Questions tagged [wireshark]

For questions about Wireshark, a packet analyzer

Filter by
Sorted by
Tagged with
0 votes
2 answers
1k views

Wireshark - capture all packets for HTTP request

I want to launch a HTTP request to a website I've never visited before. I would like to pick up all of the packets related to this request; so DNS packets, TCP packets, et cetera. Is there a way to ...
Daniel Paczuski Bak's user avatar
0 votes
1 answer
6k views

Does tcp.analysis.flags in Wireshark find bad TCP packet?

Let me start by prefixing my knowledge of Wireshark is very limited. Context : I'm investigating logs between a server hosted files and an AV that supported ICAP protocol. In this logs I'm very ...
Alexandre Roux's user avatar
0 votes
1 answer
390 views

HTTP server responds with TTL- exceeded for TCP-SYN till TTL is increased by +2 from the actual number of hops

Trying to traceroute an HTTP server using TCP-SYN packets. There are 13 hops between the two hosts, but the server responds with TTL-exceeded for TTL=13 and TTL=14. It replies with TCP SYN-ACK only ...
Kaushal Deodhar's user avatar
0 votes
1 answer
326 views

Same offset in fragmented IP packets when using Covert channel

I am currently experimenting which Tunnelshell. So, I launched it on the victim and on the attacker, executed a command via the Tunnelshell and captured the traffic via Wireshark to see what's going ...
John Doe's user avatar
0 votes
3 answers
2k views

Trying to capture a RST on a TCP/IP program using Wireshark [closed]

So, recently, I've run into a few issues with Python TCP/IP sockets. Basically, I can't make,and neither can Python's IDLE (a Python file editor) program itself, since it requires a connection at ...
said's user avatar
  • 101
0 votes
1 answer
686 views

Microsoft load balancer heartbeat [closed]

I'm dealing with the following situation: I have 2 servers running Windows 2012 R2 and 1 server running Windows 2008 R2. I need to build a Microsoft Network LoadBalancer cluster using the 3 servers; ...
Ottootto's user avatar
  • 131
0 votes
1 answer
2k views

Viewing Xbox One Network Traffic [closed]

I am trying to view the HTTP/HTTPS traffic going from my XBOX one so I can see what is being requested. I started off trying to use Charles proxy like this https://www.youtube.com/watch?v=MP4ZcwSHxbw....
Jaeren Coathup's user avatar
0 votes
0 answers
13 views

Unusual IRC Traffic Detected on My Home Network: Need Advice on Investigation and Mitigation [closed]

I'm a sysadmin and DevOps engineer and have recently detected some unusual traffic on my home network that has raised my security concerns. I noticed multiple Chromecast streaming options for devices ...
citoyen1337's user avatar
0 votes
0 answers
17 views

Where in the TLS 1.3 record is the sequence number located? [closed]

The sequence number should be a 64 bit number in every TLS record, but the record header layer is only 5 bytes long and I am looking at a Wireshark pcap, where the TLS record only includes the header ...
miran80's user avatar
  • 101
0 votes
0 answers
1k views

Wireshark not capturing packets?

I am trying to use Wireshark, but for some reason it won't capture packets. I've used it once before and it worked just fine, so I can't understand why it's not working right now. The only thing I've ...
Tita's user avatar
  • 113
0 votes
0 answers
34 views

TLS decryption with wireshark

I know there are many similar articles about how to do this, but I cant seem to get any of them to work, and I cant get any info to tell me what the problem might be. I am following this: https://www....
Alan's user avatar
  • 101
0 votes
0 answers
146 views

Monitor UDP packet in wireshark

I am trying to monitor udp packets from server to client in Wireshark at both end. Can I get any clue in Wireshark with which I find out that ok this specific udp packet is what I sent and received at ...
Nifty's user avatar
  • 13
0 votes
0 answers
155 views

(Wireshark) how to filter TCP connections

I have a filter, where I am filtering connections based on a HTTP proxy hostname. But I need to filter the whole TCP connections where at least one packet contain this tag (from SYN to FIN, not just ...
user3809807's user avatar
0 votes
1 answer
119 views

Wireshark only shows single HTTP request instead of its constituent TCP packets and ACKs

To my understanding, in packet no.39, the post request actually consists of multiple tcp packets getting sent, and they all get acked once by no.40. The server has received it. Now, the server sends ...
JohnDoeyyy's user avatar
0 votes
1 answer
206 views

Wireshark: Cannot find frame type of packets

I am getting used to Wireshark operation and currently, I am investigating different frames (control, management, data frame) and using filter in these links (https://mrncciew.com/2014/10/02/cwap-802-...
Nguyen Huy's user avatar
0 votes
0 answers
10 views

ARP Header's Mac Address set to 0 when broadcasting [duplicate]

I'm learning about Ethernet frames and networks and Wireshark has been very useful. I have a doubt regarding broadcasting and ARP request, since we don't know the Target MAC address, in the ARP's ...
ad_valle's user avatar
0 votes
1 answer
50 views

Wireshark on ProCurve 1810G - IEEE802a protocol

I have recently started a networking course and acquired an old HP ProCurve 1810G-24 Switch to play about with, which I have updated to the latest firmware. I'm using Wireshark to monitor the traffic, ...
Paul Smith's user avatar
0 votes
1 answer
94 views

Wireshark -Protocol Hierarchy Omitting large amount of subprotocol traffic

Based on responses, I've repositioned this question to ask why the subprotocols under my TCP header are not accounting for the sum of packet transfer. (I.E TCP= 97.1%, remainder of packet content not ...
N S's user avatar
  • 3
0 votes
1 answer
290 views

