Questions tagged [wireshark]

For questions about Wireshark, a packet analyzer

Filter by
Sorted by
Tagged with
3 votes
1 answer
2k views

Wireshark Protocol Hierarchy explanation

I'm trying to calculate how much bandwidth is utilised for a particular protocol, at the different layers. Wireshark Protocol Hierarchy gives something like this: Protocol %Bytes Bytes Frame ...
Yusuf's user avatar
  • 187
3 votes
2 answers
440 views

Which tcpdump metrics reveal server connectivity problems vs client problems?

I am attempting to diagnose a ~45 sec drop (to 0 Kbps) in the reported RTMP streaming bitrate in OBS while publishing a live stream. I had been running a tcpdump the entire time using Apple's ...
esilver's user avatar
  • 133
3 votes
1 answer
4k views

How can I plot the TCP RTT graph in Wireshark?

I'm suspecting one of our Host is not performing well in the TCP protocol Level.I have tried to plot the TCP RTT graph using tcp.analysis option in the IO graph.However,I'm not finding the right ...
Maverick's user avatar
  • 1,412
3 votes
1 answer
4k views

Why is the FCS not included in most ethernet frames?

I turned on the calculatin of the FCS Checksum in wireshark. There wasn't a single correct checksum in the whole 500MB packet dump. I asume the reason for this is that the field is simply not used for ...
davidb's user avatar
  • 229
3 votes
1 answer
544 views

Convert BFR to PCAP without loosing nano-second resolution

i have a BFR file from a customer that contains nano-second resolution. OI can convert it via tshark, but it does not retain the nano-second resolution on the end pcap file. Is there a way to convert ...
user2066671's user avatar
3 votes
1 answer
4k views

Why should one server repeatedly ARP for the same host?

I am trying to use Wireshark to find the root cause of a particularly slow network, and started by examining Broadcast traffic. Not only does Broadcast traffic represent over 25% of total traffic (at ...
user5449's user avatar
3 votes
1 answer
112 views

Total data length transfered in 802.11 using Wireshark

How could I get the total size of a some data that has been transfered using UDP over a wireless channel from a Wireshark capture trace ? I have read somewhere that the sender advertise the total size ...
ecdhe's user avatar
  • 131
3 votes
2 answers
148 views

How to filter traffic for the address of a name like this? [closed]

How to filter traffic for the address of type: p309-pmr.ii.ucla.edu.uk? What kinds of servers are generally these types of names given to : p309-pmr.ii.ucla.edu.uk? Is this a DNS server or IP server?...
user avatar
3 votes
1 answer
171 views

No packets showing up in Wireshark despite Client-Server communication

I am somewhat new to computer networking and I created a little project where I have two computers connected to an Ethernet switch, forming a small network. Computer server (192.168.1.1) has a mail-...
Mantabit's user avatar
  • 141
3 votes
2 answers
1k views

Receive order of bits in network packet fields

I've been interested in networking for awhile and have a basic question that was never answered or brought up in any of my classes. I was looking at the 802.11 WLAN frame format: It looks like the ...
slantalpha's user avatar
3 votes
1 answer
526 views

Why the pcap file always shows more bytes downloaded than the actual file size downloaded when using wireshark?

When capturing a dump using wireshark during download of a file and then exploring the total bytes downloaded in pcap is always greater than the actual file downloaded. for example 700000 bytes ...
Bilal's user avatar
  • 33
3 votes
2 answers
876 views

Wireshark capturing the start of a flow

Is it possible to capture only the first 10k of data in a TCP flow and discard the rest at capture time? I have a large number of TCP sessions where each session starts with some metadata and then ...
Jason Andresen's user avatar
2 votes
2 answers
21k views

Ethernet frame IG/LG bit explanation - Wireshark

I have a screenshot of an ethernet packet frame from Wireshark. I need to explain what is the meaning of these marked lines (with dots and zeros). I searched in web, but still I don't have an answer. ...
Jakub's user avatar
  • 21
2 votes
3 answers
5k views

How to find packet loss in Wireshark network dump file?

I am a beginner in Wireshark, and I would like to find some problems with a TCP connection. Basically, I have some sockets timing out, and I would like to find out if the message (packet) being sent ...
Bionix1441's user avatar
2 votes
2 answers
351 views

tcp connection and stream flow question

Could anyone explain the main principe of tcp flow when making a session ? I have take a tcp dump when i'm trying to browse a site. when I analyse the packet by wireshark, i have found many Three way ...
Mamitiana Ra's user avatar
2 votes
2 answers
2k views

Calculating the throughput of a given TCP connection

Given a TCP session, is there a way to determine the throughput of the sender? I have a wireshark sniff, and I see that to calculate the throughput of the sender I can use the TCP-Window-Size-in-bits /...
DsCpp's user avatar
  • 189
2 votes
2 answers
801 views

