Questions tagged [wireshark]
For questions about Wireshark, a packet analyzer
294
questions
2
votes
2
answers
22k
views
Wireshark Broadcast Storm
Suppose I'm using Wireshark to monitor a broadcast storm. I want to find out the exact instant of time when the capture buffer runs out of memory. How do I monitor this and obtain the exact time ...
- 323
2
votes
1
answer
1k
views
How to decide packets whether it is uplink or downllink?
I am having a wireshark capture of scp from my machine end to another end. I want to know, how can I determine whether it is uplink or downlink packets?
EDIT
Uplink means that I am the source and ...
- 181
2
votes
2
answers
3k
views
Using Wireshark to Capture Traffic Between VMs on a Third VM [closed]
I have 3 Ubuntu VMs in VirtualBox. They are in a host-only network (LAN). Now, I turn on the wireshark capturing on VM1, and then on VM2 I ping VM3. I expect to capture the ICMP messages on VM1. ...
- 151
2
votes
1
answer
224
views
how to identify addresses on an ethernet frame
How can I identify the sender's address, the receiver and what type of message does the frame carry on its payload?
The frame looks like this:
FF FF FF FF FF FF 08 24 F5 CE D3 AC 08 06 00 01 08 00 ...
- 39
2
votes
1
answer
1k
views
Wireshark trace - POST data with SLE and SRE missing sequence numbers
-Segment 237, the client (10.xxx) sends a POST request to server (128xxx) with a payload of (TCP Len) 4096.
-Segment 238, the client continue with the transmission with a payload of 1460 (seq 4097-...
- 23
2
votes
1
answer
803
views
Structural unknown HCI Command in Bluetooth LE logs
I am inspecting the Bluetooth HCI snoop logs as part of debugging an application. For dissecting the logs/Bluetooth LE packets I'm using Wireshark.
I found that there is a recurring unknown command ...
- 123
2
votes
2
answers
13k
views
How to determine whether files are downloaded serially or in parallel using Wireshark?
In the http-ethereal-trace provided in the link below there are three HTTP GET request.The 2nd and 3rd request downloads a GIF and JPG format image recpectively.How can we determine wether the two ...
- 35
2
votes
1
answer
2k
views
Npcap Loopback Adapter not showing PING results in Wireshark
I've a server process and a client process running on my machine. To capture the packets transmitted between them, I've installed the Npcap Loopback Adapter as suggested in the ever-so-famous ...
- 21
2
votes
2
answers
318
views
Wireshark - Displaying HTTP requests with comments only
It seems like a simple filter, but I don't find anything about it on StackExchange or Google itself, nor could I accomplish this myself (only part of it).
What I have now is following:
http.request....
- 163
2
votes
1
answer
6k
views
Extract packets with ECN notification set.
I am trying to understand DCTCP behavior. For that I am using RED queue discipline on switch port. I am generating traffic using iperf3 for 30 seconds. To capture the packets i am using tcpdump. ...
- 83
2
votes
1
answer
574
views
Wireshark and Scapy sniffs only ARP packets most of the times (and it's one packet in 3 minutes)
My problem is that Wireshark and Scapy sniffs only ARP packets (sometimes LMNRR or DHCP - 5 packets of those in like 20 minutes..).
Basically Wireshark and Scapy sniffs 1 packet in like 1-3 minutes, ...
- 21
2
votes
1
answer
6k
views
Number of TCP segments for HTTP response - Wireshark
After visiting a simple webpage at my browser, how can I check how many data containing TCP segments carried the HTTP response and the text file, in Wireshark?
When I check the Packet List window I ...
- 23
2
votes
0
answers
62
views
Average bits/s report in tshark
Does tshark has an option to report average bit/s statistics of the capture which appear in Wireshark at the end of Statistics > Capture File Properties?
I'm trying to automate a load test and need ...
- 121
2
votes
0
answers
307
views
Hide/replace certain source and destination IP in Wireshark packet table
For demonstration purposes I need to show Wireshark packet table, but I need to hide some of the IP's there, like show 10.0.0.1 instead of 192.168.1.19. Very old threads suggest using Linux-only tools ...
- 121
2
votes
1
answer
1k
views
How to Capture packets generated from linux pktgen traffic generator? [closed]
I am testing an openflow switch for its performance. I am using "pktgen" kernel module available in linux to generate packets at different flow rates. I have a host with two interfaces eth1 and eth2. ...
