Questions tagged [wireshark]
For questions about Wireshark, a packet analyzer
287
questions
1
vote
0
answers
3k
views
Size of packets in Wireshark [closed]
I only getting familiar with Wireshark, and there is one thing that I can't put together: estimating sizes of messages. I want to understand how much traffic my desktop application generates during it'...
- 11
1
vote
1
answer
111
views
Important points that I should take care inside packets by using wireshark
So now that I can understand that there wont be any packets received at machine one, when there is a communication initiated between Machine2 and Machine3.
Now I am testing API's using postman. First ...
- 23
1
vote
1
answer
4k
views
what do they mean about round-trip max?
6509#ping 23.6.1.111 size 500 rep 100
Type escape sequence to abort.
Sending 100, 500-byte ICMP Echos to 23.6.1.111, timeout is 2 seconds:
!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!...
- 25
1
vote
1
answer
1k
views
Wireshark filter the Wireless Hosted Network (Win7/8/10)
I was thinking about capturing iPhone traffic.
I have created a hosted network to which I can connect my iPhone. I'm able to filter the traffic for server IP addresses which are known, such as Google,...
- 113
1
vote
1
answer
89
views
Get Avarage network trafic data in MB [closed]
Currently i am using a MiroTik router, that has build in a data trafic graph.
Its werry well working, but it cant be saved and it shows only last 24h/ last week/ mounth /year.
I would like to have ...
- 13
1
vote
1
answer
485
views
Wireshark Display Filters
Apologies ahead of time if I missed an article or a posting with the answer to this question...
I'm fairly new to Wireshark and I was analyzing my network traffic, I'd like to be able to do multiple ...
- 13
0
votes
1
answer
2k
views
Weird Wireshark protocol list (eth:ethertype:ip:data where is the "udp"?)
I am capturing incoming and outgoing WAN to LAN data at a particular host on my LAN (i.e., the one actually receiving/sending the data). Sometimes I get anomalous captured frames that are missing the ...
0
votes
1
answer
495
views
TCP session established even if the server isn't listening on particular port
I have found out a strange behaviour when trying to establish TCP session between Citrix host and back-end server on port 5060. When I perform 'telent 172.18.52.73 5060' from Citrix host I get "...
- 537
0
votes
1
answer
237
views
IP packet reading
Just got an simple question.Its abt reading a plane IP packet. In a standard IP packet RFC 791, there are multiple fields, the IP packet header size is 20 bytes. Now when i look at following packet ...
0
votes
1
answer
51
views
What does this Wireshark capture filter do
I was reading through a guide where I saw the following Wireshark capture filter used.
(tcp[2:2] > 1500 and tcp[2:2] < 1550)
I had a brief look over Wireshark's website which listed their ...
- 103
0
votes
1
answer
67
views
When I send the ICMP packet with 4000B, but the IPv4 segment calculated 4008B
When I send the ICMP packet with data size as 4000B for testing the IP fragment.
ping 192.168.2.1 -c1 -s4000
and the Wireshark captured it,
Whether is is because of ICMP header? but we know ICMP ...
- 1,747
0
votes
1
answer
122
views
Capture and display filters in wireshark (limit destination IP)?
In Wireshark I can successfully create this display filter that will only show traffic going to x.x.x.x
ip.dst==x.x.x.x
But how do I create a corresponding capture filter?
E.g. if I remove all ...
- 103
0
votes
1
answer
665
views
How to extract destination MAC from PCAP? [closed]
I have PCAPs collected at the Raspberry Pi (from this paper). I want to extract the following headers:
Ether header (3)
IP header (12)
TCP header (10)
UDP header (4)
Then convert the PCAP into csv....
0
votes
1
answer
389
views
Filtering TCP connections with short duration in Wireshark
How can I filter packets for TCP connections with short duration (e.g. 3 seconds)?
I guess there may be something like
ip.addr == xxx.xxx.xxx.xxx && (time(tcp.flags.fin==1) - time(tcp.flags....
- 103
0
votes
1
answer
112
views
TCP sequence numbers in Actual Transmission vs. in Wireshark Capture
Whenever, we do a wireshark capture and Follow--> TCP Stream, we see the sequence numbers as fixed values.
In reality, if this were the case, the intruder can easily predict the transmission patterns....
- 891
0
votes
1
answer
218
views
Wireshark remote hosts
I configured a rip network. I connected two PCS to router 1, router 1 is connected to router 2 and PC 3 is connected to router 2. When I pinged PC 3 and looked at this in wireshark, in the source it ...
- 505
0
votes
3
answers
740
views
Is there an "active" network tap (not just passive)? [closed]
Passive network taps seem to be pretty simple. What if I want an "active" network tap? Let's say I want to change some HTTP packets, for example add info etc.
