Questions tagged [wireshark]
For questions about Wireshark, a packet analyzer
287
questions
0
votes
2
answers
1k
views
Wireshark - capture all packets for HTTP request
I want to launch a HTTP request to a website I've never visited before. I would like to pick up all of the packets related to this request; so DNS packets, TCP packets, et cetera.
Is there a way to ...
0
votes
1
answer
6k
views
Does tcp.analysis.flags in Wireshark find bad TCP packet?
Let me start by prefixing my knowledge of Wireshark is very limited.
Context : I'm investigating logs between a server hosted files and an AV that supported ICAP protocol. In this logs I'm very ...
- 103
0
votes
1
answer
390
views
HTTP server responds with TTL- exceeded for TCP-SYN till TTL is increased by +2 from the actual number of hops
Trying to traceroute an HTTP server using TCP-SYN packets. There are 13 hops between the two hosts, but the server responds with TTL-exceeded for TTL=13 and TTL=14. It replies with TCP SYN-ACK only ...
0
votes
1
answer
326
views
Same offset in fragmented IP packets when using Covert channel
I am currently experimenting which Tunnelshell. So, I launched it on the victim and on the attacker, executed a command via the Tunnelshell and captured the traffic via Wireshark to see what's going ...
- 1
0
votes
3
answers
2k
views
Trying to capture a RST on a TCP/IP program using Wireshark [closed]
So, recently, I've run into a few issues with Python TCP/IP sockets. Basically, I can't make,and neither can Python's IDLE (a Python file editor) program itself, since it requires a connection at ...
- 101
0
votes
1
answer
686
views
Microsoft load balancer heartbeat [closed]
I'm dealing with the following situation: I have 2 servers running Windows 2012 R2 and 1 server running Windows 2008 R2. I need to build a Microsoft Network LoadBalancer cluster using the 3 servers; ...
- 131
0
votes
1
answer
2k
views
Viewing Xbox One Network Traffic [closed]
I am trying to view the HTTP/HTTPS traffic going from my XBOX one so I can see what is being requested. I started off trying to use Charles proxy like this https://www.youtube.com/watch?v=MP4ZcwSHxbw....
0
votes
0
answers
13
views
Unusual IRC Traffic Detected on My Home Network: Need Advice on Investigation and Mitigation [closed]
I'm a sysadmin and DevOps engineer and have recently detected some unusual traffic on my home network that has raised my security concerns.
I noticed multiple Chromecast streaming options for devices ...
0
votes
0
answers
17
views
Where in the TLS 1.3 record is the sequence number located? [closed]
The sequence number should be a 64 bit number in every TLS record, but the record header layer is only 5 bytes long and I am looking at a Wireshark pcap, where the TLS record only includes the header ...
- 101
0
votes
0
answers
1k
views
Wireshark not capturing packets?
I am trying to use Wireshark, but for some reason it won't capture packets. I've used it once before and it worked just fine, so I can't understand why it's not working right now. The only thing I've ...
- 113
0
votes
0
answers
34
views
TLS decryption with wireshark
I know there are many similar articles about how to do this, but I cant seem to get any of them to work, and I cant get any info to tell me what the problem might be.
I am following this: https://www....
- 101
0
votes
0
answers
146
views
Monitor UDP packet in wireshark
I am trying to monitor udp packets from server to client in Wireshark at both end. Can I get any clue in Wireshark with which I find out that ok this specific udp packet is what I sent and received at ...
- 13
0
votes
0
answers
155
views
(Wireshark) how to filter TCP connections
I have a filter, where I am filtering connections based on a HTTP proxy hostname.
But I need to filter the whole TCP connections where at least one packet contain this tag (from SYN to FIN, not just ...
0
votes
1
answer
119
views
Wireshark only shows single HTTP request instead of its constituent TCP packets and ACKs
To my understanding, in packet no.39, the post request actually consists of multiple tcp packets getting sent, and they all get acked once by no.40. The server has received it. Now, the server sends ...
- 127
0
votes
1
answer
206
views
Wireshark: Cannot find frame type of packets
I am getting used to Wireshark operation and currently, I am investigating different frames (control, management, data frame) and using filter in these links (https://mrncciew.com/2014/10/02/cwap-802-...
0
votes
0
answers
10
views
ARP Header's Mac Address set to 0 when broadcasting [duplicate]
I'm learning about Ethernet frames and networks and Wireshark has been very useful.
I have a doubt regarding broadcasting and ARP request, since we don't know the Target MAC address, in the ARP's ...
- 1
0
votes
1
answer
50
views
Wireshark on ProCurve 1810G - IEEE802a protocol
I have recently started a networking course and acquired an old HP ProCurve 1810G-24 Switch to play about with, which I have updated to the latest firmware.
I'm using Wireshark to monitor the traffic, ...
0
votes
1
answer
94
views
Wireshark -Protocol Hierarchy Omitting large amount of subprotocol traffic
Based on responses, I've repositioned this question to ask why the subprotocols under my TCP header are not accounting for the sum of packet transfer. (I.E TCP= 97.1%, remainder of packet content not ...
