Skip to main content
Share Your Experience: Take the 2024 Developer Survey

Questions tagged [wireshark]

For questions about Wireshark, a packet analyzer

Filter by
Sorted by
Tagged with
1 vote
1 answer
30 views

How can I make wireshark focus on only packets being sent to a website and any responses?

I have captured a few TLS handshakes, I would like to focus on one tls handshake and the communication thereafter. For example, I connect to www.facebook.com and www.pinterest.com how do I tell ...
Benjamin Morales Perez's user avatar
1 vote
1 answer
10k views

Wireshark not capturing packets?

I am trying to use Wireshark, but for some reason it won't capture packets. I've used it once before and it worked just fine, so I can't understand why it's not working right now. The only thing I've ...
Tita's user avatar
  • 123
1 vote
1 answer
79 views

Can you gather only a summary of network traffic via Wireshark (or similar)?

Something on my network is using an enormous amount of data and I need to track it down. Its not constant or predictable. I have had a go with Wireshark and I am sure that it could tell me what I ...
Ben's user avatar
  • 113
1 vote
1 answer
1k views

The reason a TCP connection generate retransmission

My question is why a TCP flow make a re-transmission when a network has enough link bandwidth. For finding a cause, I used a wireshark. I got the below captured at a host side (10.0.0.1) 85968 47....
nimdrak's user avatar
  • 125
1 vote
1 answer
1k views

How to filter a wireshark capture (pcapng) by source and destination IPv4 address

I have a bunch of wireshark captures I need to mine data from. Tshark seems to fit the bill but this doesn't support filtering (-f) by the look of it, I simply get: Using: tshark -x -r Run18....
Robbie Dee's user avatar
1 vote
2 answers
671 views

Wireshark expression filters for wireless capture

1) What Wireshark expression filter stack can I utilize to discover how many devices are transmitting in the 2GHz and 5GHz spectrum in a packet capture? 2) What Wireshark expression filter stack can ...
Adrian Cunningham 's user avatar
1 vote
2 answers
8k views

Can not capture DHCP offer with wireshark?

I'd like to capture DHCP packets with wireshark. When I use the filter: "udp.port == 67 or udp.port == 68" I only see the Discover and Request broadcasts. While I thought the DHCP offer also gets ...
Woenktoenk's user avatar
1 vote
2 answers
498 views

Method in wireshark to filter for any in a set of mac addresses but no others

I am sniffing for several devices in a congested environment. I'm wondering if there is an easy way to accomplish filtering that I don't know of. I have two APs that things are connecting to so I ...
user avatar
1 vote
1 answer
588 views

Wireshark - Application Layer with Data

I am not sure if the title is the correct one. When transfering files over the network, in Wireshark, we see abbreviations like: - PK -> Beginning of a file. Is it a compressed file? - OFT2 -> ...
f4d0's user avatar
  • 113
1 vote
1 answer
134 views

Capturing traffic on wire from an endpoint

Say I have my computer connected to a router with an Ethernet cable. How do I capture all packets on the wire? (possibly with using some kind of hardware that's much cheaper than another computer) I ...
Nesa's user avatar
  • 165
1 vote
1 answer
193 views

Different results when same WireShark pcap file opened in Unbuntu17.04 and later Windows 10

Using Ubertooth, a bluetooth sniffer, I created a pcap file in Unbuntu that captured some data. When I opened that file in WireShark 2.4.1 in Windows 10 it showed more information in the SMP data ...
Niko_Jako's user avatar
1 vote
2 answers
201 views

Wireshark capturing device ip

ok so here's the scenario: Computer A captures some packets and saves the session into file 'traffic'. Later on, Computer B opens the 'traffic' file and wants to know who captured the file...the ip ...
Marley's user avatar
  • 11
1 vote
2 answers
530 views

How many HTTP servers are contacted?

I am working in wireshark and analyzing the traffic generated by a PC during web browsing. What filter should I use to know how many HTTP servers are contacted? I mean, can I just filter the tcp....
Andrea's user avatar
  • 13
1 vote
2 answers
248 views

Why can't i see wireless traffic not addressed to my wireless interface with wireshark

I'm using Wireshark to capture traffic on my 2.4G wifi network. I'm set to promiscuous mode, but I only see traffic to or from me, or broadcast or multicast traffic. Unless I'm remembering ...
Frank Jay's user avatar
1 vote
1 answer
234 views

How do I generate ESP trafic (IPv6)?

I have this topology: I only have moon and sun. After the connection was successfully established, I need to generate ESP packets for wireshark capture. How do I generate ESP packets? When I use ...
Codrut Cristian Grosu's user avatar
1 vote
1 answer
251 views

Is it possible to capture ieee802.11 management and control frames from the same phone using android APP or tcpdump on root device?

I am trying to study the traffic between the mobile and access points. So I have phone Galaxy Nexus which does not support monitoring mode but still support promiscuous mode. Unfortunately, I try many ...
Moh. Qaid's user avatar
1 vote
2 answers
2k views

WireShark: How can I determine how many hosts are on the same wi-fi as me?

