19
votes
Why does Wireshark show Version TLS 1.2 here instead of TLS 1.3?
Sorry, for the confusion, I was missing the exact TLS 1.3 semantics: For instance, in the Client Hello, the field "version" must contain the fixed value 0x0303 (TLS 1.2), while the prefered version is ...
- 421
15
votes
Accepted
ARP request with unicast MAC?
In an attempt to refresh an expired, or expiring, ARP entry, many Client OS's will issue a "targeted" ARP query to the MAC address they already expect. Most of the time, this prompts a response from ...
- 14.9k
12
votes
Accepted
What is the difference between tshark, dumpcap and others for collecting/sniffing traffic?
Wireshark is a graphical application. tshark is that application without the GUI. (i.e. command line.) dumpcap, per Wireshark's documentation, is "a small program whose only purpose is to capture ...
- 31.7k
9
votes
Ethernet frame IG/LG bit explanation - Wireshark
Both the LG bit (sometimes also referred to as UL bit) and the IG bit are located in the most significant byte of each MAC address, where the IG bit is the least significant bit in this byte and the ...
- 1,059
8
votes
Ethernet padding
IEEE 802.3 describes structure of Ethernet frames. As it says the minimum frame length is 64 bytes. Every frame less than 64 bytes should be padded with 0 before transmitted on the Ethernet link. This ...
- 298
8
votes
Accepted
Why my computer is making this ARP requests to external (Gov) IP addresses?
169.254.0.0/16 is reserved for link-local addresses as per RFC 3927. Link-local address space is used when there is no authority for IP address control (DHCP or static configuration). Some device with ...
- 82.6k
8
votes
How to view MTU size in Wireshark?
There is nothing in the packet that will tell you what the MTU is. It's an attribute of an interface. The MTU can vary along the path from source to destination. So for example, the link from A to ...
- 67.1k
7
votes
Accepted
Decode with known PSK in DTLS
Open the capture on Wireshark, and:
Rigth-click on a DTLS packet
Then select "Protocol Preferences" --> "Datagram Transport Layer Preferences"
There you can put your PSK in HEX format.
Finally, when ...
- 86
7
votes
Accepted
Wireshark, extract all http headers
I often do that by using either one of two following options:
First option is similar to the one @Elias mentioned earlier, but this is more general, especially when the header field is not visible to ...
- 3,754
6
votes
Accepted
Why do i only see QUIC and not UDP during capture in wireshark?
Wireshark uses dissectors and lua scripts to analyze and classify capture traffic (or parts thereof). What is displayed in the Protocol field of Wireshark's Packet List Pane is the information ...
- 27.2k
6
votes
Accepted
Filter ARP packets with specific "Who has" and "Tell" IP
Wireshark ARP filter reference
To filter "Who has" you need ( arp.dst.proto_ipv4 == 192.168.1.1 ) && ( arp.opcode==1 )
To find "Tell" you need ( arp.src.proto_ipv4 == 192.168.1.2 ) && ...
- 78
6
votes
Accepted
Mac Address Representation wireshark
NOTE—The bit-reversed representation is of historical interest only and is no longer applicable to any active IEEE 802 standard.
(IEEE 802-2014 8.1 Terms and notational conventions)
The bit-reversed,...
- 82.6k
6
votes
Accepted
What does a "Frame" relate to in the WIreshark packet details pane?
In this context, Frame refers to the metadata that Wireshark gathers about the data it sees. It's derived from, but not a part of, any common protocol like Ethernet.
In other contexts, "Frame" is ...
- 67.1k
6
votes
Accepted
How can a UDP Client and a packet sniffer run on the same machine?
Packet sniffing applications tap into the lower layers of the network stack, not at the top like your UDP-using applications that connect to UDP at the top of the network stack.
- 98.7k
6
votes
Why does Wireshark show Version TLS 1.2 here instead of TLS 1.3?
Why does Wireshark show in the overview Protocol TLSv1.3 but in the details Version TLS 1.2?