Wireshark http filter question

Are the filters http.host != "" and http.host the same? The first one makes the filter text edit turn yellow (suggesting I may get undesirable results) whereas the second passes the syntax check fine. ...
Isaac's user avatar
  • 123
2 votes
1 answer
234 views

IPV6 ping, the pinged address is different from the once caught by wireshark

I'm trying to ping an ECU, both PC and ECU have static IPV6 address the problem is that the target address (ECU) pinged is different from the one caught by Wireshark subnet : 64 ping command $ ...
bouqbouq's user avatar
  • 145
2 votes
2 answers
870 views

Some clients not getting an dhcp address and some don't ping the default gateway

I have a server hardware with installed windows server and DHCP server running on it. My network is 192.168.0.0/24. A small issue we just faced is the client machines could not get an IP address ...
allwynmasc's user avatar
2 votes
2 answers
10k views

TCP Window Size Allocation and TCP Zero Window Errors

Greetings Everyone! My mind is about to explode as everyone is always blaming the network guys for disconnections and slowness in the networks, but Solarwinds Reports that all utilization in the ...
Rufi's user avatar
  • 111
2 votes
1 answer
714 views

Speed of capture packets in monitor mode

I have one doubt about the speed of packets capture in monitor mode. If i have a 300mbps usb wifi adapter in monitor mode, what is the max speed of packet capture? The 300mbps of my adapter is ...
Diego Bernardes's user avatar
2 votes
2 answers
85 views

Loops in routers-same packet?

Considering a loop topology between a few routers with a host connected to one of them, when it's default routing directs to the cycle. Even when observing Wireshark, how can we know its the same ...
Danny Blozrov's user avatar
2 votes
1 answer
469 views

How to emuate simple (telnet-like) network protocol with netcat or similar

I have a barcode sensor (Keyence SR-2000) which is able to talk a simple plaintext-based protocol. I could talk to it with the provided (windows-only) app called AutoID Terminal and ontained wireshark ...
eudoxos's user avatar
  • 161
2 votes
2 answers
5k views

What are the differences between TCP iRTT and ICMP Ping?

I’m attempting to estimate latency between my PC and any servers/clients it interacts with. I don’t want to use Ping for various reasons (requires both ends to allow it, would require additional ...
Matthew Dunlop's user avatar
2 votes
1 answer
525 views

Rapid Spanning Tree Protocol - RSTP Bridge Id isn't RSTP-Priority + Ethernet-MAC

what is the difference between the eth.src Address and the Bridge-System-Id? Sometimes they are the same but mostly not. Attached you will find a screenshot where they are the same.
Charlie's user avatar
  • 123
2 votes
2 answers
1k views

Can 'wireshark' truly sense response in nansecond?

I can see the timestamp in Wireshark which ranges up to nanoseconds. But I was just wondering whether it can sense nanoseconds cause in my trace I can't see any activities in the nanosecond range, ...
Fida Hasan's user avatar
2 votes
1 answer
2k views

How to capture packets from all wifi channels at once?

I'm doing a project in which I need to capture a live feed of all wireless networks available around a given device. I was hoping to go a step further and capture all packets as well using Wireshark, ...
joshlf's user avatar
  • 317
2 votes
2 answers
6k views

How to fiter non SSH traffic in Wireshark

I am trying to monitor behaviour of packets from my PC -> VirtualBox machine which represents a virtual router, and I have established SSH session to it. My question is, how to filter out all SSH ...
fugitive's user avatar
  • 123
2 votes
1 answer
542 views

last byte received, using wireshark

If the packets captured by wireshark is 28.263227 193.54.236.133 193.54.236.132 66 55555 > 19745 [ACK] Seq=1 Ack=2897 Win=2880 Len=0 28.263228 193.54.236.132 193.54.236.133 1514 19745 > ...
lukas irides's user avatar
2 votes
1 answer
320 views

How the frame size getting below 64 bytes

I did packet capture on my system, where i did packet capture on wireless adapter. i seen some frame size below than 64 bytes like 54 bytes and other frame size as well. I seen some document frame ...
velpandian's user avatar
2 votes
1 answer
497 views

Wireshark not showing Frequency/Channel

I am using Ubuntu 18, and wireshark-gtk. I followed this and this tutorials to create a column named/showing frequency/channel. But all the packets I captured have no frequency/channel showing.I tried ...
Aven Desta's user avatar
2 votes
1 answer
630 views

Wireshark capture showing a TCP packet with no flags [closed]

In our network, I captured a TCP packet by Wireshark that has no flag set. What is the meaning of such packet ? Here is the dissection in text format : Frame 1: 54 bytes on wire (432 bits), 54 bytes ...
R1w's user avatar
  • 311
2 votes
1 answer
815 views

Probe Request Channel Information

I have used wireshark to capture Wi-fi frames, and have configured my AP to operate on Channel 1. Now in one of the transactions that occur, I find my mobile device sending a probe request in the ...
Arvind Kumar's user avatar
2 votes
1 answer
86 views

