Questions tagged [wireshark]

For questions about Wireshark, a packet analyzer

Filter by
Sorted by
Tagged with
0 votes
1 answer
6k views

TCP Window Scaling on Wireshark

i am new to Wireshark and want to find the window scaling, which is the size of the received windows if i am not mistaken. I have a dump file of some 110mb that i use for my graphs. This is the ...
vlzvl's user avatar
  • 103
0 votes
1 answer
687 views

How to differentiate whether Data or QUIC protocol frame follows UDP header? [duplicate]

I am using Wireshark to analyze network traffic and I need to programmatically differentiate whether Data or QUIC protocol frame follows UDP header. So far, every packet which has source or ...
NutCracker's user avatar
0 votes
1 answer
1k views

Wireshark capture on LoopBack interface [closed]

We have two applications running on same machine, both of them are listening on the loopback interface on two different ports. Client Application is sending data to server, but receiving Application ...
Niranjan Upadhya's user avatar
0 votes
1 answer
340 views

How to show all data (bitstream with preamble, SFD) on Ubuntu with an Intel Ethernet Interface?

On my PC I have an Intel Ethernet Connection I217-LM with e1000e driver. If I receive packets in Wireshark or any libpcap based tool, the received ethernet frames start with Ethernet II frame and end ...
user48456's user avatar
0 votes
1 answer
1k views

802.11 Wireless Lan with radio information

I just saw in wireshark under "import hexdump" the following types: IEEE 802.11 Wireless Lan IEEE 802.11 Wireless Lan with radio information What are exactly is the radio information?
idontknowwhoiamgodhelpme's user avatar
0 votes
1 answer
1k views

Getting URL of a website using a sniffer [closed]

This is my first post here. I am currently working on a project, and I am supposed to get the URL of a website I am browsing using a sniffer (such as wireshark). So, what I have done is look at the ...
Idan Toker's user avatar
0 votes
2 answers
1k views

Wireshark - capture all packets for HTTP request

I want to launch a HTTP request to a website I've never visited before. I would like to pick up all of the packets related to this request; so DNS packets, TCP packets, et cetera. Is there a way to ...
Daniel Paczuski Bak's user avatar
0 votes
1 answer
6k views

Does tcp.analysis.flags in Wireshark find bad TCP packet?

Let me start by prefixing my knowledge of Wireshark is very limited. Context : I'm investigating logs between a server hosted files and an AV that supported ICAP protocol. In this logs I'm very ...
Alexandre Roux's user avatar
0 votes
1 answer
440 views

HTTP server responds with TTL- exceeded for TCP-SYN till TTL is increased by +2 from the actual number of hops

Trying to traceroute an HTTP server using TCP-SYN packets. There are 13 hops between the two hosts, but the server responds with TTL-exceeded for TTL=13 and TTL=14. It replies with TCP SYN-ACK only ...
Kaushal Deodhar's user avatar
0 votes
1 answer
335 views

Same offset in fragmented IP packets when using Covert channel

I am currently experimenting which Tunnelshell. So, I launched it on the victim and on the attacker, executed a command via the Tunnelshell and captured the traffic via Wireshark to see what's going ...
John Doe's user avatar
0 votes
3 answers
3k views

Trying to capture a RST on a TCP/IP program using Wireshark [closed]

So, recently, I've run into a few issues with Python TCP/IP sockets. Basically, I can't make,and neither can Python's IDLE (a Python file editor) program itself, since it requires a connection at ...
said's user avatar
  • 101
0 votes
1 answer
690 views

Microsoft load balancer heartbeat [closed]

I'm dealing with the following situation: I have 2 servers running Windows 2012 R2 and 1 server running Windows 2008 R2. I need to build a Microsoft Network LoadBalancer cluster using the 3 servers; ...
Ottootto's user avatar
  • 131
0 votes
1 answer
2k views

Viewing Xbox One Network Traffic [closed]

I am trying to view the HTTP/HTTPS traffic going from my XBOX one so I can see what is being requested. I started off trying to use Charles proxy like this https://www.youtube.com/watch?v=MP4ZcwSHxbw....
Jaeren Coathup's user avatar
0 votes
0 answers
9 views

Implementing Video streaming restrictions based on hourly usage at home [closed]

I'm new at networking, so my question might be basic or naive. I want to implement restrictions for mobile devices if it is being used to view videos for more than an hour continuously then its ...
Trying Tobemyself's user avatar
0 votes
0 answers
18 views

