Questions tagged [wireshark]
For questions about Wireshark, a packet analyzer
287
questions
1
vote
2
answers
306
views
Method in wireshark to filter for any in a set of mac addresses but no others
I am sniffing for several devices in a congested environment. I'm wondering if there is an easy way to accomplish filtering that I don't know of.
I have two APs that things are connecting to so I ...
user37353
1
vote
1
answer
523
views
Wireshark - Application Layer with Data
I am not sure if the title is the correct one.
When transfering files over the network, in Wireshark, we see abbreviations like:
- PK -> Beginning of a file. Is it a compressed file?
- OFT2 -> ...
- 113
1
vote
1
answer
122
views
Capturing traffic on wire from an endpoint
Say I have my computer connected to a router with an Ethernet cable. How do I capture all packets on the wire? (possibly with using some kind of hardware that's much cheaper than another computer)
I ...
- 165
1
vote
1
answer
183
views
Different results when same WireShark pcap file opened in Unbuntu17.04 and later Windows 10
Using Ubertooth, a bluetooth sniffer, I created a pcap file in Unbuntu that captured some data.
When I opened that file in WireShark 2.4.1 in Windows 10 it showed more information in the SMP data ...
- 35
1
vote
2
answers
199
views
Wireshark capturing device ip
ok so here's the scenario:
Computer A captures some packets and saves the session into file 'traffic'.
Later on, Computer B opens the 'traffic' file and wants to know who captured the file...the ip ...
- 11
1
vote
2
answers
432
views
How many HTTP servers are contacted?
I am working in wireshark and analyzing the traffic generated by a PC during web browsing. What filter should I use to know how many HTTP servers are contacted?
I mean, can I just filter the tcp....
- 13
1
vote
2
answers
238
views
Why can't i see wireless traffic not addressed to my wireless interface with wireshark
I'm using Wireshark to capture traffic on my 2.4G wifi network. I'm set to promiscuous mode, but I only see traffic to or from me, or broadcast or multicast traffic. Unless I'm remembering ...
- 11
1
vote
1
answer
217
views
How do I generate ESP trafic (IPv6)?
I have this topology:
I only have moon and sun. After the connection was successfully established, I need to generate ESP packets for wireshark capture.
How do I generate ESP packets?
When I use ...
1
vote
1
answer
207
views
Is it possible to capture ieee802.11 management and control frames from the same phone using android APP or tcpdump on root device?
I am trying to study the traffic between the mobile and access points. So I have phone Galaxy Nexus which does not support monitoring mode but still support promiscuous mode. Unfortunately, I try many ...
- 13
1
vote
2
answers
2k
views
WireShark: How can I determine how many hosts are on the same wi-fi as me?
I need to determine the number of hosts on my network using wireshark. From what I have gathered, this is impossible on a Windows machine. Is this the case?
This is for school, so I simply need to ...
1
vote
1
answer
1k
views
How to automate Wireshark GUI like IO Graph
I use a lot IO Graph in Wireshark but for each capture, I have to set again (and again...) all my "preferences" for X/Y Axis and Graph 2/3 filters and so on...
That is really annoying. I looked at ...
- 111
1
vote
1
answer
36
views
Is there a way to precompile data from pcap to speed up booting wireshark?
Is there a way to precompile/precalculate the data from a pcap file to speed up booting wireshark?
I have a big pcap file and wireshark is crashing when I try to open it.
I know it sums and computes a ...
- 121
1
vote
1
answer
323
views
Does Ethernet have a header and a trailer?
I have read that Ethernet have a header and a trailer, but in Wireshark I can only see an Ethernet header and no Ethernet trailer.
- 13
1
vote
1
answer
43
views
what are scenario where re-transmission packets can been seen in wireshark logs
While troubleshooting i came across this challenge ,able to see retransmission packets continuously in packet capture . please let me know in what scenarios this retransmission packets are seen.
user74916
1
vote
1
answer
619
views
Why the different colours for SACK markers in Wireshark's tcptrace graph?
Wireshark's tcptrace time sequence graph shows a good deal of information, but I cannot find a document that spells out exactly what it all means. It's broadly similar to the original tcptrace except ...
- 121
1
vote
1
answer
461
views
Capturing dot1q packets with Wireshark on a PC
I have spent the last few hours trying to capture some trunk packets so I can see and examine the dot1q VLAN field. I have tried mirroring the trunk port to my PC using the following commands on Cisco ...
1
vote
1
answer
209
views
How do I interpret this Wireshark log file?
I'm new to using Wireshark and I'd like some help with analyzing the log shown in the image.