Another thing that would interest my ...
- 101
0
votes
1
answer
68
views
Where are the characters in Wireshark's Packet Bytes pane?
I've just updated my Wireshark to version 4.0.1, and now, while investigating a TCP communication, I don't see any textual information anymore in the Packet Bytes pane, as you can see from this ...
- 131
0
votes
1
answer
40
views
Wireshark: Internet Control Message Protocol
I've installed Wireshark on my Windows machine, and to my knowledge, the section at the bottom represents the packets in their octal and ASCII form. When I click on the IP version & the header ...
0
votes
2
answers
208
views
Monitoring comms between 2 devices on a switch using Wireshark
I am new to networking and now learning wireshark now and unable to capture comms between 2 devices. This is my setup.
When I connect to "Ethernet" (Ethernet is the Ethernet port at my PC) ...
- 103
0
votes
1
answer
474
views
Wireshark display filter to hide Protocol = 802.11?
[Note: reposted here from SO...]
I've set Wireshark's capture filter set to capture only packets from the MAC address of interest, but the result is dominated by zillions of packets whose Protocol is &...
- 103
0
votes
2
answers
989
views
While sniffing with Wireshark, i get lot of ICMP packets in my loop back interface with the word "CKAAAA.." in it, why is this happening? [closed]
So i have a parrot VM, and i tried to use wireshark on the lo interface of it just for fun, now I'm seeing loads of ICMP packets, which seems to be Netbios inside(not sure why is Wireshark naming the ...
- 101
0
votes
1
answer
467
views
Wireshark udp checksum errorI
I sniffing udp communication with 2 instance of wireshark , 1: 2.0.0 2: 2.2.1 .
In version 2.0.0 I get valid udp.checksum , but with 2.2.1 I always get udp checksum = 0000 .
Why is that? those ...
- 51
0
votes
1
answer
1k
views
ARP requests from outside the network [closed]
I need help understanding an ARP Storm PCAP I'm currently studying. My understating is that routers will strip layer 2 info. Therefore, an ARP request frame will not go through a layer 3 device (...
0
votes
1
answer
115
views
How to prevent getting other machine traffic in LAN on interface
I capture traffic of VMware machine in LAN (host pc is in LAN) with Wireshark.
But I see a lot of garbage traffic like LLMNR, NBNS, STP, ... .
I know I cat prevent capturing such traffic by using ...
0
votes
2
answers
679
views
Are ARP replies sent directly to the solicitor? [closed]
I understand that most ARP requests are broadcasted to the entire network. What about ARP replies?Are they sent directly to the host asking for the answer? Or must ARP replies go through the router ...
- 161
0
votes
1
answer
1k
views
Where in PCAP-NG does the Source/Destination IP address information reside?
I'm studying the pcapng file format, and I know that when wireshark reads a pcapng file, it tells you all sorts of information. I've been reading the pcap-ng format and I don't see anywhere in pcapng ...
- 103
0
votes
1
answer
519
views
How to capture to file every second packet?
We are running offline network analysis by capturing packets to files and analyzing afterwards with automated system.
Our Wireshark @ Ubunty command line looks like:
wireshark -k -i eth0 -y EN10MB -...
- 103
0
votes
1
answer
158
views
Capturing network traffic using wireshark [closed]
I have 15 systems connected with same LAN. I want to capture all the data packets(network-traffic) through every system from my single PC connected with same LAN using wireshark.Can anybody plz help ...
0
votes
1
answer
2k
views
Wireshark is giving error message while capturing packets from GNS3?
I am trying to capture packets with GNS3 using wireshark but wireshark is giving error message every time I run wireshark in GNS3. Path for Wireshark is "D:\Wireshark\Wireshark.exe". Same Path I ...
- 347
0
votes
2
answers
178
views
Determine network traffic on a switch port in bit/s from Wireshark
I am trying to understand how much data is flowing through a specific port on a Cisco (Stratix) switch. I have set up Port Mirroring so that I can capture the traffic on the target port via Wireshark. ...
0
votes
2
answers
135
views
How to include in the filter http requests satisfying the given condition and the respective responses?
For example, I want to see all the http requests containing the given string in the http.host field and their respective responses. Right now my filter is frame.number < 61403 and http.host ...
- 101
0
votes
2
answers
161
views
Detecting Ethernet over power by packets
If someone plugs an Ethernet over power (EOP, Homeplug) into the switch and then connect elsewhere in the building, can I detect this device by sniffing the packets with tools like Wireshark or ...
