Questions tagged [wireshark]
For questions about Wireshark, a packet analyzer
284
questions
1
vote
1
answer
1k
views
How to capture ARP Reply packet from all hosts in the network?
How can I capture ARP reply packets from all hosts that are connected in the network?
I've tried wireshark premicious mode but it only capture ARP replies from gateway.
- 85
3
votes
2
answers
431
views
Which tcpdump metrics reveal server connectivity problems vs client problems?
I am attempting to diagnose a ~45 sec drop (to 0 Kbps) in the reported RTMP streaming bitrate in OBS while publishing a live stream. I had been running a tcpdump the entire time using Apple's ...
- 133
1
vote
2
answers
733
views
How can i monitor ARP packet on WiFi network?
I want to monitor packet in my network. It said that ARP packet request broadcasted all over network. But why i only see my arp request packet and reply packet to the gateway?
- 85
2
votes
1
answer
447
views
How to emuate simple (telnet-like) network protocol with netcat or similar
I have a barcode sensor (Keyence SR-2000) which is able to talk a simple plaintext-based protocol. I could talk to it with the provided (windows-only) app called AutoID Terminal and ontained wireshark ...
- 161
1
vote
3
answers
256
views
Can Ethernet II frame's Type be Layer1's or Layer4's protocol?
The Ethernet II frame's Type field can be IPv4, ARP, so it can be Layer2 and Layer3's protocol.
This is a snapshot of frame captured by WireShark.
But I have a question, whether it can be other ...
- 1,128
1
vote
1
answer
116
views
Does the frame package, all are represent as hex data?
I use Wireshark for capturing packages, get many frames.
You see the left light blue background space, all are hex data, and right are converted words we can identify.
I mean whether the frame ...
- 533
1
vote
2
answers
104
views
What kind packets of the Wireshark capture's package?
We know we can use Wireshark for capture packets, we know Wireshark is based on the network interface adapter.
This is a list of packets captured by Wireshark:
Is Wireshark based on the network ...
- 533
1
vote
1
answer
740
views
Filter pcap file by layer and save to another format [closed]
I captured packets in wireshark, filtered for the protocol I'm interested in (DIS), then exported this to a pcap file. I'd like to do analysis on this data in Python. The only part I'm interested in ...
- 111
2
votes
2
answers
5k
views
What are the differences between TCP iRTT and ICMP Ping?
I’m attempting to estimate latency between my PC and any servers/clients it interacts with. I don’t want to use Ping for various reasons (requires both ends to allow it, would require additional ...
2
votes
2
answers
12k
views
How to determine whether files are downloaded serially or in parallel using Wireshark?
In the http-ethereal-trace provided in the link below there are three HTTP GET request.The 2nd and 3rd request downloads a GIF and JPG format image recpectively.How can we determine wether the two ...
- 35
2
votes
1
answer
616
views
how to get RSSI information of WiFi users in wireshark?
If I'm able to get 802.11n traffic with my network adapter, would I be able to see the RSSI information? what should be the filter to see it?
- 121
1
vote
0
answers
120
views
What is an SSL debug file [closed]
What is an SSL debug file in wireshark? I am following the below tutorial and I am stuck at step 4 of this set of Citrix Netscaler instructions
- 11
4
votes
3
answers
188
views
How does any program identify the protocol header next from TCP?
I need to know how does wireshark or any other program knows the protocol next from TCP. I mean, for instance:
The Ethernet layer has a field named Type which carry the IPv04
The Internet protocol ...
- 43
1
vote
2
answers
590
views
Wireshark expression filters for wireless capture
1) What Wireshark expression filter stack can I utilize to discover how many devices are transmitting in the 2GHz and 5GHz spectrum in a packet capture?
2) What Wireshark expression filter stack can ...
2
votes
1
answer
619
views
Why would my router send an ARP request about a device that's already listed in its ARP cache?
I checked my Ubiquiti EdgeRouterX's ARP table and my laptop IP and MAC address were there. I then checked the DHCP lease and my laptop's IP address doesn't expire until tomorrow. I then ran ...
- 195
1
vote
1
answer
920
views
Wireshark capture only TCP packets with the RST flag set
I'm quite new to networking and I got stuck while reading "Practical Packet Analysis: Using Wireshark to Solve...".
On page 61 it is written:
A common scenario is to capture only TCP packets ...
- 113
3
votes
3
answers
490
views
How to tell which one is the source IP and MAC address of the data being received?
