Questions tagged [wireshark]

For questions about Wireshark, a packet analyzer

Filter by
Sorted by
Tagged with
0
votes
1answer
155 views

Capturing network traffic using wireshark [closed]

I have 15 systems connected with same LAN. I want to capture all the data packets(network-traffic) through every system from my single PC connected with same LAN using wireshark.Can anybody plz help ...
2
votes
1answer
4k views

Extract packets with ECN notification set.

I am trying to understand DCTCP behavior. For that I am using RED queue discipline on switch port. I am generating traffic using iperf3 for 30 seconds. To capture the packets i am using tcpdump. ...
-1
votes
2answers
139 views

How to know how many frames will be needed to transmit a file

How many frames will be neeed to transmit a file of 80,480 KB file? Is there a mathematical calculation for this?
2
votes
1answer
184 views

how to identify addresses on an ethernet frame

How can I identify the sender's address, the receiver and what type of message does the frame carry on its payload? The frame looks like this: FF FF FF FF FF FF 08 24 F5 CE D3 AC 08 06 00 01 08 00 ...
0
votes
1answer
207 views

IP packet reading

Just got an simple question.Its abt reading a plane IP packet. In a standard IP packet RFC 791, there are multiple fields, the IP packet header size is 20 bytes. Now when i look at following packet ...
2
votes
1answer
689 views

Wireshark trace - POST data with SLE and SRE missing sequence numbers

-Segment 237, the client (10.xxx) sends a POST request to server (128xxx) with a payload of (TCP Len) 4096. -Segment 238, the client continue with the transmission with a payload of 1460 (seq 4097-...
7
votes
1answer
8k views

ARP request unicast MAC?

I would like to ask, with ARP request I got to believe that the destination MAC address was in all situations a broadcast address. Yet I got across a wireshark capture: I just cannot understand the ...
1
vote
1answer
102 views

Five consequtive SYN-messages from client to server

the 5 packages 333 -> 337. What are those and why does the client do this? More generally, why does the client send five SYN-messages to the server?
1
vote
1answer
1k views

Wireshark filter the Wireless Hosted Network (Win7/8/10)

I was thinking about capturing iPhone traffic. I have created a hosted network to which I can connect my iPhone. I'm able to filter the traffic for server IP addresses which are known, such as Google,...
4
votes
3answers
8k views

Why do i only see QUIC and not UDP during capture in wireshark?

I've been using wireshark and noticed that I no longer see UDP but QUIC, why is this the case?
1
vote
2answers
17k views

Ethernet frame IG/LG bit explanation - Wireshark

I have a screenshot of an ethernet packet frame from Wireshark. I need to explain what is the meaning of these marked lines (with dots and zeros). I searched in web, but still I don't have an answer. ...
2
votes
1answer
492 views

Wireshark and Scapy sniffs only ARP packets most of the times (and it's one packet in 3 minutes)

My problem is that Wireshark and Scapy sniffs only ARP packets (sometimes LMNRR or DHCP - 5 packets of those in like 20 minutes..). Basically Wireshark and Scapy sniffs 1 packet in like 1-3 minutes, ...
1
vote
1answer
5k views

Calculated window size in Wireshark

I see that the calculated window size is set to 5888 with the three handshake, however it jumps to 7808 with the first ACK. Can someone explain me why and what algorithm Linux (Linux OS and Wireshark) ...
2
votes
1answer
5k views

Number of TCP segments for HTTP response - Wireshark

After visiting a simple webpage at my browser, how can I check how many data containing TCP segments carried the HTTP response and the text file, in Wireshark? When I check the Packet List window I ...
4
votes
1answer
150 views

Copying bytes from Wireshark

Should it be possible for someone to export the binary payload (say from a UDP packet) captured from Wireshark and later send this stream as a "valid" UDP packet? Longer story: I've captured a DNS ...
1
vote
1answer
491 views

Different types of ICMP [closed]

I have a task on which I have spent a lot of time. I am not fluent in Linux, but I can manage basic things. The task is to gather different types of ICMP packets. I can harvest them by tcpdump (which ...
5
votes
1answer
3k views

Decode with known PSK in DTLS

I have a wireshark capture of implementations of DTLS protocol. I have the PSK and I have converted it to corresponding hex.DTLS uses TLS_PSK_WITH_AES_128_CCM_8 cipher suite. How can I decrypt the ...
3
votes
2answers
140 views

