Questions tagged [wireshark]
For questions about Wireshark, a packet analyzer
287
questions
3
votes
1
answer
2k
views
Wireshark Protocol Hierarchy explanation
I'm trying to calculate how much bandwidth is utilised for a particular protocol, at the different layers.
Wireshark Protocol Hierarchy gives something like this:
Protocol %Bytes Bytes
Frame ...
- 187
3
votes
2
answers
440
views
Which tcpdump metrics reveal server connectivity problems vs client problems?
I am attempting to diagnose a ~45 sec drop (to 0 Kbps) in the reported RTMP streaming bitrate in OBS while publishing a live stream. I had been running a tcpdump the entire time using Apple's ...
- 133
3
votes
1
answer
4k
views
How can I plot the TCP RTT graph in Wireshark?
I'm suspecting one of our Host is not performing well in the TCP protocol Level.I have tried to plot the TCP RTT graph using tcp.analysis option in the IO graph.However,I'm not finding the right ...
- 1,412
3
votes
1
answer
4k
views
Why is the FCS not included in most ethernet frames?
I turned on the calculatin of the FCS Checksum in wireshark. There wasn't a single correct checksum in the whole 500MB packet dump. I asume the reason for this is that the field is simply not used for ...
- 229
3
votes
1
answer
544
views
Convert BFR to PCAP without loosing nano-second resolution
i have a BFR file from a customer that contains nano-second resolution. OI can convert it via tshark, but it does not retain the nano-second resolution on the end pcap file. Is there a way to convert ...
- 73
3
votes
1
answer
4k
views
Why should one server repeatedly ARP for the same host?
I am trying to use Wireshark to find the root cause of a particularly slow network, and started by examining Broadcast traffic.
Not only does Broadcast traffic represent over 25% of total traffic (at ...
- 31
3
votes
1
answer
112
views
Total data length transfered in 802.11 using Wireshark
How could I get the total size of a some data that has been transfered using UDP over a wireless channel from a Wireshark capture trace ? I have read somewhere that the sender advertise the total size ...
- 131
3
votes
2
answers
148
views
How to filter traffic for the address of a name like this? [closed]
How to filter traffic for the address of type: p309-pmr.ii.ucla.edu.uk?
What kinds of servers are generally these types of names given to : p309-pmr.ii.ucla.edu.uk?
Is this a DNS server or IP server?...
user15062
3
votes
1
answer
171
views
No packets showing up in Wireshark despite Client-Server communication
I am somewhat new to computer networking and I created a little project where I have two computers connected to an Ethernet switch, forming a small network. Computer server (192.168.1.1) has a mail-...
- 141
3
votes
2
answers
1k
views
Receive order of bits in network packet fields
I've been interested in networking for awhile and have a basic question that was never answered or brought up in any of my classes.
I was looking at the 802.11 WLAN frame format:
It looks like the ...
- 295
3
votes
1
answer
526
views
Why the pcap file always shows more bytes downloaded than the actual file size downloaded when using wireshark?
When capturing a dump using wireshark during download of a file and then exploring the total bytes downloaded in pcap is always greater than the actual file downloaded.
for example
700000 bytes ...
- 33
3
votes
2
answers
876
views
Wireshark capturing the start of a flow
Is it possible to capture only the first 10k of data in a TCP flow and discard the rest at capture time? I have a large number of TCP sessions where each session starts with some metadata and then ...
2
votes
2
answers
21k
views
Ethernet frame IG/LG bit explanation - Wireshark
I have a screenshot of an ethernet packet frame from Wireshark.
I need to explain what is the meaning of these marked lines (with dots and zeros).
I searched in web, but still I don't have an answer.
...
- 21
2
votes
3
answers
5k
views
How to find packet loss in Wireshark network dump file?
I am a beginner in Wireshark, and I would like to find some problems with a TCP connection. Basically, I have some sockets timing out, and I would like to find out if the message (packet) being sent ...
- 329
2
votes
2
answers
351
views
tcp connection and stream flow question
Could anyone explain the main principe of tcp flow when making a session ?
I have take a tcp dump when i'm trying to browse a site. when I analyse the packet by wireshark, i have found many Three way ...
- 177
2
votes
2
answers
2k
views
Calculating the throughput of a given TCP connection
Given a TCP session, is there a way to determine the throughput of the sender?
I have a wireshark sniff, and I see that to calculate the throughput of the sender I can use the TCP-Window-Size-in-bits /...
- 189
2
votes
2
answers
801
views
Wireshark http filter question
Are the filters http.host != "" and http.host the same? The first one makes the filter text edit turn yellow (suggesting I may get undesirable results) whereas the second passes the syntax check fine. ...
