Questions tagged [wireshark]
For questions about Wireshark, a packet analyzer
294
questions
3
votes
2
answers
3k
views
Determine protocol decode for non-standard ports in Wireshark
I'm wondering if there is a heuristic plug-in, software or other process for determining protocol when a non-standard TCP port is used.
Wireshark will decode packets based on the well-known port ...
- 95
3
votes
1
answer
2k
views
What Does ICMP Code 9 Mean For a Type 8 Packet?
I am currently doing an assignment that requires us to generate ICMP packet with various types and codes. I have consulted the RFCs as well as various other place. Many of the types and codes I get ...
- 43
3
votes
1
answer
13k
views
Wireshark Etherent II Trailer field?
What does Trailer field stand for in Ethernet II frame? Can you explain this on following cases (length of ARP packet is 28 bits)?
Case #1:
Ethernet II
Destination: Broadcast (ff:ff:ff:ff:ff:ff)
...
- 205
3
votes
1
answer
2k
views
Wireshark Protocol Hierarchy explanation
I'm trying to calculate how much bandwidth is utilised for a particular protocol, at the different layers.
Wireshark Protocol Hierarchy gives something like this:
Protocol %Bytes Bytes
Frame ...
- 187
3
votes
2
answers
457
views
Which tcpdump metrics reveal server connectivity problems vs client problems?
I am attempting to diagnose a ~45 sec drop (to 0 Kbps) in the reported RTMP streaming bitrate in OBS while publishing a live stream. I had been running a tcpdump the entire time using Apple's ...
- 133
3
votes
1
answer
4k
views
How can I plot the TCP RTT graph in Wireshark?
I'm suspecting one of our Host is not performing well in the TCP protocol Level.I have tried to plot the TCP RTT graph using tcp.analysis option in the IO graph.However,I'm not finding the right ...
- 1,412
3
votes
1
answer
554
views
Convert BFR to PCAP without loosing nano-second resolution
i have a BFR file from a customer that contains nano-second resolution. OI can convert it via tshark, but it does not retain the nano-second resolution on the end pcap file. Is there a way to convert ...
- 73
3
votes
1
answer
5k
views
Why should one server repeatedly ARP for the same host?
I am trying to use Wireshark to find the root cause of a particularly slow network, and started by examining Broadcast traffic.
Not only does Broadcast traffic represent over 25% of total traffic (at ...
- 31
3
votes
1
answer
60
views
Wireshark - how to merge packets of Data of a bin file which was sent over the LAN?
I tried to send a ~80k dat file over the LAN from one device to another and then combine the captured packets back to the original file, for testing and learning purposes.
I couldn't find any way to ...
- 131
3
votes
1
answer
118
views
Total data length transfered in 802.11 using Wireshark
How could I get the total size of a some data that has been transfered using UDP over a wireless channel from a Wireshark capture trace ? I have read somewhere that the sender advertise the total size ...
- 131
3
votes
2
answers
148
views
How to filter traffic for the address of a name like this? [closed]
How to filter traffic for the address of type: p309-pmr.ii.ucla.edu.uk?
What kinds of servers are generally these types of names given to : p309-pmr.ii.ucla.edu.uk?
Is this a DNS server or IP server?...
user15062
3
votes
1
answer
202
views
No packets showing up in Wireshark despite Client-Server communication
I am somewhat new to computer networking and I created a little project where I have two computers connected to an Ethernet switch, forming a small network. Computer server (192.168.1.1) has a mail-...
- 141
3
votes
2
answers
1k
views
Receive order of bits in network packet fields
I've been interested in networking for awhile and have a basic question that was never answered or brought up in any of my classes.
I was looking at the 802.11 WLAN frame format:
It looks like the ...
- 295
3
votes
1
answer
581
views
Why the pcap file always shows more bytes downloaded than the actual file size downloaded when using wireshark?
When capturing a dump using wireshark during download of a file and then exploring the total bytes downloaded in pcap is always greater than the actual file downloaded.
for example
700000 bytes ...
- 33
3
votes
2
answers
895
views
Wireshark capturing the start of a flow
Is it possible to capture only the first 10k of data in a TCP flow and discard the rest at capture time? I have a large number of TCP sessions where each session starts with some metadata and then ...
2
votes
3
answers
5k
views
How to find packet loss in Wireshark network dump file?
I am a beginner in Wireshark, and I would like to find some problems with a TCP connection. Basically, I have some sockets timing out, and I would like to find out if the message (packet) being sent ...
- 329
2
votes
2
answers
372
views
tcp connection and stream flow question
Could anyone explain the main principe of tcp flow when making a session ?