Unable to preserve HTTP/2 headers list when extracting frame using editcap. Hex Dump Matches [closed]

When I used editcap to extract a HTTP/2 Frame from a Captured PCAP using tcpdump, the HTTP/2 headers don't show up in extracted frame, but the Hex dump matches. I am using the below editcap command to ...
Devavrat Agnihotri's user avatar
0 votes
0 answers
29 views

TCP blocked until the acknowledgment received

I am currently facing an issue in my application where the TCP messages seem to be blocked until an acknowledgment received. Specifically, the subsequent messages wait for the acknowledgment of the ...
myprogramistoobusywitherrors's user avatar
0 votes
0 answers
18 views

RPCAP active mode usage or deployment example

This is in reference to https://www.winpcap.org/docs/docs_40_2/html/group__remote.html, the RPCAP protocol. Wireshark (on Windows) has support for connecting to passive mode deployment. And the RPCAP ...
David's user avatar
  • 101
0 votes
0 answers
30 views

Can TCP seq number increment after sending a FIN?

I have an embedded device connecting to a server (on AWS Application ELB if that matters). Both the server and the client are instructed to close the connection after one request. I noticed that the ...
xxljob's user avatar
  • 1
0 votes
0 answers
43 views

TLS decryption with wireshark

I know there are many similar articles about how to do this, but I cant seem to get any of them to work, and I cant get any info to tell me what the problem might be. I am following this: https://www....
Alan's user avatar
  • 101
0 votes
0 answers
312 views

Monitor UDP packet in wireshark

I am trying to monitor udp packets from server to client in Wireshark at both end. Can I get any clue in Wireshark with which I find out that ok this specific udp packet is what I sent and received at ...
Nifty's user avatar
  • 13
0 votes
1 answer
154 views

Wireshark only shows single HTTP request instead of its constituent TCP packets and ACKs

To my understanding, in packet no.39, the post request actually consists of multiple tcp packets getting sent, and they all get acked once by no.40. The server has received it. Now, the server sends ...
JohnDoeyyy's user avatar
0 votes
1 answer
307 views

Wireshark: Cannot find frame type of packets

I am getting used to Wireshark operation and currently, I am investigating different frames (control, management, data frame) and using filter in these links (https://mrncciew.com/2014/10/02/cwap-802-...
Nguyen Huy's user avatar
0 votes
0 answers
10 views

ARP Header's Mac Address set to 0 when broadcasting [duplicate]

I'm learning about Ethernet frames and networks and Wireshark has been very useful. I have a doubt regarding broadcasting and ARP request, since we don't know the Target MAC address, in the ARP's ...
ad_valle's user avatar
0 votes
1 answer
66 views

Wireshark on ProCurve 1810G - IEEE802a protocol

I have recently started a networking course and acquired an old HP ProCurve 1810G-24 Switch to play about with, which I have updated to the latest firmware. I'm using Wireshark to monitor the traffic, ...
Paul Smith's user avatar
0 votes
1 answer
107 views

Wireshark -Protocol Hierarchy Omitting large amount of subprotocol traffic

Based on responses, I've repositioned this question to ask why the subprotocols under my TCP header are not accounting for the sum of packet transfer. (I.E TCP= 97.1%, remainder of packet content not ...
N S's user avatar
  • 3
0 votes
1 answer
373 views

Probe Request getting\understanding Information Elements (IEs)

I'm trying to read Information Elements (IEs) from the probe request can't seem to understand the stracture of it as I undersatnd it size can be 0-2312 bytes but how do I know how many there are? I ...
Afik_Android's user avatar
0 votes
1 answer
75 views

Unwanted Wireshark Optimizing Received 802.11 Channel for Frames

I am trying to run an experiment which involves monitoring 3 wireless channels simultaneously in Wireshark which would allow me to see a single frame captured 3 times on each channel. To do this, I ...
Taylor Artunian's user avatar
0 votes
0 answers
16 views

Some random client requests fails with unexpected TCP [RST] packets [duplicate]

I have a service doing listen that serves clients over a TCP sockets connection with a raw binary protocol. The principle is basic: the connection is established, the client sends a request with data, ...
Ariel's user avatar
  • 1
0 votes
1 answer
127 views

Homeplug av frame

I want to check differences between a frame sent by a pc connected to an homeplug and one pc connected directly with the gateway/router. When i sniff packets i cannot see any differences in the frame, ...
claudio's user avatar
0 votes
0 answers
118 views