How to filter traffic for the address of a name like this? [closed]

How to filter traffic for the address of type: p309-pmr.ii.ucla.edu.uk? What kinds of servers are generally these types of names given to : p309-pmr.ii.ucla.edu.uk? Is this a DNS server or IP server?...
2
votes
2answers
4k views

Capturing un-encrypted HTTPS traffic using wireshark [closed]

I am trying to capture HTTPS traffic between a client (windows machine) and a server. I would like to do this before the traffic is encrypted as I would like to analyse its contents. Is there easy ...
2
votes
2answers
840 views

Some clients not getting an dhcp address and some don't ping the default gateway

I have a server hardware with installed windows server and DHCP server running on it. My network is 192.168.0.0/24. A small issue we just faced is the client machines could not get an IP address ...
2
votes
1answer
568 views

How to test which process that drops packets?

I simulated a Denial-of-Service attack by connecting two virtual machines, i.e. attack and victim machine. The attack machine sends lots of traffic (http) against the victim machine running an ...
3
votes
1answer
360 views

Why the pcap file always shows more bytes downloaded than the actual file size downloaded when using wireshark?

When capturing a dump using wireshark during download of a file and then exploring the total bytes downloaded in pcap is always greater than the actual file downloaded. for example 700000 bytes ...
2
votes
1answer
646 views

Structural unknown HCI Command in Bluetooth LE logs

I am inspecting the Bluetooth HCI snoop logs as part of debugging an application. For dissecting the logs/Bluetooth LE packets I'm using Wireshark. I found that there is a recurring unknown command ...
0
votes
1answer
1k views

Wireshark is giving error message while capturing packets from GNS3?

I am trying to capture packets with GNS3 using wireshark but wireshark is giving error message every time I run wireshark in GNS3. Path for Wireshark is "D:\Wireshark\Wireshark.exe". Same Path I ...
3
votes
2answers
2k views

Determine protocol decode for non-standard ports in Wireshark

I'm wondering if there is a heuristic plug-in, software or other process for determining protocol when a non-standard TCP port is used. Wireshark will decode packets based on the well-known port ...
2
votes
0answers
1k views

High count of packet retransmissions/Dups over IPSEC/VPN [closed]

I'm running IPSEC-VPN (AES256/SHA256/DH14) tunnel between a PaloAlto PA-500 and a Fortigate 110C via Internet (10MBit up/down guaranteed both sides - latency between 40 and 50ms). 90% connections are ...
1
vote
2answers
5k views

how to calculate the MSS in wireshark when the window scaling option is set?

I have a TCP packet as displayed by Wireshark: The MSS is reported at 1430 bytes, and the Window scale suggests that this should be multiplied by 128, giving 183040 bytes. Question: is this the ...
-1
votes
1answer
5k views

header checksum error in wireshark

hello all , I am not able to understand what kind of error is wireshark showing me please refer picture need help.
2
votes
1answer
2k views

Using Wireshark for traffic capturing in promiscuous mode

I am new to networking; so far we learned about the OSI model, packaging stuff, Wireshark, and network troubleshooting. As I have had understood, Wireshark is able to capture all packets by going to ...
0
votes
3answers
2k views

Trying to capture a RST on a TCP/IP program using Wireshark [closed]

So, recently, I've run into a few issues with Python TCP/IP sockets. Basically, I can't make,and neither can Python's IDLE (a Python file editor) program itself, since it requires a connection at ...
1
vote
1answer
84 views

Get Avarage network trafic data in MB [closed]

Currently i am using a MiroTik router, that has build in a data trafic graph. Its werry well working, but it cant be saved and it shows only last 24h/ last week/ mounth /year. I would like to have ...
1
vote
1answer
135 views

Is it the Proxy Server slowing us? [closed]

So it's the usual Server vs Network battle. What's the best way to check if it's our Proxy Server that's slowing our Internet connection? I do not have access to the Proxy Server. I can only access ...
0
votes
1answer
652 views

Microsoft load balancer heartbeat [closed]

I'm dealing with the following situation: I have 2 servers running Windows 2012 R2 and 1 server running Windows 2008 R2. I need to build a Microsoft Network LoadBalancer cluster using the 3 servers; ...
0
votes
1answer
2k views

Viewing Xbox One Network Traffic [closed]