I need to determine the number of hosts on my network using wireshark. From what I have gathered, this is impossible on a Windows machine. Is this the case? This is for school, so I simply need to ...
Daniel Paczuski Bak's user avatar
1 vote
1 answer
2k views

How to automate Wireshark GUI like IO Graph

I use a lot IO Graph in Wireshark but for each capture, I have to set again (and again...) all my "preferences" for X/Y Axis and Graph 2/3 filters and so on... That is really annoying. I looked at ...
Yves Martin's user avatar
1 vote
1 answer
616 views

Does Ethernet have a header and a trailer?

I have read that Ethernet have a header and a trailer, but in Wireshark I can only see an Ethernet header and no Ethernet trailer.
user85108's user avatar
1 vote
1 answer
47 views

what are scenario where re-transmission packets can been seen in wireshark logs

While troubleshooting i came across this challenge ,able to see retransmission packets continuously in packet capture . please let me know in what scenarios this retransmission packets are seen.
user avatar
1 vote
1 answer
824 views

Why the different colours for SACK markers in Wireshark's tcptrace graph?

Wireshark's tcptrace time sequence graph shows a good deal of information, but I cannot find a document that spells out exactly what it all means. It's broadly similar to the original tcptrace except ...
Dave Turner's user avatar
1 vote
1 answer
381 views

How do I interpret this Wireshark log file?

I'm new to using Wireshark and I'd like some help with analyzing the log shown in the image. I also ran a nmap scan of the ports on my computer, but I'm not able to identify which of these lines are ...
bones's user avatar
  • 11
1 vote
1 answer
6k views

what's the difference between trailer and padding field in ethernet frame captured by wireshark?

The Ethernet minimum length should be 64 Bytes, so when the data is less than 46B, there would be some extra bytes padding to the end of data, make sure the frame size up to 64B. When I capture the ...
Ben's user avatar
  • 13
1 vote
1 answer
153 views

Does Wireshark capture all Wi-Fi traffic under the same access point even with WPA encryption?

I know that free unencrypted-Wi-Fi is dangerous since all the traffic in the same AP is visible. Does Wireshark capture all Wi-Fi traffic under the same access point even with WPA encryption?
mallea's user avatar
  • 519
1 vote
1 answer
258 views

How to find time duration of tracert command using wireshark?

I tried to execute a tracert command in cmd in Windows 10, specifically, tracert www.ieee.org. In the same time, I captured the packets with wireshark. How can I find the time duration of my tracert ...
Κωνσταντίνος Κορναράκης's user avatar
1 vote
1 answer
63 views

Packet analyze on router does not match client and server

thank you for your time. My (virtual) network has 3 objects : a client, a server and a router between them. I'm sniffing the traffic on the 3 machine with the command tcpdump -i any -s 0 -w [path] ...
no631609's user avatar
1 vote
1 answer
122 views

What's the hook and double hook meaning in wireshark?

What's the hook and double hook meaning in wireshark? you see the two snapshots up there, when I select #7 the #6 will be hooked. when I select the #8, the #5 will be double hooked. What's the ...
aircraft's user avatar
  • 1,138
1 vote
2 answers
955 views

How can i monitor ARP packet on WiFi network?

I want to monitor packet in my network. It said that ARP packet request broadcasted all over network. But why i only see my arp request packet and reply packet to the gateway?
Tiffany's user avatar
  • 85
1 vote
1 answer
821 views

What is "cflow" in ipfix?

I am learning ipfix and found a cmd like this: tshark -r ipfix.cap -n -d udp.port==4379,cflow -O cflow What does the cflow part mean here? I was also told to filter cflow if I use Wireshark in ...
sky's user avatar
  • 179
1 vote
1 answer
886 views

Wireshark lua Dissector sharing common variable among all packets

I just started with lua plugins in wireshark. I wanted to know if it is possible to create like a global object that can be called by dissector in one packet and used by dissector called by another ...
HighNESS's user avatar
1 vote
1 answer
5k views

Calculated window size value in SYN segment differ from calculated value in ACK segment

I am a bit confused about the window size value in some TCP segments. I think I understand the theory behind the window size field and how it is modified when the window scale option is provided ...
rutex's user avatar
  • 13
1 vote
1 answer
18k views

Wireshark No response seen sending ping request

I'm building my own packets and sending them through a raw socket. The packet is apparently A-OK, but I'm not getting any replies. Sequence block is generated with a for loop. Identifier block is ...
Kolt Penny's user avatar
1 vote
1 answer
629 views

Why is my pc not forwarding packets to my default gateway?

I understand that if I were to send a packet to a destination outside my LAN, it would have to reach the gateway first before it is being routed to the final destination. However, when I visit a ...
Lew Wei Hao's user avatar
1 vote
1 answer
546 views

What are the testing possibilities of wireshark?