Wireshark reports TLS 1.3 in the protocol column due to Server Hello containing a Supported Versions ...
- 161
6
votes
Accepted
IPv6 Wireshark filter for partial IP address
I found the answer myself. The display filter would be
ipv6.host matches ":113:5005:7b:091b$"
- 1,412
6
votes
Accepted
Weird Wireshark protocol list (eth:ethertype:ip:data where is the "udp"?)
You have fragmentation and when you don't see UDP header, it means this is not the first fragment of the IP Datagram. In your given frame, look at the 'ip.frag_offset' which is 175.
So there is at ...
- 321
5
votes
Accepted
Spurious restransmission to a server behind pfsense NAT
Found it !
It's a bug when running pfsense virtualized -> https://bugs.freebsd.org/bugzilla/show_bug.cgi?id=165059
Workaround is to disable hardware checksum offload box under System > Advanced on ...
- 81
5
votes
Is it possible to create an IPv4 packet header larger than 20 bytes on an IPv4 connection?
Is it possible to generate an IPv4 packet with an IPv4 packet header larger than 20 bytes on an IPv4 connections?
Yes, there are IPv4 options that may increase the packet header size. That is one of ...
- 98.7k
5
votes
Accepted
TCP session established even if the server isn't listening on particular port
Fortinet has an ALG (proxy) for SIP (a VoIP protocol) since this protocol uses dynamic ports (like FTP) and thus need to be handled in a specific way. Port 5060 is the default port for SIP. This means ...
- 2,343
5
votes
Accepted
Calculating 3 way TCP Handshake Duration
It's called 3-way handshake, so it is transmitted three times: SYN -> SYN/ACK -> ACK. The minimum time required is two 1.5 times the round-trip time (RTT).
(Each side sees a 1x RTT delay for the ...
- 82.6k
5
votes
Accepted
How does any program identify the protocol header next from TCP?
Services are distinguished by the port number, which is in the TCP header, and a given service (HTTP, FTP, TIME) will have a process on the server listening on a given port number. (Specifically, the ...
- 16.2k
5
votes
Does the frame package, all are represent as hex data?
Data is binary-ones and zeros. Wireshark displays the data as hex characters so it’s easy to read.
- 67.1k
5
votes
Accepted
IPV6 ping, the pinged address is different from the once caught by wireshark
What you're seeing is the Neighbor Discovery Protocol which in IPv6 replaces ARP. You can see that data is ICMP , and the destination address is a Solicited Node addresses. You can read more about ...
- 67.1k
4
votes
Calculated window size in Wireshark
This post has a good explanation for what you're seeing.
What you see is normal behavior. Both sides send a small window size
and neither announce that they are able to use window scaling. So in
...
- 2,337
4
votes
IP packet reading
The unit used in the Length field is not bit nor even byte but 32bits words.
So the value 5 correspond to five 32 bits words = 160 bits = 20 bytes.
And the max value is then 15 x 32 bits = 60 bytes (...
- 19.5k
4
votes
Accepted
How to fiter non SSH traffic in Wireshark
The ACK packets are not recognised as SSH packets, so the "not ssh" part of your filter doesn't match on them.
How about simply using
ip.addr == 10.0.0.31 && tcp.port != 22
- 2,638
4
votes
Accepted
How to capture packets from all wifi channels at once?
No.Because of the design of physical radio interface.
As you can not connect to all the channels (more than one) at a time, same applies while capturing the WLAN traffic. In capture scenario you are ...
- 56
4
votes
Wireshark, extract all http headers
If you have a header visible in a selected packet, right click it and choose apply as column. That will add the data as a column to the packet view. Then you can export your filtered data normally to ...
- 266
4
votes
What more information can I get from filtering by MAC address rather than IP?
Is there an advantage to using a MAC address capture filter over a (static) IP address for the host?
Depending on the purpose of the capture, certainly.
If so, what?
The advantage of capturing ...
- 27.2k
Only top scored, non community-wiki answers of a minimum length are eligible