I have to work with an FPGA module already running a code written by someone else. I have no access to the FPGA code.
Now the setup is something like this:-
FPGA is connected to the pc via ethernet ...
0
votes
1
answer
927
views
Wireshark capture on LoopBack interface [closed]
We have two applications running on same machine, both of them are listening on the loopback interface on two different ports. Client Application is sending data to server, but receiving Application ...
0
votes
1
answer
268
views
How to show all data (bitstream with preamble, SFD) on Ubuntu with an Intel Ethernet Interface?
On my PC I have an Intel Ethernet Connection I217-LM with e1000e driver.
If I receive packets in Wireshark or any libpcap based tool, the received ethernet frames start with Ethernet II frame and end ...
1
vote
0
answers
33
views
How to fetch application specific url's by using wireshark in Windows-8/10? [closed]
Its my first time using wireshark and I am encountered with one major problem i.e How will i sniff url/api that a particular application/software is hitting which is installed in Windows-8/10 by using ...
- 11
3
votes
1
answer
4k
views
How can I plot the TCP RTT graph in Wireshark?
I'm suspecting one of our Host is not performing well in the TCP protocol Level.I have tried to plot the TCP RTT graph using tcp.analysis option in the IO graph.However,I'm not finding the right ...
- 1,372
1
vote
1
answer
120
views
what the meaning displayed value in statistic capture wireshark
i have capture some packet with wireshark, in statistic capture windows there is value named Displayed like this
then I was figure out that i can count the Capture value (109) from the capure ...
- 13
1
vote
1
answer
675
views
What is "cflow" in ipfix？
I am learning ipfix and found a cmd like this:
tshark -r ipfix.cap -n -d udp.port==4379，cflow -O cflow
What does the cflow part mean here?
I was also told to filter cflow if I use Wireshark in ...
- 179
2
votes
1
answer
778
views
Probe Request Channel Information
I have used wireshark to capture Wi-fi frames, and have configured my AP to operate on Channel 1.
Now in one of the transactions that occur, I find my mobile device sending a probe request in the ...
- 21
1
vote
1
answer
434
views
Delayed Ack every 3 segments
I was studying some wireshark captures. I noticed that though Ack's are sent every other packet like i was expecting due to delayed TCP ack, i noticed that at some times it is acking every 3 segments. ...
- 155
4
votes
1
answer
5k
views
Calculating 3 way TCP Handshake Duration
I want to calculate the time that the 3 way TCP handshake occupies through wireshark between a server and a client.
I get something like:
Time Source Destination Info
0.00 ...
- 155
2
votes
1
answer
1k
views
Npcap Loopback Adapter not showing PING results in Wireshark
I've a server process and a client process running on my machine. To capture the packets transmitted between them, I've installed the Npcap Loopback Adapter as suggested in the ever-so-famous ...
- 21
6
votes
3
answers
35k
views
How to view MTU size in Wireshark?
I've been reading about maximum transmission unit (MTU) which is the size of the largest protocol data unit (PDU) that can be communicated in a single, network layer, transaction.
I'm generating a ...
- 311
1
vote
2
answers
7k
views
Can not capture DHCP offer with wireshark?
I'd like to capture DHCP packets with wireshark. When I use the filter: "udp.port == 67 or udp.port == 68" I only see the Discover and Request broadcasts.
While I thought the DHCP offer also gets ...
- 11
3
votes
3
answers
694
views
tcp handshake on a http response. which frame is actually the payload?
I am capturing/trying to understand a http response capture in wireshark.
On packet capture row 78,79, i am seeing the HTTP headers (no 78) and body (no 79) in the capture's payload.
On packet ...
- 529
5
votes
1
answer
279
views
Capture first packets with Wireshark
If I start capturing on an interface (e.g. wlan0) with Wireshark while it's down, and then bring the interface up, Wireshark stops the capture and I have to restart it. This way I can't see packets ...
- 165
1
vote
2
answers
299
views
Method in wireshark to filter for any in a set of mac addresses but no others
I am sniffing for several devices in a congested environment. I'm wondering if there is an easy way to accomplish filtering that I don't know of.
I have two APs that things are connecting to so I ...
user37353
2
votes
1
answer
86
views
Extracting a bit rate
I'm trying to figure out what is the lowest layer of the OSI model that can be used to extract a bit rate (through a packet sniffer). I'm not sure if it's possible through only the physical layer, or ...
