Questions tagged [wireshark]
For questions about Wireshark, a packet analyzer
294
questions
0
votes
1
answer
6k
views
TCP Window Scaling on Wireshark
i am new to Wireshark and want to find the window scaling, which is the size of the received windows if i am not mistaken.
I have a dump file of some 110mb that i use for my graphs. This is the ...
- 103
0
votes
1
answer
687
views
How to differentiate whether Data or QUIC protocol frame follows UDP header? [duplicate]
I am using Wireshark to analyze network traffic and I need to programmatically differentiate whether Data or QUIC protocol frame follows UDP header.
So far, every packet which has source or ...
- 101
0
votes
1
answer
1k
views
Wireshark capture on LoopBack interface [closed]
We have two applications running on same machine, both of them are listening on the loopback interface on two different ports. Client Application is sending data to server, but receiving Application ...
0
votes
1
answer
340
views
How to show all data (bitstream with preamble, SFD) on Ubuntu with an Intel Ethernet Interface?
On my PC I have an Intel Ethernet Connection I217-LM with e1000e driver.
If I receive packets in Wireshark or any libpcap based tool, the received ethernet frames start with Ethernet II frame and end ...
0
votes
1
answer
1k
views
802.11 Wireless Lan with radio information
I just saw in wireshark under "import hexdump" the following types:
IEEE 802.11 Wireless Lan
IEEE 802.11 Wireless Lan with radio information
What are exactly is the radio information?
0
votes
1
answer
1k
views
Getting URL of a website using a sniffer [closed]
This is my first post here.
I am currently working on a project, and I am supposed to get the URL of a website I am browsing using a sniffer (such as wireshark).
So, what I have done is look at the ...
0
votes
2
answers
1k
views
Wireshark - capture all packets for HTTP request
I want to launch a HTTP request to a website I've never visited before. I would like to pick up all of the packets related to this request; so DNS packets, TCP packets, et cetera.
Is there a way to ...
0
votes
1
answer
6k
views
Does tcp.analysis.flags in Wireshark find bad TCP packet?
Let me start by prefixing my knowledge of Wireshark is very limited.
Context : I'm investigating logs between a server hosted files and an AV that supported ICAP protocol. In this logs I'm very ...
- 103
0
votes
1
answer
440
views
HTTP server responds with TTL- exceeded for TCP-SYN till TTL is increased by +2 from the actual number of hops
Trying to traceroute an HTTP server using TCP-SYN packets. There are 13 hops between the two hosts, but the server responds with TTL-exceeded for TTL=13 and TTL=14. It replies with TCP SYN-ACK only ...
0
votes
1
answer
335
views
Same offset in fragmented IP packets when using Covert channel
I am currently experimenting which Tunnelshell. So, I launched it on the victim and on the attacker, executed a command via the Tunnelshell and captured the traffic via Wireshark to see what's going ...
- 1
0
votes
3
answers
3k
views
Trying to capture a RST on a TCP/IP program using Wireshark [closed]
So, recently, I've run into a few issues with Python TCP/IP sockets. Basically, I can't make,and neither can Python's IDLE (a Python file editor) program itself, since it requires a connection at ...
- 101
0
votes
1
answer
690
views
Microsoft load balancer heartbeat [closed]
I'm dealing with the following situation: I have 2 servers running Windows 2012 R2 and 1 server running Windows 2008 R2. I need to build a Microsoft Network LoadBalancer cluster using the 3 servers; ...
- 131
0
votes
1
answer
2k
views
Viewing Xbox One Network Traffic [closed]
I am trying to view the HTTP/HTTPS traffic going from my XBOX one so I can see what is being requested. I started off trying to use Charles proxy like this https://www.youtube.com/watch?v=MP4ZcwSHxbw....
0
votes
0
answers
9
views
Implementing Video streaming restrictions based on hourly usage at home [closed]
I'm new at networking, so my question might be basic or naive.
I want to implement restrictions for mobile devices if it is being used to view videos for more than an hour continuously then its ...