I have take a tcp dump when i'm trying to browse a site. when I analyse the packet by wireshark, i have found many Three way ...
- 177
2
votes
2
answers
3k
views
Calculating the throughput of a given TCP connection
Given a TCP session, is there a way to determine the throughput of the sender?
I have a wireshark sniff, and I see that to calculate the throughput of the sender I can use the TCP-Window-Size-in-bits /...
- 189
2
votes
2
answers
841
views
Wireshark http filter question
Are the filters http.host != "" and http.host the same? The first one makes the filter text edit turn yellow (suggesting I may get undesirable results) whereas the second passes the syntax check fine. ...
- 123
2
votes
1
answer
267
views
IPV6 ping, the pinged address is different from the once caught by wireshark
I'm trying to ping an ECU, both PC and ECU have static IPV6 address
the problem is that the target address (ECU) pinged is different from the one caught by Wireshark
subnet : 64
ping command
$ ...
- 145
2
votes
2
answers
914
views
Some clients not getting an dhcp address and some don't ping the default gateway
I have a server hardware with installed windows server and DHCP server running on it.
My network is 192.168.0.0/24. A small issue we just faced is the client machines could not get an IP address ...
- 394
2
votes
2
answers
10k
views
TCP Window Size Allocation and TCP Zero Window Errors
Greetings Everyone!
My mind is about to explode as everyone is always blaming the network guys for disconnections and slowness in the networks, but Solarwinds Reports that all utilization in the ...
- 111
2
votes
1
answer
741
views
Speed of capture packets in monitor mode
I have one doubt about the speed of packets capture in monitor mode. If i have a 300mbps usb wifi adapter in monitor mode, what is the max speed of packet capture?
The 300mbps of my adapter is ...
2
votes
2
answers
101
views
Loops in routers-same packet?
Considering a loop topology between a few routers with a host connected to one of them, when it's default routing directs to the cycle.
Even when observing Wireshark, how can we know its the same ...
- 145
2
votes
1
answer
503
views
How to emuate simple (telnet-like) network protocol with netcat or similar
I have a barcode sensor (Keyence SR-2000) which is able to talk a simple plaintext-based protocol. I could talk to it with the provided (windows-only) app called AutoID Terminal and ontained wireshark ...
- 161
2
votes
1
answer
562
views
Rapid Spanning Tree Protocol - RSTP Bridge Id isn't RSTP-Priority + Ethernet-MAC
what is the difference between the eth.src Address and the Bridge-System-Id? Sometimes they are the same but mostly not. Attached you will find a screenshot where they are the same.
- 123
2
votes
2
answers
1k
views
Can 'wireshark' truly sense response in nansecond?
I can see the timestamp in Wireshark which ranges up to nanoseconds. But I was just wondering whether it can sense nanoseconds cause in my trace I can't see any activities in the nanosecond range, ...
- 41
2
votes
1
answer
2k
views
How to capture packets from all wifi channels at once?
I'm doing a project in which I need to capture a live feed of all wireless networks available around a given device. I was hoping to go a step further and capture all packets as well using Wireshark, ...
- 327
2
votes
2
answers
7k
views
How to fiter non SSH traffic in Wireshark
I am trying to monitor behaviour of packets from my PC -> VirtualBox machine which represents a virtual router, and I have established SSH session to it.
My question is, how to filter out all SSH ...
- 123
2
votes
1
answer
564
views
last byte received, using wireshark
If the packets captured by wireshark is
28.263227 193.54.236.133 193.54.236.132 66 55555 > 19745 [ACK] Seq=1 Ack=2897 Win=2880 Len=0
28.263228 193.54.236.132 193.54.236.133 1514 19745 > ...
- 141
2
votes
1
answer
338
views
How the frame size getting below 64 bytes
I did packet capture on my system, where i did packet capture on wireless adapter. i seen some frame size below than 64 bytes like 54 bytes and other frame size as well. I seen some document frame ...
- 307
2
votes
1
answer
588
views
Wireshark not showing Frequency/Channel
I am using Ubuntu 18, and wireshark-gtk. I followed this and this tutorials to create a column named/showing frequency/channel.
But all the packets I captured have no frequency/channel showing.I tried ...
- 151
2
votes
1
answer
748
views
Wireshark capture showing a TCP packet with no flags [closed]
In our network, I captured a TCP packet by Wireshark that has no flag set.
What is the meaning of such packet ? Here is the dissection in text format :
Frame 1: 54 bytes on wire (432 bits), 54 bytes ...