Probe Request getting\understanding Information Elements (IEs)

I'm trying to read Information Elements (IEs) from the probe request can't seem to understand the stracture of it as I undersatnd it size can be 0-2312 bytes but how do I know how many there are? I ...
Afik_Android's user avatar
0 votes
1 answer
74 views

Unwanted Wireshark Optimizing Received 802.11 Channel for Frames

I am trying to run an experiment which involves monitoring 3 wireless channels simultaneously in Wireshark which would allow me to see a single frame captured 3 times on each channel. To do this, I ...
Taylor Artunian's user avatar
0 votes
0 answers
14 views

Some random client requests fails with unexpected TCP [RST] packets [duplicate]

I have a service doing listen that serves clients over a TCP sockets connection with a raw binary protocol. The principle is basic: the connection is established, the client sends a request with data, ...
Ariel's user avatar
  • 1
0 votes
1 answer
113 views

Homeplug av frame

I want to check differences between a frame sent by a pc connected to an homeplug and one pc connected directly with the gateway/router. When i sniff packets i cannot see any differences in the frame, ...
claudio's user avatar
0 votes
0 answers
87 views

Man in the middle legitimate packet inspection

we're trying to debug a faulty Panasonic Mobile softphone SIP app (both Android & Apple versions), as many calls are randomly dropped unexpectedly. This is the conceptual connection diagram: We ...
Riccardo's user avatar
  • 161
0 votes
2 answers
2k views

What's the Destination unreachable ICMP packet(ICMP payload the UDP) usage? [closed]

In my Mac(192.168.2.228), it will send ICMP packet to my house's router (192.168.2.1). with the info Destination unreachable (Port unreachable) and in the Wireshark packet detail panel, there ...
244boy's user avatar
  • 1,747
0 votes
1 answer
37 views

re transmission happened before receiving Three ACKs packets

In the following wireshark trace, the packet with seq=41030 was sent, after some time the packet before it got acknowledged. after that a retransmission happened the packet seq=41030, then 3 ACKs ...
0xDEADC0DE's user avatar
0 votes
0 answers
92 views

Wireshark packet read starting from a custom protocol

Pardon the badly-framed question title, I am struggling with it but could not find the best way to frame it. I have a program in which I use libpcap for dumping packets at various points in the ...
Panda142308's user avatar
0 votes
0 answers
43 views

How to analyze traffic made by device on local Wifi network

I have a device (Air quality sensor) that is sending data to a preconfigured server. I would like to access the data that is being sent. Device connects to local Wifi (WPA Secured) and presumably ...
Slavic's user avatar
  • 101
0 votes
0 answers
30 views

Import Embedded Packet Capture output into Wireshark

I did packet capturing with cisco's Embedded Packet Capture and I would like to view the output in Wireshark. The problem is that I only have CLI access to the device, so exporting via TFTP is not an ...
human374's user avatar
  • 383
0 votes
1 answer
2k views

No response to ICMP (traceroute)

192.168.1.37 can ping 192.168.0.22, but can't ping 192.168.0.240 subnet masks are 255.255.255.0 on all hosts in question Switch/gateway in the middle (192.168.1.253) can ping both of these ...
Tony Sepia's user avatar
0 votes
1 answer
1k views

Unable to capture http request in Wireshark [closed]

I am working in wireshark. I am monitoring the wifi traffic on the same network. We have 6 pc's there and one machine was installed on wireshark to capture wifi traffic. I got my team mates Ip ...
toastmaster's user avatar
-1 votes
4 answers
4k views

Pcap file parsing

I have a .pcap file that I would like to look at. But when I open it in notepad++ i get strings of discernible information, but a whole lot more of black boxes with 'NUL' written in them. I know I ...
user8151's user avatar
-1 votes
2 answers
280 views

How to know how many frames will be needed to transmit a file

How many frames will be neeed to transmit a file of 80,480 KB file? Is there a mathematical calculation for this?
George's user avatar
  • 39
-1 votes
1 answer
6k views

header checksum error in wireshark

hello all , I am not able to understand what kind of error is wireshark showing me please refer picture need help.
Ravi Jani's user avatar
-1 votes
1 answer
1k views

Wireshark time to live pattern question

what pattern does ttl usually follows? working with a task where the ttl increments by 1 for every 3 packets. In the other task the ttl does not have any clear pattern. Info: I am doing traceroute ...
guru's user avatar
  • 1
-1 votes
2 answers
479 views

is CDMA the main reason why Wireshark can't capture packet on wireless in promiscuous mode?

I was always curious why I can't capture other people's packets that are flying on air by Wireshark. Of course I know there's airmon-ng but I was just wondering why Wireshark itself can't "just simply"...
ksp0422's user avatar
  • 193
-1 votes
1 answer
39 views

What is the packet protocol used for communicating switch configuration changes over the network? [closed]

I am trying to isolate the packets used to communicate a switch's configuration changes. More specifically, whenever I use the online tool on my laptop and configure the switch (and hit save) I want ...
Lyra Orwell's user avatar
-1 votes
2 answers
161 views

Wireshark can't capture packets from machine 2 to machine 3 [duplicate]

I got an idea there were 3 machines. machine 1,2 amd 3. Machine 2 ping to machine 1, i can capture the packets by using tcpdump. But mchine 2 ping to machine 3 , then machine 1 can't capture by using ...
toastmaster's user avatar

1 2 3 4 5
6