0
votes
0
answers
18
views
Unable to preserve HTTP/2 headers list when extracting frame using editcap. Hex Dump Matches [closed]
When I used editcap to extract a HTTP/2 Frame from a Captured PCAP using tcpdump, the HTTP/2 headers don't show up in extracted frame, but the Hex dump matches.
I am using the below editcap command to ...
0
votes
0
answers
29
views
TCP blocked until the acknowledgment received
I am currently facing an issue in my application where the TCP messages seem to be blocked until an acknowledgment received. Specifically, the subsequent messages wait for the acknowledgment of the ...
0
votes
0
answers
18
views
RPCAP active mode usage or deployment example
This is in reference to https://www.winpcap.org/docs/docs_40_2/html/group__remote.html, the RPCAP protocol. Wireshark (on Windows) has support for connecting to passive mode deployment. And the RPCAP ...
- 101
0
votes
0
answers
30
views
Can TCP seq number increment after sending a FIN?
I have an embedded device connecting to a server (on AWS Application ELB if that matters). Both the server and the client are instructed to close the connection after one request. I noticed that the ...
- 1
0
votes
0
answers
43
views
TLS decryption with wireshark
I know there are many similar articles about how to do this, but I cant seem to get any of them to work, and I cant get any info to tell me what the problem might be.
I am following this: https://www....
- 101
0
votes
0
answers
312
views
Monitor UDP packet in wireshark
I am trying to monitor udp packets from server to client in Wireshark at both end. Can I get any clue in Wireshark with which I find out that ok this specific udp packet is what I sent and received at ...
- 13
0
votes
1
answer
154
views
Wireshark only shows single HTTP request instead of its constituent TCP packets and ACKs
To my understanding, in packet no.39, the post request actually consists of multiple tcp packets getting sent, and they all get acked once by no.40. The server has received it. Now, the server sends ...
- 127
0
votes
1
answer
307
views
Wireshark: Cannot find frame type of packets
I am getting used to Wireshark operation and currently, I am investigating different frames (control, management, data frame) and using filter in these links (https://mrncciew.com/2014/10/02/cwap-802-...
0
votes
0
answers
10
views
ARP Header's Mac Address set to 0 when broadcasting [duplicate]
I'm learning about Ethernet frames and networks and Wireshark has been very useful.
I have a doubt regarding broadcasting and ARP request, since we don't know the Target MAC address, in the ARP's ...
- 1
0
votes
1
answer
66
views
Wireshark on ProCurve 1810G - IEEE802a protocol
I have recently started a networking course and acquired an old HP ProCurve 1810G-24 Switch to play about with, which I have updated to the latest firmware.
I'm using Wireshark to monitor the traffic, ...
0
votes
1
answer
107
views
Wireshark -Protocol Hierarchy Omitting large amount of subprotocol traffic
Based on responses, I've repositioned this question to ask why the subprotocols under my TCP header are not accounting for the sum of packet transfer. (I.E TCP= 97.1%, remainder of packet content not ...
- 3
0
votes
1
answer
373
views
Probe Request getting\understanding Information Elements (IEs)
I'm trying to read Information Elements (IEs) from the probe request
can't seem to understand the stracture of it
as I undersatnd it size can be 0-2312 bytes
but how do I know how many there are?
I ...
0
votes
1
answer
75
views
Unwanted Wireshark Optimizing Received 802.11 Channel for Frames
I am trying to run an experiment which involves monitoring 3 wireless channels simultaneously in Wireshark which would allow me to see a single frame captured 3 times on each channel.
To do this, I ...
0
votes
0
answers
16
views
Some random client requests fails with unexpected TCP [RST] packets [duplicate]
I have a service doing listen that serves clients over a TCP sockets connection with a raw binary protocol.
The principle is basic: the connection is established, the client sends a request with data, ...
- 1
0
votes
1
answer
127
views
Homeplug av frame
I want to check differences between a frame sent by a pc connected to an homeplug and one pc connected directly with the gateway/router. When i sniff packets i cannot see any differences in the frame, ...