- 311
2
votes
1
answer
916
views
Probe Request Channel Information
I have used wireshark to capture Wi-fi frames, and have configured my AP to operate on Channel 1.
Now in one of the transactions that occur, I find my mobile device sending a probe request in the ...
- 21
2
votes
1
answer
87
views
Extracting a bit rate
I'm trying to figure out what is the lowest layer of the OSI model that can be used to extract a bit rate (through a packet sniffer). I'm not sure if it's possible through only the physical layer, or ...
- 23
2
votes
1
answer
903
views
Search for IP addresses in SNMP data field using Wireshark
TLDR: How can I find IP addresses that is communicated via SNMP in the data =>variable-bindings field ?
I am using wireshark to view my pcap and I use the snmp filter. But I would like to go ...
- 145
2
votes
1
answer
756
views
Wireshark - How to find cause of incomplete download
I captured a 70MB tcpdump of a linux client that downloads many big files with curl. At some point curl aborts the download with the errror
transfer closed with 3304876121 bytes remaining to read
(...
- 123
2
votes
1
answer
2k
views
Using Wireshark for traffic capturing in promiscuous mode
I am new to networking; so far we learned about the OSI model, packaging stuff, Wireshark, and network troubleshooting. As I have had understood, Wireshark is able to capture all packets by going to ...
- 21
2
votes
1
answer
960
views
Blank Wireshark GeoIP map
While I was diagnosing a pcapng file on my linux laptop (Debian Wheezy), I wanted to map out where the packets were coming from, so I followed the standard procedure for a building a GeoIP map...
...
- 29.9k
2
votes
1
answer
87
views
Is there a way to precompile data from pcap to speed up booting wireshark?
Is there a way to precompile/precalculate the data from a pcap file to speed up booting wireshark?
I have a big pcap file and wireshark is crashing when I try to open it.
I know it sums and computes a ...
- 141
2
votes
1
answer
816
views
IPv4 and UDP/TCP packets inside of ICMP packet?
A week ago, after opening wireshark, i was surprised by seing a storm of ICMP packets from different IP addresses. While deep analysing of thoses packets, i noticed that those ICMP packets contains ...
- 23
2
votes
2
answers
601
views
Capturing dot1q packets with Wireshark on a PC
I have spent the last few hours trying to capture some trunk packets so I can see and examine the dot1q VLAN field. I have tried mirroring the trunk port to my PC using the following commands on Cisco ...
2
votes
1
answer
744
views
how to get RSSI information of WiFi users in wireshark?
If I'm able to get 802.11n traffic with my network adapter, would I be able to see the RSSI information? what should be the filter to see it?
- 121
2
votes
1
answer
667
views
Why would my router send an ARP request about a device that's already listed in its ARP cache?
I checked my Ubiquiti EdgeRouterX's ARP table and my laptop IP and MAC address were there. I then checked the DHCP lease and my laptop's IP address doesn't expire until tomorrow. I then ran ...
- 195
2
votes
1
answer
1k
views
Need understanding on Wireshark Capture from LSA update of a link.PCAP attached
Consider OSPF in Area 0 is running on all routers and interfaces.
I advertise a route 223.0.0.1/24 from R4 in the diagram.
PCAP i shared is between r2 and r1 where R2 sends "LS Update"
I'm unable to ...
- 445
2
votes
1
answer
2k
views
how to capture only SMTP using latest Wireshark 2.2.6 or later
I am debugging a problem with my Azure VM Windows server receiving SMTP from the Internet, and want to use Wireshark to show ONLY SMTP.
I would also like to use Wireshark to show the contents of the ...
- 121
2
votes
2
answers
125
views
Detecting a device joining WLAN
Using Wireshark packet capture, I want to be notified when a new device joins my wifi network. Is it possible to determine this by capturing 802.11 control packets? If so, what filters will let me ...
- 23
2
votes
1
answer
369
views
`tcpdump bootp.type == 2` tcpdump: syntax error
tcpdump -i eth0 'bootp.type == 2'
Results in a:
tcpdump: syntax error
However, bootp.type == 2 works fine in Wireshark.
Also tcpdump -i eth0 'tcp[13] & 16!=0' works fine, no syntax error....
- 141
2
votes
1
answer
2k
views
How to refer packets that belong to specific TCP session?
How can I know which packet belongs to a specific TCP session? In my experiment, a client establishes a TCP session with the web server every 5 seconds using wget command (I also noticed it uses ...
- 255
2
votes
1
answer
2k
views
Wireshark to capture router MAC's
Is there any way I can capture the router IP or MAC addresses along the path of a ping packet using Wireshark tool?
- 323