- 83
2
votes
2
answers
4k
views
Capturing un-encrypted HTTPS traffic using wireshark [closed]
I am trying to capture HTTPS traffic between a client (windows machine) and a server. I would like to do this before the traffic is encrypted as I would like to analyse its contents.
Is there easy ...
- 121
2
votes
1
answer
725
views
How to test which process that drops packets?
I simulated a Denial-of-Service attack by connecting two virtual machines, i.e. attack and victim machine. The attack machine sends lots of traffic (http) against the victim machine running an ...
- 123
2
votes
0
answers
2k
views
High count of packet retransmissions/Dups over IPSEC/VPN [closed]
I'm running IPSEC-VPN (AES256/SHA256/DH14) tunnel between a PaloAlto PA-500 and a Fortigate 110C via Internet (10MBit up/down guaranteed both sides - latency between 40 and 50ms).
90% connections are ...
- 21
1
vote
2
answers
6k
views
how to calculate the MSS in wireshark when the window scaling option is set?
I have a TCP packet as displayed by Wireshark:
The MSS is reported at 1430 bytes, and the Window scale suggests that this should be multiplied by 128, giving 183040 bytes.
Question: is this the ...
- 113
1
vote
3
answers
179
views
UDP encrypted packets
I am analysing a Wireshark capture as part of understanding UDP/TCP, DNS and HTTP concepts and how packets are sent.
I found an interesting sequence of messages in the Wireshark file, but I am not ...
- 123
1
vote
1
answer
192
views
Mac Address Representation wireshark
I'm a little confused. I just learned about two different mac address representations(hexadecimal and bit-reversed representation) in IEEE 802
When hexadecimal representation is used the octets are ...
- 113
1
vote
3
answers
324
views
Can Ethernet II frame's Type be Layer1's or Layer4's protocol?
The Ethernet II frame's Type field can be IPv4, ARP, so it can be Layer2 and Layer3's protocol.
This is a snapshot of frame captured by WireShark.
But I have a question, whether it can be other ...
- 1,128
1
vote
1
answer
176
views
Does the frame package, all are represent as hex data?
I use Wireshark for capturing packages, get many frames.
You see the left light blue background space, all are hex data, and right are converted words we can identify.
I mean whether the frame ...
- 535
1
vote
1
answer
749
views
Is it possible to create an IPv4 packet header larger than 20 bytes on an IPv4 connection?
Is it possible to generate an IPv4 packet with an IPv4 packet header larger than 20 bytes on an IPv4 connections?
- 11
1
vote
1
answer
1k
views
No DHCPOFFER message captured in Wireshark
I am looking for the answer why packet captures in Wireshark doesn't contain DHCP offer message. I was trying to capture packets directly on the computer with installed Wireshark and doing a SPAN ...
- 21
1
vote
1
answer
67
views
switch wireshark arp
I connected 4 pcs to a switch, I used pc 1 to ping another pc(pc 3) and used wireshark on all the pc's. The one that sent the ping sent out an arp request and received 4 request and replies from the ...
- 515
1
vote
1
answer
1k
views
How to capture ARP Reply packet from all hosts in the network?
How can I capture ARP reply packets from all hosts that are connected in the network?
I've tried wireshark premicious mode but it only capture ARP replies from gateway.
- 85
1
vote
1
answer
124
views
what the meaning displayed value in statistic capture wireshark
i have capture some packet with wireshark, in statistic capture windows there is value named Displayed like this
then I was figure out that i can count the Capture value (109) from the capure ...
- 13
1
vote
1
answer
6k
views
Calculated window size in Wireshark
I see that the calculated window size is set to 5888 with the three handshake, however it jumps to 7808 with the first ACK.
Can someone explain me why and what algorithm Linux (Linux OS and Wireshark) ...
- 51
1
vote
1
answer
205
views
Meaning of A and B in Wireshark Conversation View
In Wireshark's conversation view, do A and B map to source and destination?
- 113
1
vote
1
answer
98
views
What's the word of a Transmission Control Protocol port in the Wireshark captured package?
What's the meaning of the dict there? why the port have the paraphrase? you see the Destination port 39578 (39578) do not have.
- 1,747
1
vote
1
answer
1k
views
Why a NIC in promiscuous mode and not will impact the capture packages?
I have a question about network interface Promiscuous mode,
A NIC in promiscuous mode can receive all data passing through it regardless of whether the destination address of the data is it. If the ...
- 1,128
1
vote
1
answer
37
views
What's the meaning of `[`, `<-` and `->` in wireshark?
When I use the WireShark check the packages:
there have three place signs I don't understand.
the [ means what? two IPs communicative to each other? but there have other IP in the range. you see the ...
