Skip to main content
Share Your Experience: Take the 2024 Developer Survey
19 votes

Why does Wireshark show Version TLS 1.2 here instead of TLS 1.3?

Sorry, for the confusion, I was missing the exact TLS 1.3 semantics: For instance, in the Client Hello, the field "version" must contain the fixed value 0x0303 (TLS 1.2), while the prefered version is ...
user120513's user avatar
15 votes
Accepted

ARP request with unicast MAC?

In an attempt to refresh an expired, or expiring, ARP entry, many Client OS's will issue a "targeted" ARP query to the MAC address they already expect. Most of the time, this prompts a response from ...
Eddie's user avatar
  • 15k
12 votes
Accepted

What is the difference between tshark, dumpcap and others for collecting/sniffing traffic?

Wireshark is a graphical application. tshark is that application without the GUI. (i.e. command line.) dumpcap, per Wireshark's documentation, is "a small program whose only purpose is to capture ...
Ricky's user avatar
  • 32.3k
9 votes

Ethernet padding

IEEE 802.3 describes structure of Ethernet frames. As it says the minimum frame length is 64 bytes. Every frame less than 64 bytes should be padded with 0 before transmitted on the Ethernet link. This ...
SuB's user avatar
  • 308
8 votes
Accepted

Why my computer is making this ARP requests to external (Gov) IP addresses?

169.254.0.0/16 is reserved for link-local addresses as per RFC 3927. Link-local address space is used when there is no authority for IP address control (DHCP or static configuration). Some device with ...
Zac67's user avatar
  • 84.9k
8 votes

How to view MTU size in Wireshark?

There is nothing in the packet that will tell you what the MTU is. It's an attribute of an interface. The MTU can vary along the path from source to destination. So for example, the link from A to ...
Ron Trunk's user avatar
  • 67.7k
7 votes
Accepted

Wireshark, extract all http headers

I often do that by using either one of two following options: First option is similar to the one @Elias mentioned earlier, but this is more general, especially when the header field is not visible to ...
Hung Tran's user avatar
  • 3,754
6 votes
Accepted

Filter ARP packets with specific "Who has" and "Tell" IP

Wireshark ARP filter reference To filter "Who has" you need ( arp.dst.proto_ipv4 == 192.168.1.1 ) && ( arp.opcode==1 ) To find "Tell" you need ( arp.src.proto_ipv4 == 192.168.1.2 ) && ...
fastforward's user avatar
6 votes
Accepted

Mac Address Representation wireshark

NOTE—The bit-reversed representation is of historical interest only and is no longer applicable to any active IEEE 802 standard. (IEEE 802-2014 8.1 Terms and notational conventions) The bit-reversed,...
Zac67's user avatar
  • 84.9k
6 votes
Accepted

What does a "Frame" relate to in the WIreshark packet details pane?

In this context, Frame refers to the metadata that Wireshark gathers about the data it sees. It's derived from, but not a part of, any common protocol like Ethernet. In other contexts, "Frame" is ...
Ron Trunk's user avatar
  • 67.7k
6 votes
Accepted

How can a UDP Client and a packet sniffer run on the same machine?

Packet sniffing applications tap into the lower layers of the network stack, not at the top like your UDP-using applications that connect to UDP at the top of the network stack.
Ron Maupin's user avatar
  • 99.8k
6 votes

Why does Wireshark show Version TLS 1.2 here instead of TLS 1.3?

Why does Wireshark show in the overview Protocol TLSv1.3 but in the details Version TLS 1.2? Wireshark reports TLS 1.3 in the protocol column due to Server Hello containing a Supported Versions ...
Lekensteyn's user avatar
6 votes
Accepted

IPv6 Wireshark filter for partial IP address

I found the answer myself. The display filter would be ipv6.host matches ":113:5005:7b:091b$"
Maverick's user avatar
  • 1,412
6 votes
Accepted

Weird Wireshark protocol list (eth:ethertype:ip:data where is the "udp"?)

You have fragmentation and when you don't see UDP header, it means this is not the first fragment of the IP Datagram. In your given frame, look at the 'ip.frag_offset' which is 175. So there is at ...
omuffat's user avatar
  • 321
5 votes
Accepted

Spurious restransmission to a server behind pfsense NAT

Found it ! It's a bug when running pfsense virtualized -> https://bugs.freebsd.org/bugzilla/show_bug.cgi?id=165059 Workaround is to disable hardware checksum offload box under System > Advanced on ...
aurel's user avatar
  • 81
5 votes

Is it possible to create an IPv4 packet header larger than 20 bytes on an IPv4 connection?