- 23
2
votes
2
answers
304
views
Wireshark - Displaying HTTP requests with comments only
It seems like a simple filter, but I don't find anything about it on StackExchange or Google itself, nor could I accomplish this myself (only part of it).
What I have now is following:
http.request....
- 163
4
votes
2
answers
2k
views
Decoding wpa-psk traffic with Wireshark
I want to plot how much data each client is using from a wpa-psk protected access point (that I control). For that I intend to monitor all traffic for a couple of days. However I can't decode the TCP ...
- 161
3
votes
1
answer
389
views
Is it possible to capture packets between two devices in a wifi
I have little knowledge of how wifis work.
I have these:
A device which creates a wifi network when turned on. (Lets call this DeviceA)
A mobile app, when connected to the above wifi network, ...
- 133
1
vote
1
answer
488
views
Wireshark - Application Layer with Data
I am not sure if the title is the correct one.
When transfering files over the network, in Wireshark, we see abbreviations like:
- PK -> Beginning of a file. Is it a compressed file?
- OFT2 -> ...
- 113
1
vote
2
answers
102
views
Why are WLAN packages translated to Ethernet packages by Wireshark?
When using Wireshark on my MacBook, I see all my packages wrapped inside Ethernet II frames, although I'm connected wirelessly, which I already figured must be because they are translated from 802.11 ...
- 307
0
votes
1
answer
114
views
How to prevent getting other machine traffic in LAN on interface
I capture traffic of VMware machine in LAN (host pc is in LAN) with Wireshark.
But I see a lot of garbage traffic like LLMNR, NBNS, STP, ... .
I know I cat prevent capturing such traffic by using ...
1
vote
1
answer
120
views
Capturing traffic on wire from an endpoint
Say I have my computer connected to a router with an Ethernet cable. How do I capture all packets on the wire? (possibly with using some kind of hardware that's much cheaper than another computer)
I ...
- 165
1
vote
1
answer
2k
views
Capture auto-negotiation ability flags
I'm performing a set of tests on an embedded device, one of which is "To verify that the control system and instrument supports auto-negotiation". I need to verify that "Expected auto-negotiation is ...
- 123
1
vote
1
answer
691
views
Wireshark lua Dissector sharing common variable among all packets
I just started with lua plugins in wireshark. I wanted to know if it is possible to create like a global object that can be called by dissector in one packet and used by dissector called by another ...
- 13
3
votes
1
answer
7k
views
How can I filter out particular MAC addresses when running tshark on a pcap trace?
I've tried a number of things, but none of them seem to do the trick. I want to run this command:
tshark -r data.pcap -T fields -e frame.time_epoch -e frame.len
but to have it ignore any packets ...
- 163
1
vote
1
answer
170
views
Mac Address Representation wireshark
I'm a little confused. I just learned about two different mac address representations(hexadecimal and bit-reversed representation) in IEEE 802
When hexadecimal representation is used the octets are ...
- 113
2
votes
1
answer
515
views
Rapid Spanning Tree Protocol - RSTP Bridge Id isn't RSTP-Priority + Ethernet-MAC
what is the difference between the eth.src Address and the Bridge-System-Id? Sometimes they are the same but mostly not. Attached you will find a screenshot where they are the same.
- 123
1
vote
1
answer
5k
views
Calculated window size value in SYN segment differ from calculated value in ACK segment
I am a bit confused about the window size value in some TCP segments. I think I understand the theory behind the window size field and how it is modified when the window scale option is provided ...
- 13
3
votes
1
answer
112
views
Total data length transfered in 802.11 using Wireshark
How could I get the total size of a some data that has been transfered using UDP over a wireless channel from a Wireshark capture trace ? I have read somewhere that the sender advertise the total size ...
- 131
2
votes
3
answers
5k
views
How to find packet loss in Wireshark network dump file?
I am a beginner in Wireshark, and I would like to find some problems with a TCP connection. Basically, I have some sockets timing out, and I would like to find out if the message (packet) being sent ...
- 329
3
votes
1
answer
4k
views
Why is the FCS not included in most ethernet frames?
I turned on the calculatin of the FCS Checksum in wireshark. There wasn't a single correct checksum in the whole 500MB packet dump. I asume the reason for this is that the field is simply not used for ...
- 219
3
votes
2
answers
1k
views
Receive order of bits in network packet fields
I've been interested in networking for awhile and have a basic question that was never answered or brought up in any of my classes.
I was looking at the 802.11 WLAN frame format:
It looks like the ...
- 295