Questions tagged [wireshark]

For questions about Wireshark, a packet analyzer

Filter by
Sorted by
Tagged with
1
vote
2answers
267 views

How many HTTP servers are contacted?

I am working in wireshark and analyzing the traffic generated by a PC during web browsing. What filter should I use to know how many HTTP servers are contacted? I mean, can I just filter the tcp....
0
votes
3answers
662 views

Is there an "active" network tap (not just passive)? [closed]

Passive network taps seem to be pretty simple. What if I want an "active" network tap? Let's say I want to change some HTTP packets, for example add info etc. Another thing that would interest my ...
2
votes
1answer
2k views

how to capture only SMTP using latest Wireshark 2.2.6 or later

I am debugging a problem with my Azure VM Windows server receiving SMTP from the Internet, and want to use Wireshark to show ONLY SMTP. I would also like to use Wireshark to show the contents of the ...
0
votes
2answers
603 views

Are ARP replies sent directly to the solicitor? [closed]

I understand that most ARP requests are broadcasted to the entire network. What about ARP replies?Are they sent directly to the host asking for the answer? Or must ARP replies go through the router ...
0
votes
1answer
802 views

Where in PCAP-NG does the Source/Destination IP address information reside?

I'm studying the pcapng file format, and I know that when wireshark reads a pcapng file, it tells you all sorts of information. I've been reading the pcap-ng format and I don't see anywhere in pcapng ...
1
vote
0answers
2k views

Size of packets in Wireshark [closed]

I only getting familiar with Wireshark, and there is one thing that I can't put together: estimating sizes of messages. I want to understand how much traffic my desktop application generates during it'...
1
vote
1answer
498 views

Why is my pc not forwarding packets to my default gateway?

I understand that if I were to send a packet to a destination outside my LAN, it would have to reach the gateway first before it is being routed to the final destination. However, when I visit a ...
2
votes
2answers
120 views

Detecting a device joining WLAN

Using Wireshark packet capture, I want to be notified when a new device joins my wifi network. Is it possible to determine this by capturing 802.11 control packets? If so, what filters will let me ...
4
votes
2answers
13k views

Ethernet padding

I'm using Wireshark for my project. I sent a ping over to Google.com and Wireshark said that the length was 57 bytes(when I received the reply it was 60 bytes long and it contained 6 bits of padding. ...
0
votes
1answer
1k views

Getting URL of a website using a sniffer [closed]

This is my first post here. I am currently working on a project, and I am supposed to get the URL of a website I am browsing using a sniffer (such as wireshark). So, what I have done is look at the ...
2
votes
1answer
328 views

`tcpdump bootp.type == 2` tcpdump: syntax error

tcpdump -i eth0 'bootp.type == 2' Results in a: tcpdump: syntax error However, bootp.type == 2 works fine in Wireshark. Also tcpdump -i eth0 'tcp[13] & 16!=0' works fine, no syntax error....
2
votes
1answer
2k views

How to capture packets from all wifi channels at once?

I'm doing a project in which I need to capture a live feed of all wireless networks available around a given device. I was hoping to go a step further and capture all packets as well using Wireshark, ...
2
votes
1answer
851 views

How to Capture packets generated from linux pktgen traffic generator? [closed]

I am testing an openflow switch for its performance. I am using "pktgen" kernel module available in linux to generate packets at different flow rates. I have a host with two interfaces eth1 and eth2. ...
1
vote
1answer
494 views

What are the testing possibilities of wireshark?

I got an information that tcpdump is same like wireshark. In using tcpdump we can capture the packets, but in wireshark we can see the GUI of packet capture. Later I understand that we can use the ...
1
vote
1answer
98 views

Wireshark PCAP file clarification

I need your support urgently as I've a problem in the connection between 2 servers. Here's the below when the connection became down, but this is from the other side so I can't identify what is it ? ...
1
vote
1answer
108 views

Important points that I should take care inside packets by using wireshark

So now that I can understand that there wont be any packets received at machine one, when there is a communication initiated between Machine2 and Machine3. Now I am testing API's using postman. First ...
-1
votes
2answers
153 views

Wireshark can't capture packets from machine 2 to machine 3 [duplicate]

I got an idea there were 3 machines. machine 1,2 amd 3. Machine 2 ping to machine 1, i can capture the packets by using tcpdump. But mchine 2 ping to machine 3 , then machine 1 can't capture by using ...
0
votes
1answer
1k views