Extracting a bit rate

I'm trying to figure out what is the lowest layer of the OSI model that can be used to extract a bit rate (through a packet sniffer). I'm not sure if it's possible through only the physical layer, or ...
Tom Dawn's user avatar
2 votes
1 answer
814 views

Search for IP addresses in SNMP data field using Wireshark

TLDR: How can I find IP addresses that is communicated via SNMP in the data =>variable-bindings field ? I am using wireshark to view my pcap and I use the snmp filter. But I would like to go ...
kenfire's user avatar
  • 145
2 votes
1 answer
679 views

Wireshark - How to find cause of incomplete download

I captured a 70MB tcpdump of a linux client that downloads many big files with curl. At some point curl aborts the download with the errror transfer closed with 3304876121 bytes remaining to read (...
hypnomaki's user avatar
  • 123
2 votes
1 answer
2k views

Using Wireshark for traffic capturing in promiscuous mode

I am new to networking; so far we learned about the OSI model, packaging stuff, Wireshark, and network troubleshooting. As I have had understood, Wireshark is able to capture all packets by going to ...
TobyW's user avatar
  • 21
2 votes
1 answer
908 views

Blank Wireshark GeoIP map

While I was diagnosing a pcapng file on my linux laptop (Debian Wheezy), I wanted to map out where the packets were coming from, so I followed the standard procedure for a building a GeoIP map... ...
Mike Pennington's user avatar
2 votes
1 answer
608 views

IPv4 and UDP/TCP packets inside of ICMP packet?

A week ago, after opening wireshark, i was surprised by seing a storm of ICMP packets from different IP addresses. While deep analysing of thoses packets, i noticed that those ICMP packets contains ...
Yazid's user avatar
  • 23
2 votes
1 answer
660 views

how to get RSSI information of WiFi users in wireshark?

If I'm able to get 802.11n traffic with my network adapter, would I be able to see the RSSI information? what should be the filter to see it?
Natiya's user avatar
  • 121
2 votes
1 answer
632 views

Why would my router send an ARP request about a device that's already listed in its ARP cache?

I checked my Ubiquiti EdgeRouterX's ARP table and my laptop IP and MAC address were there. I then checked the DHCP lease and my laptop's IP address doesn't expire until tomorrow. I then ran ...
vim_usr's user avatar
  • 195
2 votes
1 answer
1k views

Need understanding on Wireshark Capture from LSA update of a link.PCAP attached

Consider OSPF in Area 0 is running on all routers and interfaces. I advertise a route 223.0.0.1/24 from R4 in the diagram. PCAP i shared is between r2 and r1 where R2 sends "LS Update" I'm unable to ...
Terminator's user avatar
2 votes
1 answer
2k views

how to capture only SMTP using latest Wireshark 2.2.6 or later

I am debugging a problem with my Azure VM Windows server receiving SMTP from the Internet, and want to use Wireshark to show ONLY SMTP. I would also like to use Wireshark to show the contents of the ...
Doug Null's user avatar
  • 121
2 votes
2 answers
123 views

Detecting a device joining WLAN

Using Wireshark packet capture, I want to be notified when a new device joins my wifi network. Is it possible to determine this by capturing 802.11 control packets? If so, what filters will let me ...
paolodm's user avatar
  • 23
2 votes
1 answer
358 views

`tcpdump bootp.type == 2` tcpdump: syntax error

tcpdump -i eth0 'bootp.type == 2' Results in a: tcpdump: syntax error However, bootp.type == 2 works fine in Wireshark. Also tcpdump -i eth0 'tcp[13] & 16!=0' works fine, no syntax error....
Elijah Lynn's user avatar
2 votes
1 answer
2k views

How to refer packets that belong to specific TCP session?

How can I know which packet belongs to a specific TCP session? In my experiment, a client establishes a TCP session with the web server every 5 seconds using wget command (I also noticed it uses ...
Steven's user avatar
  • 255
2 votes
1 answer
2k views

Wireshark to capture router MAC's

Is there any way I can capture the router IP or MAC addresses along the path of a ping packet using Wireshark tool?
Danis Fermi's user avatar
2 votes
2 answers
20k views

Wireshark Broadcast Storm

Suppose I'm using Wireshark to monitor a broadcast storm. I want to find out the exact instant of time when the capture buffer runs out of memory. How do I monitor this and obtain the exact time ...
Danis Fermi's user avatar
2 votes
1 answer
910 views

How to decide packets whether it is uplink or downllink?

I am having a wireshark capture of scp from my machine end to another end. I want to know, how can I determine whether it is uplink or downlink packets? EDIT Uplink means that I am the source and ...
Kalu's user avatar
  • 181
2 votes
2 answers
3k views

Using Wireshark to Capture Traffic Between VMs on a Third VM [closed]

I have 3 Ubuntu VMs in VirtualBox. They are in a host-only network (LAN). Now, I turn on the wireshark capturing on VM1, and then on VM2 I ping VM3. I expect to capture the ICMP messages on VM1. ...
ZillGate's user avatar
  • 151