As of May 31, 2023, we have updated our Code of Conduct.

Questions tagged [wireshark]

For questions about Wireshark, a packet analyzer

Filter by
Sorted by
Tagged with
2 votes
1 answer
205 views

how to identify addresses on an ethernet frame

How can I identify the sender's address, the receiver and what type of message does the frame carry on its payload? The frame looks like this: FF FF FF FF FF FF 08 24 F5 CE D3 AC 08 06 00 01 08 00 ...
George's user avatar
  • 39
2 votes
1 answer
955 views

Wireshark trace - POST data with SLE and SRE missing sequence numbers

-Segment 237, the client (10.xxx) sends a POST request to server (128xxx) with a payload of (TCP Len) 4096. -Segment 238, the client continue with the transmission with a payload of 1460 (seq 4097-...
Chloe's user avatar
  • 23
2 votes
1 answer
754 views

Structural unknown HCI Command in Bluetooth LE logs

I am inspecting the Bluetooth HCI snoop logs as part of debugging an application. For dissecting the logs/Bluetooth LE packets I'm using Wireshark. I found that there is a recurring unknown command ...
Zimano's user avatar
  • 123
2 votes
2 answers
12k views

How to determine whether files are downloaded serially or in parallel using Wireshark?

In the http-ethereal-trace provided in the link below there are three HTTP GET request.The 2nd and 3rd request downloads a GIF and JPG format image recpectively.How can we determine wether the two ...
onk101's user avatar
  • 35
2 votes
1 answer
1k views

Npcap Loopback Adapter not showing PING results in Wireshark

I've a server process and a client process running on my machine. To capture the packets transmitted between them, I've installed the Npcap Loopback Adapter as suggested in the ever-so-famous ...
Kushal Kumar's user avatar
2 votes
2 answers
309 views

Wireshark - Displaying HTTP requests with comments only

It seems like a simple filter, but I don't find anything about it on StackExchange or Google itself, nor could I accomplish this myself (only part of it). What I have now is following: http.request....
Fusseldieb's user avatar
2 votes
1 answer
5k views

Extract packets with ECN notification set.

I am trying to understand DCTCP behavior. For that I am using RED queue discipline on switch port. I am generating traffic using iperf3 for 30 seconds. To capture the packets i am using tcpdump. ...
akadam's user avatar
  • 83
2 votes
1 answer
550 views

Wireshark and Scapy sniffs only ARP packets most of the times (and it's one packet in 3 minutes)

My problem is that Wireshark and Scapy sniffs only ARP packets (sometimes LMNRR or DHCP - 5 packets of those in like 20 minutes..). Basically Wireshark and Scapy sniffs 1 packet in like 1-3 minutes, ...
Roy Kuper's user avatar
2 votes
1 answer
6k views

Number of TCP segments for HTTP response - Wireshark

After visiting a simple webpage at my browser, how can I check how many data containing TCP segments carried the HTTP response and the text file, in Wireshark? When I check the Packet List window I ...
ntina.ve's user avatar
2 votes
0 answers
31 views

Average bits/s report in tshark

Does tshark has an option to report average bit/s statistics of the capture which appear in Wireshark at the end of Statistics > Capture File Properties? I'm trying to automate a load test and need ...
jackhab's user avatar
  • 121
2 votes
0 answers
75 views

Does Wireshark capture all Wi-Fi traffic under the same access point even with WPA encryption?

I know that free unencrypted-Wi-Fi is dangerous since all the traffic in the same AP is visible. Does Wireshark capture all Wi-Fi traffic under the same access point even with WPA encryption?
mallea's user avatar
  • 511
2 votes
1 answer
996 views

How to Capture packets generated from linux pktgen traffic generator? [closed]

I am testing an openflow switch for its performance. I am using "pktgen" kernel module available in linux to generate packets at different flow rates. I have a host with two interfaces eth1 and eth2. ...
akadam's user avatar
  • 83
2 votes
2 answers
4k views

Capturing un-encrypted HTTPS traffic using wireshark [closed]

I am trying to capture HTTPS traffic between a client (windows machine) and a server. I would like to do this before the traffic is encrypted as I would like to analyse its contents. Is there easy ...
SivaDotRender's user avatar
2 votes
1 answer
686 views

How to test which process that drops packets?

I simulated a Denial-of-Service attack by connecting two virtual machines, i.e. attack and victim machine. The attack machine sends lots of traffic (http) against the victim machine running an ...
Curioso's user avatar
  • 123
2 votes
0 answers
2k views

High count of packet retransmissions/Dups over IPSEC/VPN [closed]

I'm running IPSEC-VPN (AES256/SHA256/DH14) tunnel between a PaloAlto PA-500 and a Fortigate 110C via Internet (10MBit up/down guaranteed both sides - latency between 40 and 50ms). 90% connections are ...
Stony's user avatar
  • 21
1 vote
2 answers
6k views

how to calculate the MSS in wireshark when the window scaling option is set?