Unable to capture http request in Wireshark [closed]

I am working in wireshark. I am monitoring the wifi traffic on the same network. We have 6 pc's there and one machine was installed on wireshark to capture wifi traffic. I got my team mates Ip ...
2
votes
1answer
559 views

Wireshark - How to find cause of incomplete download

I captured a 70MB tcpdump of a linux client that downloads many big files with curl. At some point curl aborts the download with the errror transfer closed with 3304876121 bytes remaining to read (...
0
votes
2answers
931 views

Wireshark - capture all packets for HTTP request

I want to launch a HTTP request to a website I've never visited before. I would like to pick up all of the packets related to this request; so DNS packets, TCP packets, et cetera. Is there a way to ...
6
votes
1answer
16k views

Filter ARP packets with specific "Who has" and "Tell" IP

Here is an ARP packet: 192.168.1.3 ARP 62 Who has 192.168.1.1? Tell 192.168.1.2 How to display only ARP packets with 1) specific "Who has" IP (192.168.1.1 here)? 2) specific "Tell" IP (192....
1
vote
3answers
2k views

Wireshark shows wrong protocol

We have connection problems to some 3rd party https endpoints. We checked the network packages via Wireshark to find the problem but we couldn't identify anything yet. I compared one working and one ...
2
votes
1answer
1k views

How to refer packets that belong to specific TCP session?

How can I know which packet belongs to a specific TCP session? In my experiment, a client establishes a TCP session with the web server every 5 seconds using wget command (I also noticed it uses ...
2
votes
2answers
5k views

How to fiter non SSH traffic in Wireshark

I am trying to monitor behaviour of packets from my PC -> VirtualBox machine which represents a virtual router, and I have established SSH session to it. My question is, how to filter out all SSH ...
0
votes
1answer
5k views

Does tcp.analysis.flags in Wireshark find bad TCP packet?

Let me start by prefixing my knowledge of Wireshark is very limited. Context : I'm investigating logs between a server hosted files and an AV that supported ICAP protocol. In this logs I'm very ...
1
vote
1answer
375 views

Wireshark: configure for capturing ssl data

I'm using Wireshark for getting all https packets and decoding them. I follow two methods in Wireshark. The first method is on this link: Wireshark SSL. In short, I do following things: generate key....
1
vote
1answer
440 views

Wireshark Display Filters

Apologies ahead of time if I missed an article or a posting with the answer to this question... I'm fairly new to Wireshark and I was analyzing my network traffic, I'd like to be able to do multiple ...
1
vote
2answers
819 views

Sniffing packets while roaming in WLAN

I built a simple WLAN containing two routers used as APs. They are connected to each other with a switch. (Those two routers has different manufacturer) I simulated a seamless roaming between the ...
1
vote
1answer
570 views

Arp spoofing and ip detection

I am testing two differents lan and I am tring to sniff traffic with Mitm attack using simple Linux shell command like arpspoof and whireshark to sniff the packets. In the first lan I can sniff ...
1
vote
2answers
211 views

Why can't i see wireless traffic not addressed to my wireless interface with wireshark

I'm using Wireshark to capture traffic on my 2.4G wifi network. I'm set to promiscuous mode, but I only see traffic to or from me, or broadcast or multicast traffic. Unless I'm remembering ...
1
vote
1answer
8k views

How do I get wireshark to actually display packets [closed]

I've just started using wireshark. I click the blue shark fin, then 10 seconds later click the red stop button. The bar along the bottom of the window says "Packets 47 - Displayed 0". I can't work ...
1
vote
1answer
305 views

Confirm DFS issues using Monitor Mode + Wireshark

I believe that our AP's are being affected by DFS but need a way to "prove" this issue before getting any kind of change enacted. Using Wireshark, is there anyway that I can watch the network traffic ...
6
votes
2answers
531 views

TCP Flow-control questions that drives me mad

This is a capture of a TCP session when I was downloading the 10Mb file from an FTP server. The server has an ICW of 10x MSS, so this means that the server can initially send 10 segments without ...
1
vote
2answers
259 views

Cisco 2900 Default Fast Ethernet Port Speed

What is the default speed of a Fast Ethernet Interface of Cisco 2900 Switch that was just reset to default settings using write erase? I'm asking because my Wireshark capture of ARP packets gives a ...
2
votes
1answer
2k views

