capture DHCP offer with wireshark?

I'd like to capture DHCP packets with wireshark. When I use the filter: "udp.port == 67 or udp.port == 68" I only see the Discover and Request broadcasts. While I thought the DHCP offer also gets ...
3
votes
3answers
480 views

tcp handshake on a http response. which frame is actually the payload?

I am capturing/trying to understand a http response capture in wireshark. On packet capture row 78,79, i am seeing the HTTP headers (no 78) and body (no 79) in the capture's payload. On packet ...
5
votes
1answer
245 views

Capture first packets with Wireshark

If I start capturing on an interface (e.g. wlan0) with Wireshark while it's down, and then bring the interface up, Wireshark stops the capture and I have to restart it. This way I can't see packets ...
1
vote
2answers
245 views

Method in wireshark to filter for any in a set of mac addresses but no others

I am sniffing for several devices in a congested environment. I'm wondering if there is an easy way to accomplish filtering that I don't know of. I have two APs that things are connecting to so I ...
2
votes
1answer
84 views

Extracting a bit rate

I'm trying to figure out what is the lowest layer of the OSI model that can be used to extract a bit rate (through a packet sniffer). I'm not sure if it's possible through only the physical layer, or ...
2
votes
2answers
294 views

Wireshark - Displaying HTTP requests with comments only

It seems like a simple filter, but I don't find anything about it on StackExchange or Google itself, nor could I accomplish this myself (only part of it). What I have now is following: http.request....
4
votes
2answers
2k views

Decoding wpa-psk traffic with Wireshark

I want to plot how much data each client is using from a wpa-psk protected access point (that I control). For that I intend to monitor all traffic for a couple of days. However I can't decode the TCP ...
3
votes
1answer
299 views

Is it possible to capture packets between two devices in a wifi

I have little knowledge of how wifis work. I have these: A device which creates a wifi network when turned on. (Lets call this DeviceA) A mobile app, when connected to the above wifi network, ...
1
vote
1answer
396 views

Wireshark - Application Layer with Data

I am not sure if the title is the correct one. When transfering files over the network, in Wireshark, we see abbreviations like: - PK -> Beginning of a file. Is it a compressed file? - OFT2 -> ...
1
vote
2answers
94 views

Why are WLAN packages translated to Ethernet packages by Wireshark?

When using Wireshark on my MacBook, I see all my packages wrapped inside Ethernet II frames, although I'm connected wirelessly, which I already figured must be because they are translated from 802.11 ...
0
votes
1answer
112 views

How to prevent getting other machine traffic in LAN on interface

I capture traffic of VMware machine in LAN (host pc is in LAN) with Wireshark. But I see a lot of garbage traffic like LLMNR, NBNS, STP, ... . I know I cat prevent capturing such traffic by using ...
1
vote
1answer
113 views

Capturing traffic on wire from an endpoint

Say I have my computer connected to a router with an Ethernet cable. How do I capture all packets on the wire? (possibly with using some kind of hardware that's much cheaper than another computer) I ...
1
vote
1answer
1k views

Capture auto-negotiation ability flags

I'm performing a set of tests on an embedded device, one of which is "To verify that the control system and instrument supports auto-negotiation". I need to verify that "Expected auto-negotiation is ...
1
vote
1answer
500 views

Wireshark lua Dissector sharing common variable among all packets

I just started with lua plugins in wireshark. I wanted to know if it is possible to create like a global object that can be called by dissector in one packet and used by dissector called by another ...
3
votes
1answer
6k views

How can I filter out particular MAC addresses when running tshark on a pcap trace?

I've tried a number of things, but none of them seem to do the trick. I want to run this command: tshark -r data.pcap -T fields -e frame.time_epoch -e frame.len but to have it ignore any packets ...
1
vote
1answer
137 views

Mac Address Representation wireshark

I'm a little confused. I just learned about two different mac address representations(hexadecimal and bit-reversed representation) in IEEE 802 When hexadecimal representation is used the octets are ...
2
votes
1answer
435 views

Rapid Spanning Tree Protocol - RSTP Bridge Id isn't RSTP-Priority + Ethernet-MAC

what is the difference between the eth.src Address and the Bridge-System-Id? Sometimes they are the same but mostly not. Attached you will find a screenshot where they are the same.
1
vote
1answer
4k views

Calculated window size value in SYN segment differ from calculated value in ACK segment

I am a bit confused about the window size value in some TCP segments. I think I understand the theory behind the window size field and how it is modified when the window scale option is provided ...
3
votes
1answer
87 views

Total data length transfered in 802.11 using Wireshark

How could I get the total size of a some data that has been transfered using UDP over a wireless channel from a Wireshark capture trace ? I have read somewhere that the sender advertise the total size ...
2
votes
3answers
5k views

How to find packet loss in Wireshark network dump file?

I am a beginner in Wireshark, and I would like to find some problems with a TCP connection. Basically, I have some sockets timing out, and I would like to find out if the message (packet) being sent ...
3
votes
1answer
3k views

Why is the FCS not included in most ethernet frames?

