Questions tagged [wireshark]

For questions about Wireshark, a packet analyzer

Filter by
Sorted by
Tagged with
1 vote
0 answers
123 views

What is an SSL debug file [closed]

What is an SSL debug file in wireshark? I am following the below tutorial and I am stuck at step 4 of this set of Citrix Netscaler instructions
Tyra Untamed's user avatar
1 vote
0 answers
41 views

How to fetch application specific url's by using wireshark in Windows-8/10? [closed]

Its my first time using wireshark and I am encountered with one major problem i.e How will i sniff url/api that a particular application/software is hitting which is installed in Windows-8/10 by using ...
suv's user avatar
  • 11
1 vote
1 answer
1k views

Setup a server for traffic monitoring using wireshark in bridge mode [closed]

i was able to get a hold of a server with 2 ethernet ports to start learning about traffic inspection using wireshark. The server and software are setup. I would like to know how i can configure the ...
The Architect's user avatar
1 vote
1 answer
1k views

Dumpcap capture filter syntax - wlan addr1 question

I am trying to capture wireless traffic from specified MAC addresses only, and I seem to be using the wrong syntax. When I use: dumpcap -i wlp2s0 -b filesize:100000 -w capture.pcapng -a duration:...
user avatar
1 vote
0 answers
3k views

Size of packets in Wireshark [closed]

I only getting familiar with Wireshark, and there is one thing that I can't put together: estimating sizes of messages. I want to understand how much traffic my desktop application generates during it'...
Serge Poele's user avatar
1 vote
1 answer
112 views

Important points that I should take care inside packets by using wireshark

So now that I can understand that there wont be any packets received at machine one, when there is a communication initiated between Machine2 and Machine3. Now I am testing API's using postman. First ...
toastmaster's user avatar
1 vote
1 answer
4k views

what do they mean about round-trip max?

6509#ping 23.6.1.111 size 500 rep 100 Type escape sequence to abort. Sending 100, 500-byte ICMP Echos to 23.6.1.111, timeout is 2 seconds: !!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!...
Dense.mode's user avatar
1 vote
1 answer
1k views

Wireshark filter the Wireless Hosted Network (Win7/8/10)

I was thinking about capturing iPhone traffic. I have created a hosted network to which I can connect my iPhone. I'm able to filter the traffic for server IP addresses which are known, such as Google,...
Sens4's user avatar
  • 113
1 vote
1 answer
90 views

Get Avarage network trafic data in MB [closed]

Currently i am using a MiroTik router, that has build in a data trafic graph. Its werry well working, but it cant be saved and it shows only last 24h/ last week/ mounth /year. I would like to have ...
Shawn's user avatar
  • 13
1 vote
1 answer
512 views

Wireshark Display Filters

Apologies ahead of time if I missed an article or a posting with the answer to this question... I'm fairly new to Wireshark and I was analyzing my network traffic, I'd like to be able to do multiple ...
BeepBoopBeep's user avatar
0 votes
1 answer
2k views

Weird Wireshark protocol list (eth:ethertype:ip:data where is the "udp"?)

I am capturing incoming and outgoing WAN to LAN data at a particular host on my LAN (i.e., the one actually receiving/sending the data). Sometimes I get anomalous captured frames that are missing the ...
Michael Goldshteyn's user avatar
0 votes
1 answer
524 views

TCP session established even if the server isn't listening on particular port

I have found out a strange behaviour when trying to establish TCP session between Citrix host and back-end server on port 5060. When I perform 'telent 172.18.52.73 5060' from Citrix host I get "...
Daniel Blazek's user avatar
0 votes
2 answers
95 views

Does ARP play any role when we try to access a website?

I was looking to find the role of ARP whenever say we want to access a website like google.com. I found some answers here. But, when I tried to use Wireshark to check the ARP request I wasn't able to ...
Vedanta Mohapatra's user avatar
0 votes
1 answer
269 views

IP packet reading

Just got an simple question.Its abt reading a plane IP packet. In a standard IP packet RFC 791, there are multiple fields, the IP packet header size is 20 bytes. Now when i look at following packet ...
user24556's user avatar
0 votes
1 answer
263 views

Wireshark filter for specific SYN packet which never received a SYN/ACK

Is there a way in wireshark to find out a single SYN that does not get answered by SYN/ACK?
fsociety's user avatar
  • 893
0 votes
1 answer
50 views

Wireshark: Internet Control Message Protocol

I've installed Wireshark on my Windows machine, and to my knowledge, the section at the bottom represents the packets in their octal and ASCII form. When I click on the IP version & the header ...
oussama101's user avatar
0 votes
1 answer
59 views

What does this Wireshark capture filter do

I was reading through a guide where I saw the following Wireshark capture filter used. (tcp[2:2] > 1500 and tcp[2:2] < 1550) I had a brief look over Wireshark's website which listed their ...
questioner's user avatar
0 votes
1 answer
75 views

When I send the ICMP packet with 4000B, but the IPv4 segment calculated 4008B

When I send the ICMP packet with data size as 4000B for testing the IP fragment. ping 192.168.2.1 -c1 -s4000 and the Wireshark captured it, Whether is is because of ICMP header? but we know ICMP ...
244boy's user avatar
  • 1,767
0 votes
1 answer
183 views

Capture and display filters in wireshark (limit destination IP)?