Wireshark to capture router MAC's

Is there any way I can capture the router IP or MAC addresses along the path of a ping packet using Wireshark tool?
2
votes
4answers
4k views

Why does Wireshark not show all traffic (especially GVSP data)

This discussion reveals that Wireshark may not capture every packet on a network. In that case, the reason pertains to TCP data. I am specifically interested in seeing (extremely bulky) GVSP data. As ...
2
votes
2answers
17k views

Wireshark Broadcast Storm

Suppose I'm using Wireshark to monitor a broadcast storm. I want to find out the exact instant of time when the capture buffer runs out of memory. How do I monitor this and obtain the exact time ...
0
votes
1answer
456 views

How to capture to file every second packet?

We are running offline network analysis by capturing packets to files and analyzing afterwards with automated system. Our Wireshark @ Ubunty command line looks like: wireshark -k -i eth0 -y EN10MB -...
1
vote
1answer
187 views

How do I generate ESP trafic (IPv6)?

I have this topology: I only have moon and sun. After the connection was successfully established, I need to generate ESP packets for wireshark capture. How do I generate ESP packets? When I use ...
1
vote
1answer
3k views

what do they mean about round-trip max?

6509#ping 23.6.1.111 size 500 rep 100 Type escape sequence to abort. Sending 100, 500-byte ICMP Echos to 23.6.1.111, timeout is 2 seconds: !!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!...
0
votes
1answer
284 views

HTTP server responds with TTL- exceeded for TCP-SYN till TTL is increased by +2 from the actual number of hops

Trying to traceroute an HTTP server using TCP-SYN packets. There are 13 hops between the two hosts, but the server responds with TTL-exceeded for TTL=13 and TTL=14. It replies with TCP SYN-ACK only ...
1
vote
1answer
501 views

ICMP TTL-exceeded header shows Length: 243 [Length of original datagram: 972] in wireshark. Original TCP-SYN was 58 Bytes

TCP SYN for traceroute ICMP header shows Length 243 [Length of original datagram: 972] Not sure how this works, as I sent a TCP-SYN of 58 Bytes frame. Please explain
1
vote
1answer
162 views

Is it possible to capture ieee802.11 management and control frames from the same phone using android APP or tcpdump on root device?

I am trying to study the traffic between the mobile and access points. So I have phone Galaxy Nexus which does not support monitoring mode but still support promiscuous mode. Unfortunately, I try many ...
1
vote
2answers
1k views

WireShark: How can I determine how many hosts are on the same wi-fi as me?

I need to determine the number of hosts on my network using wireshark. From what I have gathered, this is impossible on a Windows machine. Is this the case? This is for school, so I simply need to ...
2
votes
1answer
632 views

How to decide packets whether it is uplink or downllink?

I am having a wireshark capture of scp from my machine end to another end. I want to know, how can I determine whether it is uplink or downlink packets? EDIT Uplink means that I am the source and ...
0
votes
1answer
276 views

Same offset in fragmented IP packets when using Covert channel

I am currently experimenting which Tunnelshell. So, I launched it on the victim and on the attacker, executed a command via the Tunnelshell and captured the traffic via Wireshark to see what's going ...
3
votes
1answer
2k views

Spurious restransmission to a server behind pfsense NAT

i'm trying to connect to my ssh test server that i setup behind a pfsense firewall via nat on port 22. When I sniff packet on my laptop (WAN side of pfsense) trying to connect to the server, SYN is ...
1
vote
2answers
2k views

Using Wireshark to Capture Traffic Between VMs on a Third VM [closed]

I have 3 Ubuntu VMs in VirtualBox. They are in a host-only network (LAN). Now, I turn on the wireshark capturing on VM1, and then on VM2 I ping VM3. I expect to capture the ICMP messages on VM1. ...
0
votes
1answer
155 views

Capturing network traffic using wireshark [closed]

I have 15 systems connected with same LAN. I want to capture all the data packets(network-traffic) through every system from my single PC connected with same LAN using wireshark.Can anybody plz help ...
2
votes
1answer
4k views

Extract packets with ECN notification set.

I am trying to understand DCTCP behavior. For that I am using RED queue discipline on switch port. I am generating traffic using iperf3 for 30 seconds. To capture the packets i am using tcpdump. ...