- 5
0
votes
0
answers
118
views
Man in the middle legitimate packet inspection
we're trying to debug a faulty Panasonic Mobile softphone SIP app (both Android & Apple versions), as many calls are randomly dropped unexpectedly.
This is the conceptual connection diagram:
We ...
- 163
0
votes
2
answers
3k
views
What's the Destination unreachable ICMP packet(ICMP payload the UDP) usage? [closed]
In my Mac(192.168.2.228), it will send ICMP packet to my house's router (192.168.2.1).
with the info Destination unreachable (Port unreachable)
and in the Wireshark packet detail panel, there ...
- 1,747
0
votes
1
answer
48
views
re transmission happened before receiving Three ACKs packets
In the following wireshark trace, the packet with seq=41030 was sent, after some time the packet before it got acknowledged. after that a retransmission happened the packet seq=41030, then 3 ACKs ...
- 103
0
votes
0
answers
122
views
Wireshark packet read starting from a custom protocol
Pardon the badly-framed question title, I am struggling with it but could not find the best way to frame it. I have a program in which I use libpcap for dumping packets at various points in the ...
0
votes
0
answers
47
views
How to analyze traffic made by device on local Wifi network
I have a device (Air quality sensor) that is sending data to a preconfigured server. I would like to access the data that is being sent.
Device connects to local Wifi (WPA Secured) and presumably ...
- 101
0
votes
0
answers
48
views
Import Embedded Packet Capture output into Wireshark
I did packet capturing with cisco's Embedded Packet Capture and I would like to view the output in Wireshark.
The problem is that I only have CLI access to the device, so exporting via TFTP is not an ...
- 383
0
votes
1
answer
2k
views
No response to ICMP (traceroute)
192.168.1.37 can ping 192.168.0.22,
but can't ping 192.168.0.240
subnet masks are 255.255.255.0 on all hosts in question
Switch/gateway in the middle (192.168.1.253) can ping both of these ...
- 113
0
votes
1
answer
1k
views
Unable to capture http request in Wireshark [closed]
I am working in wireshark. I am monitoring the wifi traffic on the same network. We have 6 pc's there and one machine was installed on wireshark to capture wifi traffic. I got my team mates Ip ...
- 23
-1
votes
4
answers
4k
views
Pcap file parsing
I have a .pcap file that I would like to look at. But when I open it in notepad++ i get strings of discernible information, but a whole lot more of black boxes with 'NUL' written in them.
I know I ...
- 1
-1
votes
2
answers
350
views
How to know how many frames will be needed to transmit a file
How many frames will be neeed to transmit a file of 80,480 KB file? Is there a mathematical calculation for this?
- 39
-1
votes
1
answer
7k
views
header checksum error in wireshark
hello all , I am not able to understand what kind of error is wireshark showing me please refer picture
need help.
- 11
-1
votes
1
answer
1k
views
Wireshark time to live pattern question
what pattern does ttl usually follows?
working with a task where the ttl increments by 1 for every 3 packets. In the other task the ttl does not have any clear pattern.
Info: I am doing traceroute ...
- 1
-1
votes
2
answers
484
views
is CDMA the main reason why Wireshark can't capture packet on wireless in promiscuous mode?
I was always curious why I can't capture other people's packets that are flying on air by Wireshark. Of course I know there's airmon-ng but I was just wondering why Wireshark itself can't "just simply"...
- 193
-1
votes
1
answer
44
views
What is the packet protocol used for communicating switch configuration changes over the network? [closed]
I am trying to isolate the packets used to communicate a switch's configuration changes. More specifically, whenever I use the online tool on my laptop and configure the switch (and hit save) I want ...
- 103
-1
votes
2
answers
161
views
Wireshark can't capture packets from machine 2 to machine 3 [duplicate]
I got an idea there were 3 machines. machine 1,2 amd 3.
Machine 2 ping to machine 1, i can capture the packets by using tcpdump. But mchine 2 ping to machine 3 , then machine 1 can't capture by using ...
- 23