- 3
0
votes
1
answer
290
views
Probe Request getting\understanding Information Elements (IEs)
I'm trying to read Information Elements (IEs) from the probe request
can't seem to understand the stracture of it
as I undersatnd it size can be 0-2312 bytes
but how do I know how many there are?
I ...
0
votes
1
answer
74
views
Unwanted Wireshark Optimizing Received 802.11 Channel for Frames
I am trying to run an experiment which involves monitoring 3 wireless channels simultaneously in Wireshark which would allow me to see a single frame captured 3 times on each channel.
To do this, I ...
0
votes
0
answers
14
views
Some random client requests fails with unexpected TCP [RST] packets [duplicate]
I have a service doing listen that serves clients over a TCP sockets connection with a raw binary protocol.
The principle is basic: the connection is established, the client sends a request with data, ...
- 1
0
votes
1
answer
113
views
Homeplug av frame
I want to check differences between a frame sent by a pc connected to an homeplug and one pc connected directly with the gateway/router. When i sniff packets i cannot see any differences in the frame, ...
- 5
0
votes
0
answers
87
views
Man in the middle legitimate packet inspection
we're trying to debug a faulty Panasonic Mobile softphone SIP app (both Android & Apple versions), as many calls are randomly dropped unexpectedly.
This is the conceptual connection diagram:
We ...
- 161
0
votes
2
answers
2k
views
What's the Destination unreachable ICMP packet(ICMP payload the UDP) usage? [closed]
In my Mac(192.168.2.228), it will send ICMP packet to my house's router (192.168.2.1).
with the info Destination unreachable (Port unreachable)
and in the Wireshark packet detail panel, there ...
- 1,747
0
votes
1
answer
37
views
re transmission happened before receiving Three ACKs packets
In the following wireshark trace, the packet with seq=41030 was sent, after some time the packet before it got acknowledged. after that a retransmission happened the packet seq=41030, then 3 ACKs ...
- 103
0
votes
0
answers
92
views
Wireshark packet read starting from a custom protocol
Pardon the badly-framed question title, I am struggling with it but could not find the best way to frame it. I have a program in which I use libpcap for dumping packets at various points in the ...
0
votes
0
answers
43
views
How to analyze traffic made by device on local Wifi network
I have a device (Air quality sensor) that is sending data to a preconfigured server. I would like to access the data that is being sent.
Device connects to local Wifi (WPA Secured) and presumably ...
- 101
0
votes
0
answers
30
views
Import Embedded Packet Capture output into Wireshark
I did packet capturing with cisco's Embedded Packet Capture and I would like to view the output in Wireshark.
The problem is that I only have CLI access to the device, so exporting via TFTP is not an ...
- 383
0
votes
1
answer
2k
views
No response to ICMP (traceroute)
192.168.1.37 can ping 192.168.0.22,
but can't ping 192.168.0.240
subnet masks are 255.255.255.0 on all hosts in question
Switch/gateway in the middle (192.168.1.253) can ping both of these ...
- 113
0
votes
1
answer
1k
views
Unable to capture http request in Wireshark [closed]
I am working in wireshark. I am monitoring the wifi traffic on the same network. We have 6 pc's there and one machine was installed on wireshark to capture wifi traffic. I got my team mates Ip ...
- 23
-1
votes
4
answers
4k
views
Pcap file parsing
I have a .pcap file that I would like to look at. But when I open it in notepad++ i get strings of discernible information, but a whole lot more of black boxes with 'NUL' written in them.
I know I ...
- 1
-1
votes
2
answers
280
views
How to know how many frames will be needed to transmit a file
How many frames will be neeed to transmit a file of 80,480 KB file? Is there a mathematical calculation for this?
- 39
-1
votes
1
answer
6k
views
header checksum error in wireshark
hello all , I am not able to understand what kind of error is wireshark showing me please refer picture
need help.
- 11
-1
votes
1
answer
1k
views
Wireshark time to live pattern question
what pattern does ttl usually follows?
working with a task where the ttl increments by 1 for every 3 packets. In the other task the ttl does not have any clear pattern.
Info: I am doing traceroute ...
- 1
-1
votes
2
answers
479
views
is CDMA the main reason why Wireshark can't capture packet on wireless in promiscuous mode?
I was always curious why I can't capture other people's packets that are flying on air by Wireshark. Of course I know there's airmon-ng but I was just wondering why Wireshark itself can't "just simply"...
- 193
-1
votes
1
answer
39
views
What is the packet protocol used for communicating switch configuration changes over the network? [closed]
I am trying to isolate the packets used to communicate a switch's configuration changes. More specifically, whenever I use the online tool on my laptop and configure the switch (and hit save) I want ...
- 103
-1
votes
2
answers
161
views
Wireshark can't capture packets from machine 2 to machine 3 [duplicate]
I got an idea there were 3 machines. machine 1,2 amd 3.
Machine 2 ping to machine 1, i can capture the packets by using tcpdump. But mchine 2 ping to machine 3 , then machine 1 can't capture by using ...
- 23