- 5
0
votes
1
answer
101
views
Wireshark, Bluetooth interface, identify errors in frames/re-transmissions
I'm using WireShark on Ubuntu 20.04.1 LTS.
I listen to bluetooth0 interface while transferring a file from my laptop to my smartphone over Bluetooth(using Blueman).
Without any transfer, I get packets ...
- 111
0
votes
1
answer
489
views
Capture traffic flowing through a Brocade switch remotely
I am currently doing packet capture through mirroring with Wireshark as mentioned in this post
I can mirror the traffic to a port physically jacked into and analyze the packets redirected there w/ ...
0
votes
3
answers
14k
views
how to capture DHCP packets in wireshark
Hy!
I want to capture DHCP packets in Wireshark but I did not receive any. Not my filter wrong, I don't get any. So I think I can't trigger the DHCP communications.
my filters:
dhcp
bootp
udp.port == ...
- 1
0
votes
1
answer
425
views
What type of attack could this be ? (Wireshark pcap) [closed]
If I understand it correctly the "client" sent an unencrypted password to the pop3 server consisting of a long string of As. Is this a type of attack and if yes, how does it work?
- 1
0
votes
1
answer
741
views
how to send a number of TCP packets and capture only those packets using tshark?
I'm using iperf3 to send 1005 TCP packets with the commands:
iperf3 -s -i 1 -f m -p 5200 -D
iperf3 -c 10.60.0.113 -k 1005 -bitrate 0 --reverse --omit 2 -p 5200
In server, client respectively.
The ...
- 121
0
votes
1
answer
1k
views
How do I use the wireshark I/O graph to plot the value of an arbitrary bit in the data layer?
I have a number of UDP packets that are using a protocol that is not implemented in wireshark. I would like to use the I/O graph to plot the value of the data packet byte at index 3. Is this possible?
...
0
votes
1
answer
157
views
Wireshark filter to display al packets which have traveled through switch
I am trying to filter my packets based on whether or not they went through specific switch. This router has the ip address of 192.168.1.235. Is their a way to do this using Wireshark filters?
- 103
0
votes
1
answer
1k
views
Filtering out abnormal connection termination packets in wireshark
I am trying to find out a way to filter out packets specifying abnormal connection termination in wireshark. I mean is there any tcp.connection.terminated filter in wireshark??
- 105
0
votes
3
answers
434
views
Analyzing TCP connection by running Wireshark in two endpoint
I am trying to find the number of lost packets in the network.
I have 2 devices say DeviceA and DeviceB. IP addresses are respectively DeviceA : 192.168.0.104 and DeviceB: 192.168.0.105.
In order ...
- 111
0
votes
1
answer
67
views
Is it possible to re-transmit only the last packet at TCP flow?
I try to understand the TCP behavior, especially re-transmission.
I did a small experiment and find the curious thing.
The only last packet is re-transmitted. Why do this happen?
I think if the ...
- 25
0
votes
1
answer
108
views
why doesn't WireShark show any traffic from invalid certificate https site? [closed]
i have tried mobile apps like HttpCanary and pc programs like wireshark still got nothing from the site !!
- 103
0
votes
1
answer
5k
views
TCP Window Scaling on Wireshark
i am new to Wireshark and want to find the window scaling, which is the size of the received windows if i am not mistaken.
I have a dump file of some 110mb that i use for my graphs. This is the ...
- 103
0
votes
1
answer
624
views
How to differentiate whether Data or QUIC protocol frame follows UDP header? [duplicate]
I am using Wireshark to analyze network traffic and I need to programmatically differentiate whether Data or QUIC protocol frame follows UDP header.
So far, every packet which has source or ...
- 101
0
votes
1
answer
963
views
Wireshark capture on LoopBack interface [closed]
We have two applications running on same machine, both of them are listening on the loopback interface on two different ports. Client Application is sending data to server, but receiving Application ...
0
votes
1
answer
283
views
How to show all data (bitstream with preamble, SFD) on Ubuntu with an Intel Ethernet Interface?
On my PC I have an Intel Ethernet Connection I217-LM with e1000e driver.
If I receive packets in Wireshark or any libpcap based tool, the received ethernet frames start with Ethernet II frame and end ...
0
votes
1
answer
1k
views
802.11 Wireless Lan with radio information
I just saw in wireshark under "import hexdump" the following types:
IEEE 802.11 Wireless Lan
IEEE 802.11 Wireless Lan with radio information
What are exactly is the radio information?
0
votes
1
answer
1k
views
Getting URL of a website using a sniffer [closed]
This is my first post here.
I am currently working on a project, and I am supposed to get the URL of a website I am browsing using a sniffer (such as wireshark).
So, what I have done is look at the ...