In Wireshark I can successfully create this display filter that will only show traffic going to x.x.x.x ip.dst==x.x.x.x But how do I create a corresponding capture filter? E.g. if I remove all ...
u123's user avatar
  • 103
0 votes
1 answer
883 views

How to extract destination MAC from PCAP? [closed]

I have PCAPs collected at the Raspberry Pi (from this paper). I want to extract the following headers: Ether header (3) IP header (12) TCP header (10) UDP header (4) Then convert the PCAP into csv....
user3385496's user avatar
0 votes
1 answer
635 views

Filtering TCP connections with short duration in Wireshark

How can I filter packets for TCP connections with short duration (e.g. 3 seconds)? I guess there may be something like ip.addr == xxx.xxx.xxx.xxx && (time(tcp.flags.fin==1) - time(tcp.flags....
Hyunjik Bae's user avatar
0 votes
1 answer
126 views

TCP sequence numbers in Actual Transmission vs. in Wireshark Capture

Whenever, we do a wireshark capture and Follow--> TCP Stream, we see the sequence numbers as fixed values. In reality, if this were the case, the intruder can easily predict the transmission patterns....
fsociety's user avatar
  • 893
0 votes
1 answer
236 views

Wireshark remote hosts

I configured a rip network. I connected two PCS to router 1, router 1 is connected to router 2 and PC 3 is connected to router 2. When I pinged PC 3 and looked at this in wireshark, in the source it ...
The_Bear's user avatar
  • 515
0 votes
3 answers
766 views

Is there an "active" network tap (not just passive)? [closed]

Passive network taps seem to be pretty simple. What if I want an "active" network tap? Let's say I want to change some HTTP packets, for example add info etc. Another thing that would interest my ...
user1231247's user avatar
0 votes
1 answer
318 views

How to determine which TCP payloads should be combined to form a complete PDU?

I understand that the TCP itself provides a byte stream connection, but has no idea nor does it care what its payload is and how it is segmented to fit into individual packets that travel on the wire. ...
miran80's user avatar
  • 103
0 votes
1 answer
134 views

Where are the characters in Wireshark's Packet Bytes pane?

I've just updated my Wireshark to version 4.0.1, and now, while investigating a TCP communication, I don't see any textual information anymore in the Packet Bytes pane, as you can see from this ...
Dominique's user avatar
  • 131
0 votes
2 answers
917 views

Monitoring comms between 2 devices on a switch using Wireshark

I am new to networking and now learning wireshark now and unable to capture comms between 2 devices. This is my setup. When I connect to "Ethernet" (Ethernet is the Ethernet port at my PC) ...
GeneCode's user avatar
  • 103
0 votes
1 answer
747 views

Wireshark display filter to hide Protocol = 802.11?

[Note: reposted here from SO...] I've set Wireshark's capture filter set to capture only packets from the MAC address of interest, but the result is dominated by zillions of packets whose Protocol is &...
fearless_fool's user avatar
0 votes
2 answers
1k views

While sniffing with Wireshark, i get lot of ICMP packets in my loop back interface with the word "CKAAAA.." in it, why is this happening? [closed]

So i have a parrot VM, and i tried to use wireshark on the lo interface of it just for fun, now I'm seeing loads of ICMP packets, which seems to be Netbios inside(not sure why is Wireshark naming the ...
Mery Ted's user avatar
  • 101
0 votes
1 answer
530 views

Wireshark udp checksum errorI

I sniffing udp communication with 2 instance of wireshark , 1: 2.0.0 2: 2.2.1 . In version 2.0.0 I get valid udp.checksum , but with 2.2.1 I always get udp checksum = 0000 . Why is that? those ...
pointers's user avatar
0 votes
1 answer
1k views

ARP requests from outside the network [closed]

I need help understanding an ARP Storm PCAP I'm currently studying. My understating is that routers will strip layer 2 info. Therefore, an ARP request frame will not go through a layer 3 device (...
netavaster's user avatar
0 votes
1 answer
119 views

How to prevent getting other machine traffic in LAN on interface

I capture traffic of VMware machine in LAN (host pc is in LAN) with Wireshark. But I see a lot of garbage traffic like LLMNR, NBNS, STP, ... . I know I cat prevent capturing such traffic by using ...
David Parker's user avatar
0 votes
2 answers
713 views

Are ARP replies sent directly to the solicitor? [closed]

I understand that most ARP requests are broadcasted to the entire network. What about ARP replies?Are they sent directly to the host asking for the answer? Or must ARP replies go through the router ...
Lew Wei Hao's user avatar
0 votes
1 answer
1k views

Where in PCAP-NG does the Source/Destination IP address information reside?