- 123
2
votes
1
answer
234
views
IPV6 ping, the pinged address is different from the once caught by wireshark
I'm trying to ping an ECU, both PC and ECU have static IPV6 address
the problem is that the target address (ECU) pinged is different from the one caught by Wireshark
subnet : 64
ping command
$ ...
- 145
2
votes
2
answers
870
views
Some clients not getting an dhcp address and some don't ping the default gateway
I have a server hardware with installed windows server and DHCP server running on it.
My network is 192.168.0.0/24. A small issue we just faced is the client machines could not get an IP address ...
- 394
2
votes
2
answers
10k
views
TCP Window Size Allocation and TCP Zero Window Errors
Greetings Everyone!
My mind is about to explode as everyone is always blaming the network guys for disconnections and slowness in the networks, but Solarwinds Reports that all utilization in the ...
- 111
2
votes
1
answer
714
views
Speed of capture packets in monitor mode
I have one doubt about the speed of packets capture in monitor mode. If i have a 300mbps usb wifi adapter in monitor mode, what is the max speed of packet capture?
The 300mbps of my adapter is ...
2
votes
2
answers
85
views
Loops in routers-same packet?
Considering a loop topology between a few routers with a host connected to one of them, when it's default routing directs to the cycle.
Even when observing Wireshark, how can we know its the same ...
- 145
2
votes
1
answer
469
views
How to emuate simple (telnet-like) network protocol with netcat or similar
I have a barcode sensor (Keyence SR-2000) which is able to talk a simple plaintext-based protocol. I could talk to it with the provided (windows-only) app called AutoID Terminal and ontained wireshark ...
- 161
2
votes
2
answers
5k
views
What are the differences between TCP iRTT and ICMP Ping?
I’m attempting to estimate latency between my PC and any servers/clients it interacts with. I don’t want to use Ping for various reasons (requires both ends to allow it, would require additional ...
2
votes
1
answer
525
views
Rapid Spanning Tree Protocol - RSTP Bridge Id isn't RSTP-Priority + Ethernet-MAC
what is the difference between the eth.src Address and the Bridge-System-Id? Sometimes they are the same but mostly not. Attached you will find a screenshot where they are the same.
- 123
2
votes
2
answers
1k
views
Can 'wireshark' truly sense response in nansecond?
I can see the timestamp in Wireshark which ranges up to nanoseconds. But I was just wondering whether it can sense nanoseconds cause in my trace I can't see any activities in the nanosecond range, ...
- 41
2
votes
1
answer
2k
views
How to capture packets from all wifi channels at once?
I'm doing a project in which I need to capture a live feed of all wireless networks available around a given device. I was hoping to go a step further and capture all packets as well using Wireshark, ...
- 317
2
votes
2
answers
6k
views
How to fiter non SSH traffic in Wireshark
I am trying to monitor behaviour of packets from my PC -> VirtualBox machine which represents a virtual router, and I have established SSH session to it.
My question is, how to filter out all SSH ...
- 123
2
votes
1
answer
542
views
last byte received, using wireshark
If the packets captured by wireshark is
28.263227 193.54.236.133 193.54.236.132 66 55555 > 19745 [ACK] Seq=1 Ack=2897 Win=2880 Len=0
28.263228 193.54.236.132 193.54.236.133 1514 19745 > ...
- 141
2
votes
1
answer
320
views
How the frame size getting below 64 bytes
I did packet capture on my system, where i did packet capture on wireless adapter. i seen some frame size below than 64 bytes like 54 bytes and other frame size as well. I seen some document frame ...
- 297
2
votes
1
answer
497
views
Wireshark not showing Frequency/Channel
I am using Ubuntu 18, and wireshark-gtk. I followed this and this tutorials to create a column named/showing frequency/channel.
But all the packets I captured have no frequency/channel showing.I tried ...
- 151
2
votes
1
answer
630
views
Wireshark capture showing a TCP packet with no flags [closed]
In our network, I captured a TCP packet by Wireshark that has no flag set.
What is the meaning of such packet ? Here is the dissection in text format :
Frame 1: 54 bytes on wire (432 bits), 54 bytes ...
- 311
2
votes
1
answer
815
views
Probe Request Channel Information
I have used wireshark to capture Wi-fi frames, and have configured my AP to operate on Channel 1.
Now in one of the transactions that occur, I find my mobile device sending a probe request in the ...
