Questions tagged [wireshark]
For questions about Wireshark, a packet analyzer
294
questions
-1
votes
1
answer
7k
views
header checksum error in wireshark
hello all , I am not able to understand what kind of error is wireshark showing me please refer picture
need help.
- 11
2
votes
1
answer
2k
views
Using Wireshark for traffic capturing in promiscuous mode
I am new to networking; so far we learned about the OSI model, packaging stuff, Wireshark, and network troubleshooting. As I have had understood, Wireshark is able to capture all packets by going to ...
- 21
0
votes
3
answers
3k
views
Trying to capture a RST on a TCP/IP program using Wireshark [closed]
So, recently, I've run into a few issues with Python TCP/IP sockets. Basically, I can't make,and neither can Python's IDLE (a Python file editor) program itself, since it requires a connection at ...
- 101
1
vote
1
answer
89
views
Get Avarage network trafic data in MB [closed]
Currently i am using a MiroTik router, that has build in a data trafic graph.
Its werry well working, but it cant be saved and it shows only last 24h/ last week/ mounth /year.
I would like to have ...
- 13
1
vote
1
answer
145
views
Is it the Proxy Server slowing us? [closed]
So it's the usual Server vs Network battle. What's the best way to check if it's our Proxy Server that's slowing our Internet connection? I do not have access to the Proxy Server. I can only access ...
- 11
0
votes
1
answer
690
views
Microsoft load balancer heartbeat [closed]
I'm dealing with the following situation: I have 2 servers running Windows 2012 R2 and 1 server running Windows 2008 R2. I need to build a Microsoft Network LoadBalancer cluster using the 3 servers; ...
- 131
0
votes
1
answer
2k
views
Viewing Xbox One Network Traffic [closed]
I am trying to view the HTTP/HTTPS traffic going from my XBOX one so I can see what is being requested. I started off trying to use Charles proxy like this https://www.youtube.com/watch?v=MP4ZcwSHxbw....
4
votes
1
answer
4k
views
Creating a Network Diagram with .pcap
I have a Wireshark .pcap Capture of around 500k packets and I would like to enumerate a Network Diagram with all the Routers, Switches, PCs etc.
Is Wireshark capable of such procedure or is there any ...
- 143
3
votes
2
answers
895
views
Wireshark capturing the start of a flow
Is it possible to capture only the first 10k of data in a TCP flow and discard the rest at capture time? I have a large number of TCP sessions where each session starts with some metadata and then ...
-1
votes
1
answer
1k
views
Wireshark time to live pattern question
what pattern does ttl usually follows?
working with a task where the ttl increments by 1 for every 3 packets. In the other task the ttl does not have any clear pattern.
Info: I am doing traceroute ...
- 1
3
votes
1
answer
554
views
Convert BFR to PCAP without loosing nano-second resolution
i have a BFR file from a customer that contains nano-second resolution. OI can convert it via tshark, but it does not retain the nano-second resolution on the end pcap file. Is there a way to convert ...
- 73
2
votes
1
answer
564
views
last byte received, using wireshark
If the packets captured by wireshark is
28.263227 193.54.236.133 193.54.236.132 66 55555 > 19745 [ACK] Seq=1 Ack=2897 Win=2880 Len=0
28.263228 193.54.236.132 193.54.236.133 1514 19745 > ...
- 141
5
votes
1
answer
1k
views
How to disable TCP window scaling in Wireshark?
I am currently using Wireshark version 1.12.2.
When I searched the internet I found this result
(source: wireshark.org)
But, this option is not available in my version. I could see only the "...
- 379
6
votes
1
answer
3k
views
Don't fragment set, still being fragmented
Working with a network entirely consisting of Cisco router/switch, two devices (server and client) are talking to each other across a network, about 5 hops of routers including a nexus 7k.
Server ...
- 512
3
votes
1
answer
2k
views
What Does ICMP Code 9 Mean For a Type 8 Packet?
I am currently doing an assignment that requires us to generate ICMP packet with various types and codes. I have consulted the RFCs as well as various other place. Many of the types and codes I get ...