Man in the middle legitimate packet inspection

we're trying to debug a faulty Panasonic Mobile softphone SIP app (both Android & Apple versions), as many calls are randomly dropped unexpectedly. This is the conceptual connection diagram: We ...
Riccardo's user avatar
  • 163
0 votes
2 answers
3k views

What's the Destination unreachable ICMP packet(ICMP payload the UDP) usage? [closed]

In my Mac(192.168.2.228), it will send ICMP packet to my house's router (192.168.2.1). with the info Destination unreachable (Port unreachable) and in the Wireshark packet detail panel, there ...
244boy's user avatar
  • 1,747
0 votes
1 answer
48 views

re transmission happened before receiving Three ACKs packets

In the following wireshark trace, the packet with seq=41030 was sent, after some time the packet before it got acknowledged. after that a retransmission happened the packet seq=41030, then 3 ACKs ...
0xDEADC0DE's user avatar
0 votes
0 answers
122 views

Wireshark packet read starting from a custom protocol

Pardon the badly-framed question title, I am struggling with it but could not find the best way to frame it. I have a program in which I use libpcap for dumping packets at various points in the ...
Panda142308's user avatar
0 votes
0 answers
47 views

How to analyze traffic made by device on local Wifi network

I have a device (Air quality sensor) that is sending data to a preconfigured server. I would like to access the data that is being sent. Device connects to local Wifi (WPA Secured) and presumably ...
Slavic's user avatar
  • 101
0 votes
0 answers
48 views

Import Embedded Packet Capture output into Wireshark

I did packet capturing with cisco's Embedded Packet Capture and I would like to view the output in Wireshark. The problem is that I only have CLI access to the device, so exporting via TFTP is not an ...
human374's user avatar
  • 383
0 votes
1 answer
2k views

No response to ICMP (traceroute)

192.168.1.37 can ping 192.168.0.22, but can't ping 192.168.0.240 subnet masks are 255.255.255.0 on all hosts in question Switch/gateway in the middle (192.168.1.253) can ping both of these ...
Tony Sepia's user avatar
0 votes
1 answer
1k views

Unable to capture http request in Wireshark [closed]

I am working in wireshark. I am monitoring the wifi traffic on the same network. We have 6 pc's there and one machine was installed on wireshark to capture wifi traffic. I got my team mates Ip ...
toastmaster's user avatar
-1 votes
4 answers
4k views

Pcap file parsing

I have a .pcap file that I would like to look at. But when I open it in notepad++ i get strings of discernible information, but a whole lot more of black boxes with 'NUL' written in them. I know I ...
user8151's user avatar
-1 votes
2 answers
350 views

How to know how many frames will be needed to transmit a file

How many frames will be neeed to transmit a file of 80,480 KB file? Is there a mathematical calculation for this?
George's user avatar
  • 39
-1 votes
1 answer
7k views

header checksum error in wireshark

hello all , I am not able to understand what kind of error is wireshark showing me please refer picture need help.
Ravi Jani's user avatar
-1 votes
1 answer
1k views

Wireshark time to live pattern question

what pattern does ttl usually follows? working with a task where the ttl increments by 1 for every 3 packets. In the other task the ttl does not have any clear pattern. Info: I am doing traceroute ...
guru's user avatar
  • 1
-1 votes
2 answers
484 views

is CDMA the main reason why Wireshark can't capture packet on wireless in promiscuous mode?

I was always curious why I can't capture other people's packets that are flying on air by Wireshark. Of course I know there's airmon-ng but I was just wondering why Wireshark itself can't "just simply"...
ksp0422's user avatar
  • 193
-1 votes
1 answer
44 views

What is the packet protocol used for communicating switch configuration changes over the network? [closed]

I am trying to isolate the packets used to communicate a switch's configuration changes. More specifically, whenever I use the online tool on my laptop and configure the switch (and hit save) I want ...
Lyra Orwell's user avatar
-1 votes
2 answers
161 views

Wireshark can't capture packets from machine 2 to machine 3 [duplicate]

I got an idea there were 3 machines. machine 1,2 amd 3. Machine 2 ping to machine 1, i can capture the packets by using tcpdump. But mchine 2 ping to machine 3 , then machine 1 can't capture by using ...
toastmaster's user avatar

1 2 3 4 5
6