- 21
2
votes
1
answer
86
views
Extracting a bit rate
I'm trying to figure out what is the lowest layer of the OSI model that can be used to extract a bit rate (through a packet sniffer). I'm not sure if it's possible through only the physical layer, or ...
- 23
2
votes
1
answer
814
views
Search for IP addresses in SNMP data field using Wireshark
TLDR: How can I find IP addresses that is communicated via SNMP in the data =>variable-bindings field ?
I am using wireshark to view my pcap and I use the snmp filter. But I would like to go ...
- 145
2
votes
1
answer
679
views
Wireshark - How to find cause of incomplete download
I captured a 70MB tcpdump of a linux client that downloads many big files with curl. At some point curl aborts the download with the errror
transfer closed with 3304876121 bytes remaining to read
(...
- 123
2
votes
1
answer
2k
views
Using Wireshark for traffic capturing in promiscuous mode
I am new to networking; so far we learned about the OSI model, packaging stuff, Wireshark, and network troubleshooting. As I have had understood, Wireshark is able to capture all packets by going to ...
- 21
2
votes
1
answer
908
views
Blank Wireshark GeoIP map
While I was diagnosing a pcapng file on my linux laptop (Debian Wheezy), I wanted to map out where the packets were coming from, so I followed the standard procedure for a building a GeoIP map...
...
- 29.8k
2
votes
1
answer
608
views
IPv4 and UDP/TCP packets inside of ICMP packet?
A week ago, after opening wireshark, i was surprised by seing a storm of ICMP packets from different IP addresses. While deep analysing of thoses packets, i noticed that those ICMP packets contains ...
- 23
2
votes
1
answer
660
views
how to get RSSI information of WiFi users in wireshark?
If I'm able to get 802.11n traffic with my network adapter, would I be able to see the RSSI information? what should be the filter to see it?
- 121
2
votes
1
answer
632
views
Why would my router send an ARP request about a device that's already listed in its ARP cache?
I checked my Ubiquiti EdgeRouterX's ARP table and my laptop IP and MAC address were there. I then checked the DHCP lease and my laptop's IP address doesn't expire until tomorrow. I then ran ...
- 195
2
votes
1
answer
1k
views
Need understanding on Wireshark Capture from LSA update of a link.PCAP attached
Consider OSPF in Area 0 is running on all routers and interfaces.
I advertise a route 223.0.0.1/24 from R4 in the diagram.
PCAP i shared is between r2 and r1 where R2 sends "LS Update"
I'm unable to ...
- 445
2
votes
1
answer
2k
views
how to capture only SMTP using latest Wireshark 2.2.6 or later
I am debugging a problem with my Azure VM Windows server receiving SMTP from the Internet, and want to use Wireshark to show ONLY SMTP.
I would also like to use Wireshark to show the contents of the ...
- 121
2
votes
2
answers
123
views
Detecting a device joining WLAN
Using Wireshark packet capture, I want to be notified when a new device joins my wifi network. Is it possible to determine this by capturing 802.11 control packets? If so, what filters will let me ...
- 23
2
votes
1
answer
358
views
`tcpdump bootp.type == 2` tcpdump: syntax error
tcpdump -i eth0 'bootp.type == 2'
Results in a:
tcpdump: syntax error
However, bootp.type == 2 works fine in Wireshark.
Also tcpdump -i eth0 'tcp[13] & 16!=0' works fine, no syntax error....
- 141
2
votes
1
answer
2k
views
How to refer packets that belong to specific TCP session?
How can I know which packet belongs to a specific TCP session? In my experiment, a client establishes a TCP session with the web server every 5 seconds using wget command (I also noticed it uses ...
- 255
2
votes
1
answer
2k
views
Wireshark to capture router MAC's
Is there any way I can capture the router IP or MAC addresses along the path of a ping packet using Wireshark tool?
- 323
2
votes
2
answers
20k
views
Wireshark Broadcast Storm
Suppose I'm using Wireshark to monitor a broadcast storm. I want to find out the exact instant of time when the capture buffer runs out of memory. How do I monitor this and obtain the exact time ...
- 323
2
votes
1
answer
910
views
How to decide packets whether it is uplink or downllink?
I am having a wireshark capture of scp from my machine end to another end. I want to know, how can I determine whether it is uplink or downlink packets?
EDIT
Uplink means that I am the source and ...
- 181
2
votes
2
answers
3k
views
Using Wireshark to Capture Traffic Between VMs on a Third VM [closed]
I have 3 Ubuntu VMs in VirtualBox. They are in a host-only network (LAN). Now, I turn on the wireshark capturing on VM1, and then on VM2 I ping VM3. I expect to capture the ICMP messages on VM1. ...
- 151