Is it possible to generate an IPv4 packet with an IPv4 packet header larger than 20 bytes on an IPv4 connections? Yes, there are IPv4 options that may increase the packet header size. That is one of ...
Ron Maupin's user avatar
  • 99.8k
5 votes
Accepted

TCP session established even if the server isn't listening on particular port

Fortinet has an ALG (proxy) for SIP (a VoIP protocol) since this protocol uses dynamic ports (like FTP) and thus need to be handled in a specific way. Port 5060 is the default port for SIP. This means ...
Steffen Ullrich's user avatar
5 votes
Accepted

Calculating 3 way TCP Handshake Duration

It's called 3-way handshake, so it is transmitted three times: SYN -> SYN/ACK -> ACK. The minimum time required is two 1.5 times the round-trip time (RTT). (Each side sees a 1x RTT delay for the ...
Zac67's user avatar
  • 84.9k
5 votes
Accepted

How does any program identify the protocol header next from TCP?

Services are distinguished by the port number, which is in the TCP header, and a given service (HTTP, FTP, TIME) will have a process on the server listening on a given port number. (Specifically, the ...
jonathanjo's user avatar
  • 16.3k
5 votes

Does the frame package, all are represent as hex data?

Data is binary-ones and zeros. Wireshark displays the data as hex characters so it’s easy to read.
Ron Trunk's user avatar
  • 67.7k
5 votes
Accepted

IPV6 ping, the pinged address is different from the once caught by wireshark

What you're seeing is the Neighbor Discovery Protocol which in IPv6 replaces ARP. You can see that data is ICMP , and the destination address is a Solicited Node addresses. You can read more about ...
Ron Trunk's user avatar
  • 67.7k
4 votes

IP packet reading

The unit used in the Length field is not bit nor even byte but 32bits words. So the value 5 correspond to five 32 bits words = 160 bits = 20 bytes. And the max value is then 15 x 32 bits = 60 bytes (...
JFL's user avatar
  • 19.7k
4 votes
Accepted

How to fiter non SSH traffic in Wireshark

The ACK packets are not recognised as SSH packets, so the "not ssh" part of your filter doesn't match on them. How about simply using ip.addr == 10.0.0.31 && tcp.port != 22
hertitu's user avatar
  • 2,658
4 votes
Accepted

How to capture packets from all wifi channels at once?

No.Because of the design of physical radio interface. As you can not connect to all the channels (more than one) at a time, same applies while capturing the WLAN traffic. In capture scenario you are ...
Time Bandit's user avatar
4 votes

Wireshark, extract all http headers

If you have a header visible in a selected packet, right click it and choose apply as column. That will add the data as a column to the packet view. Then you can export your filtered data normally to ...
Elias's user avatar
  • 266
4 votes

What more information can I get from filtering by MAC address rather than IP?

Is there an advantage to using a MAC address capture filter over a (static) IP address for the host? Depending on the purpose of the capture, certainly. If so, what? The advantage of capturing ...
YLearn's user avatar
  • 27.4k
4 votes
Accepted

Rapid Spanning Tree Protocol - RSTP Bridge Id isn't RSTP-Priority + Ethernet-MAC

eth.src is the media access control address (MAC address) of the device which is a unique identifier assigned to network interfaces for communications at the data link layer of a network segment. In ...
DRP's user avatar
  • 1,491
4 votes

How can I filter out particular MAC addresses when running tshark on a pcap trace?

You can use not ether host 01:23:45:67:89:ab. To filter only source or destination address use not ether src or not ether dst. Check http://www.tcpdump.org/manpages/pcap-filter.7.html
Zac67's user avatar
  • 84.9k
4 votes
Accepted

Is it possible to capture packets between two devices in a wifi

Yes, it is possible to sniff the wireless packets. You would need airpcap and a wireless adapter which is compatible with airpcap.Basically,an adapter which supports monitoring mode. Google for the ...
Maverick's user avatar
  • 1,412

Only top scored, non community-wiki answers of a minimum length are eligible