I got an information that tcpdump is same like wireshark. In using tcpdump we can capture the packets, but in wireshark we can see the GUI of packet capture. Later I understand that we can use the ...
toastmaster's user avatar
1 vote
1 answer
103 views

Wireshark PCAP file clarification

I need your support urgently as I've a problem in the connection between 2 servers. Here's the below when the connection became down, but this is from the other side so I can't identify what is it ? ...
Sara Hussein's user avatar
1 vote
1 answer
553 views

Confirm DFS issues using Monitor Mode + Wireshark

I believe that our AP's are being affected by DFS but need a way to "prove" this issue before getting any kind of change enacted. Using Wireshark, is there anyway that I can watch the network traffic ...
Andrew's user avatar
  • 113
1 vote
1 answer
727 views

ICMP TTL-exceeded header shows Length: 243 [Length of original datagram: 972] in wireshark. Original TCP-SYN was 58 Bytes

TCP SYN for traceroute ICMP header shows Length 243 [Length of original datagram: 972] Not sure how this works, as I sent a TCP-SYN of 58 Bytes frame. Please explain
Kaushal Deodhar's user avatar
1 vote
1 answer
106 views

Five consequtive SYN-messages from client to server

the 5 packages 333 -> 337. What are those and why does the client do this? More generally, why does the client send five SYN-messages to the server?
kirkegaard's user avatar
1 vote
1 answer
506 views

Different types of ICMP [closed]

I have a task on which I have spent a lot of time. I am not fluent in Linux, but I can manage basic things. The task is to gather different types of ICMP packets. I can harvest them by tcpdump (which ...
user20134's user avatar
1 vote
1 answer
147 views

Is it the Proxy Server slowing us? [closed]

So it's the usual Server vs Network battle. What's the best way to check if it's our Proxy Server that's slowing our Internet connection? I do not have access to the Proxy Server. I can only access ...
DM73's user avatar
  • 11
1 vote
1 answer
856 views

In a Wireshark trace how do radiotap.mactime and wlan_mgt.fixed.timestamp differ?

I don't mean simply the data format of these, as that is easy enough to look up. I am referring to what they actually mean, and the units and where they originate. Looking at a script I have been ...
John R Ramsden's user avatar
1 vote
1 answer
48 views

Acknowledgment numbers in Wireshark do not match sequence numbers

Recently, I conducted an experiment involving uploading a file to a server. I noticed that the acknowledgment numbers I received did not align with the sequence numbers. Please refer to the attached ...
nsrdn's user avatar
  • 13
1 vote
1 answer
112 views

Exact difference between EAP and EAPoL

In the PSK authentication method, I see only 4 way handshake packets between supplicant and authenticator. They are called EAPoL in the Wireshark What I know that when EAP is carried over LAN (...
tbhaxor's user avatar
  • 123
1 vote
0 answers
29 views

DORA process TCPIP [duplicate]

http://www.tcpipguide.com/free/t_DHCPGeneralOperationandClientFiniteStateMachine.htm I'm reading through the entire Discover, Offer, Request, Acknowledgement phases in DHCP. And I am really confused. ...
Team B.I's user avatar
  • 113
1 vote
1 answer
75 views

troubleshoot pcaps for BACnet industrial protocol in OT/IoT

I have a test bench that I am trying to learn how to take pcaps with WireShark for BACnet UDP traffic of building automation devices. 4 devices in total on test bench: Windows 10 OS running ...
bbartling's user avatar
  • 113
1 vote
1 answer
609 views

Suspicious flood of ARP requests [closed]

I'm trying to review a Wireshark capture and it seems the network is heavily flooded with ARP requests that make no sense to me. The destination is not "Broadcast", but some unknown DELL ...
Guest's user avatar
  • 11
1 vote
1 answer
3k views

How do I set a display filter in wireshark that sorts by destination broadcast?

1 0.000000 Vmware_90:07:7b Broadcast ARP 60 Who has 192.168.185.144? Tell 192.168.185.7 27 0.995837 28.144.7.123 192.168.185.144 HTTP 1177 HTTP/1.1 200 OK (...
Dr. Suess Official's user avatar
1 vote
0 answers
741 views

ICMP No Reply Found Issue [closed]

Currently working on a Go based NAT router and when translating ICMP traffic and am seeing some interesting behavior. The clients request is forwarded to the server, the server keeps track of the ...
toothflower's user avatar
1 vote
0 answers
93 views

How can we capture traffic under WiFi AP connected with an WAN router?

My PC is connected to the internet via an WiFi access point. The AP is connected to the router that provides global IP address. In our network, some of the PCs (Say PCs1) are directly connected to the ...
mallea's user avatar
  • 519
1 vote
1 answer
336 views

ARPs in WIFI Interface Monitor Mode

I set my WIFI interface to monitor mode. I did not expect to see any ARP requests. Can someone explain why there is ARP traffic?
Felix PK's user avatar