I'm studying the pcapng file format, and I know that when wireshark reads a pcapng file, it tells you all sorts of information. I've been reading the pcap-ng format and I don't see anywhere in pcapng ...
trueCamelType's user avatar
0 votes
1 answer
551 views

How to capture to file every second packet?

We are running offline network analysis by capturing packets to files and analyzing afterwards with automated system. Our Wireshark @ Ubunty command line looks like: wireshark -k -i eth0 -y EN10MB -...
Anton Krouglov's user avatar
0 votes
1 answer
161 views

Capturing network traffic using wireshark [closed]

I have 15 systems connected with same LAN. I want to capture all the data packets(network-traffic) through every system from my single PC connected with same LAN using wireshark.Can anybody plz help ...
robinson george's user avatar
0 votes
1 answer
2k views

Wireshark is giving error message while capturing packets from GNS3?

I am trying to capture packets with GNS3 using wireshark but wireshark is giving error message every time I run wireshark in GNS3. Path for Wireshark is "D:\Wireshark\Wireshark.exe". Same Path I ...
Heisenberg's user avatar
0 votes
1 answer
429 views

Why am I not capturing any ICMP packets on wireshark?

I am doing a lab where we are meant to ping an address and use wireshark to capture ICMP packets when we ping that address. WHen I run the wireshark capture with the ICMP filter on and ping my address,...
Garrett LaCoste's user avatar
0 votes
2 answers
329 views

Determine network traffic on a switch port in bit/s from Wireshark

I am trying to understand how much data is flowing through a specific port on a Cisco (Stratix) switch. I have set up Port Mirroring so that I can capture the traffic on the target port via Wireshark. ...
Greg Smith's user avatar
0 votes
2 answers
247 views

How to include in the filter http requests satisfying the given condition and the respective responses?

For example, I want to see all the http requests containing the given string in the http.host field and their respective responses. Right now my filter is frame.number < 61403 and http.host ...
mark's user avatar
  • 101
0 votes
2 answers
224 views

Detecting Ethernet over power by packets

If someone plugs an Ethernet over power (EOP, Homeplug) into the switch and then connect elsewhere in the building, can I detect this device by sniffing the packets with tools like Wireshark or ...
claudio's user avatar
0 votes
1 answer
127 views

Wireshark, Bluetooth interface, identify errors in frames/re-transmissions

I'm using WireShark on Ubuntu 20.04.1 LTS. I listen to bluetooth0 interface while transferring a file from my laptop to my smartphone over Bluetooth(using Blueman). Without any transfer, I get packets ...
Aviel Fedida's user avatar
0 votes
1 answer
633 views

Capture traffic flowing through a Brocade switch remotely

I am currently doing packet capture through mirroring with Wireshark as mentioned in this post I can mirror the traffic to a port physically jacked into and analyze the packets redirected there w/ ...
Frankie Guzikowski's user avatar
0 votes
3 answers
18k views

how to capture DHCP packets in wireshark

Hy! I want to capture DHCP packets in Wireshark but I did not receive any. Not my filter wrong, I don't get any. So I think I can't trigger the DHCP communications. my filters: dhcp bootp udp.port == ...
Finaria's user avatar
0 votes
1 answer
623 views

What type of attack could this be ? (Wireshark pcap) [closed]

If I understand it correctly the "client" sent an unencrypted password to the pop3 server consisting of a long string of As. Is this a type of attack and if yes, how does it work?
siheder's user avatar
0 votes
1 answer
1k views

how to send a number of TCP packets and capture only those packets using tshark?

I'm using iperf3 to send 1005 TCP packets with the commands: iperf3 -s -i 1 -f m -p 5200 -D iperf3 -c 10.60.0.113 -k 1005 -bitrate 0 --reverse --omit 2 -p 5200 In server, client respectively. The ...
Natiya's user avatar
  • 121
0 votes
1 answer
2k views

How do I use the wireshark I/O graph to plot the value of an arbitrary bit in the data layer?

I have a number of UDP packets that are using a protocol that is not implemented in wireshark. I would like to use the I/O graph to plot the value of the data packet byte at index 3. Is this possible? ...
Adam Fontana's user avatar
0 votes
1 answer
190 views

Wireshark filter to display al packets which have traveled through switch

I am trying to filter my packets based on whether or not they went through specific switch. This router has the ip address of 192.168.1.235. Is their a way to do this using Wireshark filters?
Lyra Orwell's user avatar
0 votes
1 answer
1k views

Filtering out abnormal connection termination packets in wireshark

I am trying to find out a way to filter out packets specifying abnormal connection termination in wireshark. I mean is there any tcp.connection.terminated filter in wireshark??
Vipul Tyagi's user avatar
0 votes
3 answers
459 views

Analyzing TCP connection by running Wireshark in two endpoint

I am trying to find the number of lost packets in the network. I have 2 devices say DeviceA and DeviceB. IP addresses are respectively DeviceA : 192.168.0.104 and DeviceB: 192.168.0.105. In order ...
I.K.'s user avatar
  • 111