I am trying to view the HTTP/HTTPS traffic going from my XBOX one so I can see what is being requested. I started off trying to use Charles proxy like this https://www.youtube.com/watch?v=MP4ZcwSHxbw....
4
votes
1answer
3k views

Creating a Network Diagram with .pcap

I have a Wireshark .pcap Capture of around 500k packets and I would like to enumerate a Network Diagram with all the Routers, Switches, PCs etc. Is Wireshark capable of such procedure or is there any ...
3
votes
2answers
826 views

Wireshark capturing the start of a flow

Is it possible to capture only the first 10k of data in a TCP flow and discard the rest at capture time? I have a large number of TCP sessions where each session starts with some metadata and then ...
-1
votes
1answer
1k views

Wireshark time to live pattern question

what pattern does ttl usually follows? working with a task where the ttl increments by 1 for every 3 packets. In the other task the ttl does not have any clear pattern. Info: I am doing traceroute ...
3
votes
1answer
508 views

Convert BFR to PCAP without loosing nano-second resolution

i have a BFR file from a customer that contains nano-second resolution. OI can convert it via tshark, but it does not retain the nano-second resolution on the end pcap file. Is there a way to convert ...
2
votes
1answer
458 views

last byte received, using wireshark

If the packets captured by wireshark is 28.263227 193.54.236.133 193.54.236.132 66 55555 > 19745 [ACK] Seq=1 Ack=2897 Win=2880 Len=0 28.263228 193.54.236.132 193.54.236.133 1514 19745 > ...
4
votes
1answer
974 views

How to disable TCP window scaling in Wireshark?

I am currently using Wireshark version 1.12.2. When I searched the internet I found this result But, this option is not available in my version. I could see only the "Relative sequence numbers" check ...
6
votes
1answer
2k views

Don't fragment set, still being fragmented

Working with a network entirely consisting of Cisco router/switch, two devices (server and client) are talking to each other across a network, about 5 hops of routers including a nexus 7k. Server ...
3
votes
1answer
1k views

What Does ICMP Code 9 Mean For a Type 8 Packet?

I am currently doing an assignment that requires us to generate ICMP packet with various types and codes. I have consulted the RFCs as well as various other place. Many of the types and codes I get ...
3
votes
3answers
4k views

Computer booting due to (I guess) untraceable wake-on-lan packet

There is a desktop computer in our LAN that keeps booting almost every time seconds after it has been turned off manually. I suspected it was a Wake-on-LAN issue since the beginning, and it looks ...
-1
votes
2answers
458 views

is CDMA the main reason why Wireshark can't capture packet on wireless in promiscuous mode?

I was always curious why I can't capture other people's packets that are flying on air by Wireshark. Of course I know there's airmon-ng but I was just wondering why Wireshark itself can't "just simply"...
18
votes
2answers
29k views

Traceroute - every packet has TTL == 1

I'm working on Wireshark lab-IP in Computer networking - A top down approach and I don't understand why every packet that normally expired has a TTL of 1. Here is my Wireshark capture file. https://...
2
votes
1answer
761 views

Blank Wireshark GeoIP map

While I was diagnosing a pcapng file on my linux laptop (Debian Wheezy), I wanted to map out where the packets were coming from, so I followed the standard procedure for a building a GeoIP map... ...
1
vote
1answer
697 views

In a Wireshark trace how do radiotap.mactime and wlan_mgt.fixed.timestamp differ?

I don't mean simply the data format of these, as that is easy enough to look up. I am referring to what they actually mean, and the units and where they originate. Looking at a script I have been ...
1
vote
2answers
9k views

TCP Window Size Allocation and TCP Zero Window Errors

Greetings Everyone! My mind is about to explode as everyone is always blaming the network guys for disconnections and slowness in the networks, but Solarwinds Reports that all utilization in the ...
-1
votes
4answers
3k views

Pcap file parsing

I have a .pcap file that I would like to look at. But when I open it in notepad++ i get strings of discernible information, but a whole lot more of black boxes with 'NUL' written in them. I know I ...
7
votes
1answer
41k views

Troubleshooting "TCP Zero Window" Issues

I'm currently having a problem troubleshooting a trading application. Let me give a simple diagram of the current network setup (Gov't Stock Exchange Network Router)X-->(256kbs Leased Line)<--X(...