I also ran a nmap scan of the ports on my computer, but I'm not able to identify which of these lines are ...
- 11
1
vote
1
answer
4k
views
what's the difference between trailer and padding field in ethernet frame captured by wireshark?
The Ethernet minimum length should be 64 Bytes, so when the data is less than 46B, there would be some extra bytes padding to the end of data, make sure the frame size up to 64B.
When I capture the ...
- 13
1
vote
1
answer
187
views
How to find time duration of tracert command using wireshark?
I tried to execute a tracert command in cmd in Windows 10, specifically, tracert www.ieee.org.
In the same time, I captured the packets with wireshark.
How can I find the time duration of my tracert ...
1
vote
1
answer
57
views
Packet analyze on router does not match client and server
thank you for your time.
My (virtual) network has 3 objects : a client, a server and a router between them.
I'm sniffing the traffic on the 3 machine with the command
tcpdump -i any -s 0 -w [path]
...
- 13
1
vote
1
answer
100
views
What's the hook and double hook meaning in wireshark?
What's the hook and double hook meaning in wireshark?
you see the two snapshots up there, when I select #7 the #6 will be hooked.
when I select the #8, the #5 will be double hooked.
What's the ...
- 1,128
1
vote
2
answers
776
views
How can i monitor ARP packet on WiFi network?
I want to monitor packet in my network. It said that ARP packet request broadcasted all over network. But why i only see my arp request packet and reply packet to the gateway?
- 85
1
vote
1
answer
697
views
What is "cflow" in ipfix？
I am learning ipfix and found a cmd like this:
tshark -r ipfix.cap -n -d udp.port==4379，cflow -O cflow
What does the cflow part mean here?
I was also told to filter cflow if I use Wireshark in ...
- 179
1
vote
1
answer
718
views
Wireshark lua Dissector sharing common variable among all packets
I just started with lua plugins in wireshark. I wanted to know if it is possible to create like a global object that can be called by dissector in one packet and used by dissector called by another ...
- 13
1
vote
1
answer
5k
views
Calculated window size value in SYN segment differ from calculated value in ACK segment
I am a bit confused about the window size value in some TCP segments. I think I understand the theory behind the window size field and how it is modified when the window scale option is provided ...
- 13
1
vote
1
answer
16k
views
Wireshark No response seen sending ping request
I'm building my own packets and sending them through a raw socket. The packet is apparently A-OK, but I'm not getting any replies.
Sequence block is generated with a for loop.
Identifier block is ...
- 13
1
vote
1
answer
559
views
Why is my pc not forwarding packets to my default gateway?
I understand that if I were to send a packet to a destination outside my LAN, it would have to reach the gateway first before it is being routed to the final destination. However, when I visit a ...
- 161
1
vote
1
answer
533
views
What are the testing possibilities of wireshark?
I got an information that tcpdump is same like wireshark. In using tcpdump we can capture the packets, but in wireshark we can see the GUI of packet capture. Later I understand that we can use the ...
- 23
1
vote
1
answer
100
views
Wireshark PCAP file clarification
I need your support urgently as I've a problem in the connection between 2 servers.
Here's the below when the connection became down, but this is from the other side so I can't identify what is it ?
...
- 19
1
vote
1
answer
416
views
Confirm DFS issues using Monitor Mode + Wireshark
I believe that our AP's are being affected by DFS but need a way to "prove" this issue before getting any kind of change enacted. Using Wireshark, is there anyway that I can watch the network traffic ...
- 113
1
vote
1
answer
648
views
ICMP TTL-exceeded header shows Length: 243 [Length of original datagram: 972] in wireshark. Original TCP-SYN was 58 Bytes
TCP SYN for traceroute
ICMP header shows
Length 243
[Length of original datagram: 972]
Not sure how this works, as I sent a TCP-SYN of 58 Bytes frame. Please explain
1
vote
1
answer
102
views
Five consequtive SYN-messages from client to server
the 5 packages 333 -> 337. What are those and why does the client do this? More generally, why does the client send five SYN-messages to the server?
- 113
1
vote
1
answer
504
views
Different types of ICMP [closed]
I have a task on which I have spent a lot of time. I am not fluent in Linux, but I can manage basic things.
The task is to gather different types of ICMP packets. I can harvest them by tcpdump (which ...
- 11
1
vote
1
answer
139
views
Is it the Proxy Server slowing us? [closed]
So it's the usual Server vs Network battle. What's the best way to check if it's our Proxy Server that's slowing our Internet connection? I do not have access to the Proxy Server. I can only access ...