I have a TCP packet as displayed by Wireshark: The MSS is reported at 1430 bytes, and the Window scale suggests that this should be multiplied by 128, giving 183040 bytes. Question: is this the ...
Chris Snow's user avatar
1 vote
3 answers
93 views

UDP encrypted packets

I am analysing a Wireshark capture as part of understanding UDP/TCP, DNS and HTTP concepts and how packets are sent. I found an interesting sequence of messages in the Wireshark file, but I am not ...
Tita's user avatar
  • 113
1 vote
1 answer
177 views

Mac Address Representation wireshark

I'm a little confused. I just learned about two different mac address representations(hexadecimal and bit-reversed representation) in IEEE 802 When hexadecimal representation is used the octets are ...
anstue's user avatar
  • 113
1 vote
3 answers
274 views

Can Ethernet II frame's Type be Layer1's or Layer4's protocol?

The Ethernet II frame's Type field can be IPv4, ARP, so it can be Layer2 and Layer3's protocol. This is a snapshot of frame captured by WireShark. But I have a question, whether it can be other ...
aircraft's user avatar
  • 1,128
1 vote
1 answer
130 views

Does the frame package, all are represent as hex data?

I use Wireshark for capturing packages, get many frames. You see the left light blue background space, all are hex data, and right are converted words we can identify. I mean whether the frame ...
qg_java_17137's user avatar
1 vote
1 answer
718 views

Is it possible to create an IPv4 packet header larger than 20 bytes on an IPv4 connection?

Is it possible to generate an IPv4 packet with an IPv4 packet header larger than 20 bytes on an IPv4 connections?
John D's user avatar
  • 11
1 vote
1 answer
1k views

No DHCPOFFER message captured in Wireshark

I am looking for the answer why packet captures in Wireshark doesn't contain DHCP offer message. I was trying to capture packets directly on the computer with installed Wireshark and doing a SPAN ...
deuter's user avatar
  • 21
1 vote
1 answer
63 views

switch wireshark arp

I connected 4 pcs to a switch, I used pc 1 to ping another pc(pc 3) and used wireshark on all the pc's. The one that sent the ping sent out an arp request and received 4 request and replies from the ...
The_Bear's user avatar
  • 505
1 vote
1 answer
1k views

How to capture ARP Reply packet from all hosts in the network?

How can I capture ARP reply packets from all hosts that are connected in the network? I've tried wireshark premicious mode but it only capture ARP replies from gateway.
Tiffany's user avatar
  • 85
1 vote
1 answer
121 views

what the meaning displayed value in statistic capture wireshark

i have capture some packet with wireshark, in statistic capture windows there is value named Displayed like this then I was figure out that i can count the Capture value (109) from the capure ...
eniac05's user avatar
  • 13
1 vote
1 answer
6k views

Calculated window size in Wireshark

I see that the calculated window size is set to 5888 with the three handshake, however it jumps to 7808 with the first ACK. Can someone explain me why and what algorithm Linux (Linux OS and Wireshark) ...
Joanna's user avatar
  • 51
1 vote
1 answer
149 views

Meaning of A and B in Wireshark Conversation View

In Wireshark's conversation view, do A and B map to source and destination?
ishmandoo's user avatar
  • 113
1 vote
1 answer
89 views

What's the word of a Transmission Control Protocol port in the Wireshark captured package?

What's the meaning of the dict there? why the port have the paraphrase? you see the Destination port 39578 (39578) do not have.
244boy's user avatar
  • 1,747
1 vote
1 answer
967 views

Why a NIC in promiscuous mode and not will impact the capture packages?

I have a question about network interface Promiscuous mode, A NIC in promiscuous mode can receive all data passing through it regardless of whether the destination address of the data is it. If the ...
aircraft's user avatar
  • 1,128
1 vote
1 answer
37 views

What's the meaning of `[`, `<-` and `->` in wireshark?

When I use the WireShark check the packages: there have three place signs I don't understand. the [ means what? two IPs communicative to each other? but there have other IP in the range. you see the ...
aircraft's user avatar
  • 1,128
1 vote
2 answers
6k views

How to measure max bandwidth with Wireshark?

I'm trying to measure the max bandwidth usage of my LAN with Wireshark. I´ve done several packet captures but I don't know how to obtain the max bandwidth usage. Any Idea? Thank you in advance
ArtFe's user avatar
  • 11
1 vote
1 answer
63 views

Where I can find frame specification?

When I capture from wireshark traffic I can see data like this Where I can see the specification of each field? When I read wiki https://en.wikipedia.org/wiki/Ethernet_frame there is nothing like ...
mefisto74's user avatar
1 vote
2 answers
110 views

What kind packets of the Wireshark capture's package?