- 1,128
1
vote
2
answers
7k
views
How to measure max bandwidth with Wireshark?
I'm trying to measure the max bandwidth usage of my LAN with Wireshark. I´ve done several packet captures but I don't know how to obtain the max bandwidth usage.
Any Idea?
Thank you in advance
- 11
1
vote
1
answer
76
views
Where I can find frame specification?
When I capture from wireshark traffic I can see data like this
Where I can see the specification of each field?
When I read wiki https://en.wikipedia.org/wiki/Ethernet_frame there is nothing like ...
- 11
1
vote
2
answers
129
views
What kind packets of the Wireshark capture's package?
We know we can use Wireshark for capture packets, we know Wireshark is based on the network interface adapter.
This is a list of packets captured by Wireshark:
Is Wireshark based on the network ...
- 535
1
vote
1
answer
798
views
Filter pcap file by layer and save to another format [closed]
I captured packets in wireshark, filtered for the protocol I'm interested in (DIS), then exported this to a pcap file. I'd like to do analysis on this data in Python. The only part I'm interested in ...
- 111
1
vote
1
answer
1k
views
Wireshark capture only TCP packets with the RST flag set
I'm quite new to networking and I got stuck while reading "Practical Packet Analysis: Using Wireshark to Solve...".
On page 61 it is written:
A common scenario is to capture only TCP packets ...
- 113
1
vote
1
answer
484
views
Delayed Ack every 3 segments
I was studying some wireshark captures. I noticed that though Ack's are sent every other packet like i was expecting due to delayed TCP ack, i noticed that at some times it is acking every 3 segments. ...
- 165
1
vote
2
answers
107
views
Why are WLAN packages translated to Ethernet packages by Wireshark?
When using Wireshark on my MacBook, I see all my packages wrapped inside Ethernet II frames, although I'm connected wirelessly, which I already figured must be because they are translated from 802.11 ...
- 307
1
vote
1
answer
2k
views
Capture auto-negotiation ability flags
I'm performing a set of tests on an embedded device, one of which is "To verify that the control system and instrument supports auto-negotiation". I need to verify that "Expected auto-negotiation is ...
- 123
1
vote
3
answers
2k
views
Wireshark shows wrong protocol
We have connection problems to some 3rd party https endpoints.
We checked the network packages via Wireshark to find the problem but we couldn't identify anything yet.
I compared one working and one ...
- 113
1
vote
1
answer
388
views
Wireshark: configure for capturing ssl data
I'm using Wireshark for getting all https packets and decoding them.
I follow two methods in Wireshark. The first method is on this link: Wireshark SSL. In short, I do following things:
generate key....
- 111
1
vote
2
answers
1k
views
Sniffing packets while roaming in WLAN
I built a simple WLAN containing two routers used as APs. They are connected to each other with a switch. (Those two routers has different manufacturer) I simulated a seamless roaming between the ...
1
vote
1
answer
628
views
Arp spoofing and ip detection
I am testing two differents lan and I am tring to sniff traffic with Mitm attack using simple Linux shell command like arpspoof and whireshark to sniff the packets. In the first lan I can sniff ...
- 111
1
vote
1
answer
10k
views
How do I get wireshark to actually display packets [closed]
I've just started using wireshark. I click the blue shark fin, then 10 seconds later click the red stop button. The bar along the bottom of the window says "Packets 47 - Displayed 0".
I can't work ...
- 111
1
vote
2
answers
300
views
Cisco 2900 Default Fast Ethernet Port Speed
What is the default speed of a Fast Ethernet Interface of Cisco 2900 Switch that was just reset to default settings using write erase?
I'm asking because my Wireshark capture of ARP packets gives a ...
- 323
1
vote
1
answer
6k
views
Wireshark not capturing packets?
I am trying to use Wireshark, but for some reason it won't capture packets. I've used it once before and it worked just fine, so I can't understand why it's not working right now. The only thing I've ...
- 123
1
vote
1
answer
1k
views
How does wireshark calculate the TCP length when there is no header indiciating such?
In wireshark, you have this field:
[TCP Segment Len: 1380] # How is this calculated?
My assumption is using the IP headers plus TCP's.
TCP Segment Len = IP Total Length - IHL - TCP Header Length
In ...
- 13
1
vote
1
answer
59
views
Can you gather only a summary of network traffic via Wireshark (or similar)?
Something on my network is using an enormous amount of data and I need to track it down. Its not constant or predictable.
I have had a go with Wireshark and I am sure that it could tell me what I ...
- 113