- 11
1
vote
1
answer
799
views
In a Wireshark trace how do radiotap.mactime and wlan_mgt.fixed.timestamp differ?
I don't mean simply the data format of these, as that is easy enough to look up. I am referring to what they actually mean, and the units and where they originate.
Looking at a script I have been ...
- 113
1
vote
1
answer
33
views
troubleshoot pcaps for BACnet industrial protocol in OT/IoT
I have a test bench that I am trying to learn how to take pcaps with WireShark for BACnet UDP traffic of building automation devices.
4 devices in total on test bench:
Windows 10 OS running ...
- 113
1
vote
1
answer
401
views
Suspicious flood of ARP requests [closed]
I'm trying to review a Wireshark capture and it seems the network is heavily flooded with ARP requests that make no sense to me.
The destination is not "Broadcast", but some unknown DELL ...
- 11
1
vote
1
answer
2k
views
How do I set a display filter in wireshark that sorts by destination broadcast?
1 0.000000 Vmware_90:07:7b Broadcast ARP 60 Who has 192.168.185.144? Tell 192.168.185.7
27 0.995837 28.144.7.123 192.168.185.144 HTTP 1177 HTTP/1.1 200 OK (...
1
vote
0
answers
627
views
ICMP No Reply Found Issue [closed]
Currently working on a Go based NAT router and when translating ICMP traffic and am seeing some interesting behavior.
The clients request is forwarded to the server, the server keeps track of the ...
- 11
1
vote
0
answers
62
views
How can we capture traffic under WiFi AP connected with an WAN router?
My PC is connected to the internet via an WiFi access point.
The AP is connected to the router that provides global IP address.
In our network, some of the PCs (Say PCs1) are directly connected to the ...
- 511
1
vote
1
answer
288
views
ARPs in WIFI Interface Monitor Mode
I set my WIFI interface to monitor mode.
I did not expect to see any ARP requests.
Can someone explain why there is ARP traffic?
- 13
1
vote
0
answers
181
views
Is this wireshark capture showing any issue? [closed]
I used Wireshark to capture the packets bellow:
...
350 18.942762436 d0:07:ca:0b:63:0c -> Broadcast ARP 60 Who has 13.210.32.75? Tell 13.210.32.78
351 18.947224197 d0:07:ca:0b:63:0c -> ...
- 1,747
1
vote
0
answers
217
views
Hide/replace certain source and destination IP in Wireshark packet table
For demonstration purposes I need to show Wireshark packet table, but I need to hide some of the IP's there, like show 10.0.0.1 instead of 192.168.1.19. Very old threads suggest using Linux-only tools ...
- 111
1
vote
0
answers
141
views
Why do I not see slow start in this TCP packet capture? [closed]
I am looking at the packet flow between a server and a client (which is downloading a file from the server). As you can see in the packet capture below (with IP addresses omitted), after the initial ...
- 141
1
vote
0
answers
3k
views
Modifying linux ping icmp payload [closed]
On analyzing ping request and reply from a windows system to Linux. It was observed that the windows ping request payload was
"abcdefghijklmnopqrstuvwabcdefghi" with size 32 bytes
Could this ...
- 227
1
vote
0
answers
46
views
Remote monitoring using a non root user account with Sudo Privilege [closed]
I want to remotely take tcpdump on my server with a non root user account? I tried it but doesnt seems to be working? Can someone guide me on this?
plink.exe -ssh -pw abc123 iamuser@192.168.1.1 "sudo ...
- 1,412
1
vote
0
answers
120
views
What is an SSL debug file [closed]
What is an SSL debug file in wireshark? I am following the below tutorial and I am stuck at step 4 of this set of Citrix Netscaler instructions
- 11
1
vote
0
answers
33
views
How to fetch application specific url's by using wireshark in Windows-8/10? [closed]
Its my first time using wireshark and I am encountered with one major problem i.e How will i sniff url/api that a particular application/software is hitting which is installed in Windows-8/10 by using ...
- 11
1
vote
1
answer
1k
views
Setup a server for traffic monitoring using wireshark in bridge mode [closed]
i was able to get a hold of a server with 2 ethernet ports to start learning about traffic inspection using wireshark.
The server and software are setup. I would like to know how i can configure the ...
- 113
1
vote
1
answer
1k
views
Dumpcap capture filter syntax - wlan addr1 question
I am trying to capture wireless traffic from specified MAC addresses only, and I seem to be using the wrong syntax. When I use:
dumpcap -i wlp2s0 -b filesize:100000 -w capture.pcapng -a duration:...
user37353