- 43
3
votes
3
answers
4k
views
Computer booting due to (I guess) untraceable wake-on-lan packet
There is a desktop computer in our LAN that keeps booting almost every time seconds after it has been turned off manually.
I suspected it was a Wake-on-LAN issue since the beginning, and it looks ...
- 191
-1
votes
2
answers
484
views
is CDMA the main reason why Wireshark can't capture packet on wireless in promiscuous mode?
I was always curious why I can't capture other people's packets that are flying on air by Wireshark. Of course I know there's airmon-ng but I was just wondering why Wireshark itself can't "just simply"...
- 193
19
votes
2
answers
31k
views
Traceroute - every packet has TTL == 1
I'm working on Wireshark lab-IP in Computer networking - A top down approach and I don't understand why every packet that normally expired has a TTL of 1.
Here is my Wireshark capture file.
https://...
- 193
2
votes
1
answer
960
views
Blank Wireshark GeoIP map
While I was diagnosing a pcapng file on my linux laptop (Debian Wheezy), I wanted to map out where the packets were coming from, so I followed the standard procedure for a building a GeoIP map...
...
- 29.9k
1
vote
1
answer
829
views
In a Wireshark trace how do radiotap.mactime and wlan_mgt.fixed.timestamp differ?
I don't mean simply the data format of these, as that is easy enough to look up. I am referring to what they actually mean, and the units and where they originate.
Looking at a script I have been ...
- 113
2
votes
2
answers
10k
views
TCP Window Size Allocation and TCP Zero Window Errors
Greetings Everyone!
My mind is about to explode as everyone is always blaming the network guys for disconnections and slowness in the networks, but Solarwinds Reports that all utilization in the ...
- 111
-1
votes
4
answers
4k
views
Pcap file parsing
I have a .pcap file that I would like to look at. But when I open it in notepad++ i get strings of discernible information, but a whole lot more of black boxes with 'NUL' written in them.
I know I ...
- 1
7
votes
1
answer
44k
views
Troubleshooting "TCP Zero Window" Issues
I'm currently having a problem troubleshooting a trading application. Let me give a simple diagram of the current network setup
(Gov't Stock Exchange Network Router)X-->(256kbs Leased Line)<--X(...
- 111
2
votes
2
answers
840
views
Wireshark http filter question
Are the filters http.host != "" and http.host the same? The first one makes the filter text edit turn yellow (suggesting I may get undesirable results) whereas the second passes the syntax check fine. ...
- 123
27
votes
2
answers
34k
views
Difference between sniffer tools
I am unsure what the following networking tools do. They all seem to do a similar thing.
First some background. I am familiar with cisco IOS. I am doing some linux networking experimentation with ...
- 373
1
vote
1
answer
1k
views
How to automate Wireshark GUI like IO Graph
I use a lot IO Graph in Wireshark but for each capture, I have to set again (and again...) all my "preferences" for X/Y Axis and Graph 2/3 filters and so on...
That is really annoying. I looked at ...
- 111
3
votes
3
answers
14k
views
Wireshark shows SSDP protocol for HTTP request, and not TCP protocol
I have been learning ICND1 through CBTNuggets.com course online,
I have recently started a video where the instructor is guiding on how to use Wireshark to trace the communication.
He first used DNS ...
- 449
4
votes
2
answers
314
views
Why are there no packets for PC on the same network in Wireshark?
I'm trying to isolate SQL commands sent from another PC on the same subnet using WireShark. I know the PC's local IP address (first three numbers are the same as my PC's) but when I start the capture ...
- 143
6
votes
1
answer
3k
views
Wireshark tcp.len and data.len missmatch
What is the difference between tcp.len and data.len filters? I thought that both mean data size traveling in the segment (not including TCP header). I have a problem related to MTU issue and I'm ...
- 238
3
votes
1
answer
5k
views
Why should one server repeatedly ARP for the same host?
I am trying to use Wireshark to find the root cause of a particularly slow network, and started by examining Broadcast traffic.