I turned on the calculatin of the FCS Checksum in wireshark. There wasn't a single correct checksum in the whole 500MB packet dump. I asume the reason for this is that the field is simply not used for ...
3
votes
2answers
1k views

Receive order of bits in network packet fields

I've been interested in networking for awhile and have a basic question that was never answered or brought up in any of my classes. I was looking at the 802.11 WLAN frame format: It looks like the ...
3
votes
3answers
588 views

What more information can I get from filtering by MAC address rather than IP?

I want to do some very simple traffic analysis for a single device. I'm using tcpdump to collect this data. Is there an advantage to using a MAC address capture filter over a (static) IP address for ...
2
votes
1answer
632 views

Search for IP addresses in SNMP data field using Wireshark

TLDR: How can I find IP addresses that is communicated via SNMP in the data =>variable-bindings field ? I am using wireshark to view my pcap and I use the snmp filter. But I would like to go ...
1
vote
1answer
164 views

Different results when same WireShark pcap file opened in Unbuntu17.04 and later Windows 10

Using Ubertooth, a bluetooth sniffer, I created a pcap file in Unbuntu that captured some data. When I opened that file in WireShark 2.4.1 in Windows 10 it showed more information in the SMP data ...
2
votes
2answers
812 views

Can 'wireshark' truly sense response in nansecond?

I can see the timestamp in Wireshark which ranges up to nanoseconds. But I was just wondering whether it can sense nanoseconds cause in my trace I can't see any activities in the nanosecond range, ...
4
votes
2answers
13k views

Wireshark, extract all http headers

I have some .pcap from which I would like to extract all http headers. By using the filters I'm able to display only Http requests but what I would like is to be able to extract/display/print/export ...
0
votes
1answer
2k views

No response to ICMP (traceroute)

192.168.1.37 can ping 192.168.0.22, but can't ping 192.168.0.240 subnet masks are 255.255.255.0 on all hosts in question Switch/gateway in the middle (192.168.1.253) can ping both of these ...
2
votes
1answer
1k views

Need understanding on Wireshark Capture from LSA update of a link.PCAP attached

Consider OSPF in Area 0 is running on all routers and interfaces. I advertise a route 223.0.0.1/24 from R4 in the diagram. PCAP i shared is between r2 and r1 where R2 sends "LS Update" I'm unable to ...
1
vote
1answer
796 views

Setup a server for traffic monitoring using wireshark in bridge mode [closed]

i was able to get a hold of a server with 2 ethernet ports to start learning about traffic inspection using wireshark. The server and software are setup. I would like to know how i can configure the ...
1
vote
2answers
198 views

Wireshark capturing device ip

ok so here's the scenario: Computer A captures some packets and saves the session into file 'traffic'. Later on, Computer B opens the 'traffic' file and wants to know who captured the file...the ip ...
2
votes
1answer
303 views

Why my computer is making this ARP requests to external (Gov) IP addresses?

I am posting here because I randomly installed Wireshark and I found that for 2 minutes or so (later it stopped) my computer started making ARP requests to IP addresses outside my local network, and ...
1
vote
1answer
12k views

Wireshark No response seen sending ping request

I'm building my own packets and sending them through a raw socket. The packet is apparently A-OK, but I'm not getting any replies. Sequence block is generated with a for loop. Identifier block is ...
0
votes
1answer
463 views

TCP session established even if the server isn't listening on particular port

I have found out a strange behaviour when trying to establish TCP session between Citrix host and back-end server on port 5060. When I perform 'telent 172.18.52.73 5060' from Citrix host I get "...
1
vote
1answer
792 views

Dumpcap capture filter syntax - wlan addr1 question

I am trying to capture wireless traffic from specified MAC addresses only, and I seem to be using the wrong syntax. When I use: dumpcap -i wlp2s0 -b filesize:100000 -w capture.pcapng -a duration:...
0
votes
1answer
941 views

802.11 Wireless Lan with radio information

I just saw in wireshark under "import hexdump" the following types: IEEE 802.11 Wireless Lan IEEE 802.11 Wireless Lan with radio information What are exactly is the radio information?
1
vote
1answer
591 views

Is it possible to create an IPv4 packet header larger than 20 bytes on an IPv4 connection?

Is it possible to generate an IPv4 packet with an IPv4 packet header larger than 20 bytes on an IPv4 connections?
1
vote
2answers
241 views

How many HTTP servers are contacted?

I am working in wireshark and analyzing the traffic generated by a PC during web browsing. What filter should I use to know how many HTTP servers are contacted? I mean, can I just filter the tcp....
0
votes
3answers
651 views

Is there an "active" network tap (not just passive)? [closed]

Passive network taps seem to be pretty simple. What if I want an "active" network tap? Let's say I want to change some HTTP packets, for example add info etc. Another thing that would interest my ...
2
votes
1answer
2k views

how to capture only SMTP using latest Wireshark 2.2.6 or later

I am debugging a problem with my Azure VM Windows server receiving SMTP from the Internet, and want to use Wireshark to show ONLY SMTP. I would also like to use Wireshark to show the contents of the ...
0
votes
2answers
576 views

Are ARP replies sent directly to the solicitor? [closed]

I understand that most ARP requests are broadcasted to the entire network. What about ARP replies?Are they sent directly to the host asking for the answer? Or must ARP replies go through the router ...