We know we can use Wireshark for capture packets, we know Wireshark is based on the network interface adapter. This is a list of packets captured by Wireshark: Is Wireshark based on the network ...
qg_java_17137's user avatar
1 vote
1 answer
760 views

Filter pcap file by layer and save to another format [closed]

I captured packets in wireshark, filtered for the protocol I'm interested in (DIS), then exported this to a pcap file. I'd like to do analysis on this data in Python. The only part I'm interested in ...
Austin's user avatar
  • 111
1 vote
1 answer
968 views

Wireshark capture only TCP packets with the RST flag set

I'm quite new to networking and I got stuck while reading "Practical Packet Analysis: Using Wireshark to Solve...". On page 61 it is written: A common scenario is to capture only TCP packets ...
Unix von Bash's user avatar
1 vote
1 answer
450 views

Delayed Ack every 3 segments

I was studying some wireshark captures. I noticed that though Ack's are sent every other packet like i was expecting due to delayed TCP ack, i noticed that at some times it is acking every 3 segments. ...
baskon1's user avatar
  • 155
1 vote
2 answers
103 views

Why are WLAN packages translated to Ethernet packages by Wireshark?

When using Wireshark on my MacBook, I see all my packages wrapped inside Ethernet II frames, although I'm connected wirelessly, which I already figured must be because they are translated from 802.11 ...
hgiesel's user avatar
  • 307
1 vote
1 answer
2k views

Capture auto-negotiation ability flags

I'm performing a set of tests on an embedded device, one of which is "To verify that the control system and instrument supports auto-negotiation". I need to verify that "Expected auto-negotiation is ...
Q-bertsuit's user avatar
1 vote
3 answers
2k views

Wireshark shows wrong protocol

We have connection problems to some 3rd party https endpoints. We checked the network packages via Wireshark to find the problem but we couldn't identify anything yet. I compared one working and one ...
Yucel's user avatar
  • 113
1 vote
1 answer
382 views

Wireshark: configure for capturing ssl data

I'm using Wireshark for getting all https packets and decoding them. I follow two methods in Wireshark. The first method is on this link: Wireshark SSL. In short, I do following things: generate key....
hqt's user avatar
  • 111
1 vote
2 answers
946 views

Sniffing packets while roaming in WLAN

I built a simple WLAN containing two routers used as APs. They are connected to each other with a switch. (Those two routers has different manufacturer) I simulated a seamless roaming between the ...
fahrenheit004's user avatar
1 vote
1 answer
620 views

Arp spoofing and ip detection

I am testing two differents lan and I am tring to sniff traffic with Mitm attack using simple Linux shell command like arpspoof and whireshark to sniff the packets. In the first lan I can sniff ...
Stefano Maglione's user avatar
1 vote
1 answer
10k views

How do I get wireshark to actually display packets [closed]

I've just started using wireshark. I click the blue shark fin, then 10 seconds later click the red stop button. The bar along the bottom of the window says "Packets 47 - Displayed 0". I can't work ...
Aidan Ewen's user avatar
1 vote
2 answers
279 views

Cisco 2900 Default Fast Ethernet Port Speed

What is the default speed of a Fast Ethernet Interface of Cisco 2900 Switch that was just reset to default settings using write erase? I'm asking because my Wireshark capture of ARP packets gives a ...
Danis Fermi's user avatar
1 vote
1 answer
827 views

How does wireshark calculate the TCP length when there is no header indiciating such?

In wireshark, you have this field: [TCP Segment Len: 1380] # How is this calculated? My assumption is using the IP headers plus TCP's. TCP Segment Len = IP Total Length - IHL - TCP Header Length In ...
jerry's user avatar
  • 13
1 vote
1 answer
54 views

Can you gather only a summary of network traffic via Wireshark (or similar)?

Something on my network is using an enormous amount of data and I need to track it down. Its not constant or predictable. I have had a go with Wireshark and I am sure that it could tell me what I ...
Ben's user avatar
  • 113
1 vote
1 answer
1k views

The reason a TCP connection generate retransmission

My question is why a TCP flow make a re-transmission when a network has enough link bandwidth. For finding a cause, I used a wireshark. I got the below captured at a host side (10.0.0.1) 85968 47....
nimdrak's user avatar
  • 25
1 vote
1 answer
949 views

How to filter a wireshark capture (pcapng) by source and destination IPv4 address

I have a bunch of wireshark captures I need to mine data from. Tshark seems to fit the bill but this doesn't support filtering (-f) by the look of it, I simply get: Using: tshark -x -r Run18....
Robbie Dee's user avatar
1 vote
2 answers
613 views

Wireshark expression filters for wireless capture

1) What Wireshark expression filter stack can I utilize to discover how many devices are transmitting in the 2GHz and 5GHz spectrum in a packet capture? 2) What Wireshark expression filter stack can ...
Adrian Cunningham 's user avatar
1 vote
2 answers
7k views

Can not capture DHCP offer with wireshark?

I'd like to capture DHCP packets with wireshark. When I use the filter: "udp.port == 67 or udp.port == 68" I only see the Discover and Request broadcasts. While I thought the DHCP offer also gets ...
Woenktoenk's user avatar