Not only does Broadcast traffic represent over 25% of total traffic (at ...
- 31
2
votes
1
answer
338
views
How the frame size getting below 64 bytes
I did packet capture on my system, where i did packet capture on wireless adapter. i seen some frame size below than 64 bytes like 54 bytes and other frame size as well. I seen some document frame ...
- 307
7
votes
1
answer
26k
views
tcp.length and tcp.data wireshark filters
I was playing with Wireshark and noticed two filters: tcp.len and tcp.data. What is the difference between the two? As far as I know, the tcp.len (length) field tells how many bytes of data travel ...
- 205
3
votes
1
answer
13k
views
Wireshark Etherent II Trailer field?
What does Trailer field stand for in Ethernet II frame? Can you explain this on following cases (length of ARP packet is 28 bits)?
Case #1:
Ethernet II
Destination: Broadcast (ff:ff:ff:ff:ff:ff)
...
- 205
2
votes
1
answer
741
views
Speed of capture packets in monitor mode
I have one doubt about the speed of packets capture in monitor mode. If i have a 300mbps usb wifi adapter in monitor mode, what is the max speed of packet capture?
The 300mbps of my adapter is ...
7
votes
2
answers
7k
views
Why Don’t Probe Requests for Specific SSIDs include BSSIDs
I'm looking at WLAN traffic captured from wireshark on monitor mode and notice that out of the 67,000 probe requests, 99.08% have the destination set to FF:FF:FF:FF:FF:FF (Broadcast).
The thing is, ...
- 71
7
votes
2
answers
2k
views
Monitoring without Port Mirroring
A quick overview of the problem
We've been experiencing some issues with our bandwidth usage lately which I fear may be due to misuse (whether intentional or not) of our internet in the office. I ...
- 173
6
votes
1
answer
3k
views
Wireshark TCP and window size
Can please someone explain me on the below screenshot why host 192.168.1.200 on packet 9 sends an ACK for the packets 6 - 7 - 8? The total packet size does not correspond to the window size agreed. If ...
- 63
8
votes
1
answer
524
views
Will WireShark assume packets are DUP or Retransmitted?
I have a SPAN on two different switch ports which are going to the same sniffer. Host A's connecting port is SPANed, and host B's connecting port is SPANed as well. Because it's a router on a stick ...
- 258
4
votes
5
answers
16k
views
Packet sniffing promiscuously on MacBook Air [closed]
I'm on a MacBook air, and I got a book form the library about wireless network security. I've been following pretty diligently, but it seems like no matter what I do I cannot capture packets of other ...
- 183
3
votes
1
answer
2k
views
Wireshark Protocol Hierarchy explanation
I'm trying to calculate how much bandwidth is utilised for a particular protocol, at the different layers.
Wireshark Protocol Hierarchy gives something like this:
Protocol %Bytes Bytes
Frame ...
- 187
8
votes
1
answer
2k
views
Wireshark Filter - OSPF Database Description Link State ID
Within Wireshark, how would one write a display filter for the IP address of the Link State ID within an OSPF Database Description packet? The Link State ID addresses are found within the LSA Header ...
- 963
53
votes
2
answers
361k
views
Why do I see a RST, ACK packet instead of a RST packet?
Looking in Wireshark, I often see TCP Streams end with a RST, ACK packet instead of a RST packet. Anyone know why this is?
An example of what I see:
SYN
SYN, ACK
...data...
RST, ACK
Wireshark is ...
- 611
8
votes
2
answers
18k
views
How can I capture traffic on a Brocade XMR, MLX, CER or CES?
How can I perform a packet analysis on traffic flowing through a Brocade XMR, MLX, CER or CES without having to install a specific software on any of the remote endpoints ?
- 1,687
27
votes
4
answers
114k
views
How can I capture traffic on Cisco IOS switches?
For investigating a problem in client to server communication, I need to capture packets for analysis. However it's not allowed to install a packet analyzer, such as Wireshark or tcpdump, on client or ...
- 3,374