The tag has no wiki summary.

learn more… | top users | synonyms

0
votes
2answers
36 views

Remove pauses greater than x from pcap file

I've captured udp traffic to a pcap file. When replaying with tcpreplay-edit, I'd like to shorten all pauses (where there is no udp traffic at all) to x seconds max. tcpreplay-edit only has a global ...
2
votes
1answer
31 views

How to sniff download information of different pc's on a network(router)

Actually I am making an Log Analyzer for downloads on a network by different users.So i want to know who downloaded what in a same network.I know SSL packets cannot be sniffed but I want only ...
3
votes
1answer
168 views

merge pcap files

I'm trying to merge 15 pcap files using wireshark. The merging is successful. I'm using appending function so that the second file is just added to the bottom of the first file. But when this is done, ...
0
votes
0answers
29 views

Difference between mergecap merging and concatenate

Can anyone tell me the difference between merging and concatenate the pcap files using mergecap function. I opened the output files in wireshark. I couldn't understand any difference.
0
votes
2answers
206 views

using mergecap for set of files

Im trying to use mergecap to merge 15 old pcap files in a folder. I tried to use FILES=($(find /mnt/md0/capture/DCN/ -maxdepth 1 -type f -name "*.pcap" -print0 | xargs -0 ls -lt | tail -15 | awk ...
0
votes
3answers
219 views

How to set up wireshark with correct permissions [duplicate]

Ubuntu 13.10, Saucy Salamander here. I am trying to install wireshark in order to monitor USB activity with a certain device. The problem is that wireshark does not have access to the USB bus (or any ...
0
votes
1answer
266 views

dumpcap: SIOCSIWMODE failed: Operation not permitted

When I try to capture in monitor mode in Wireshark after capturing a few packets I get the following error: Unknown message from dumpcap, try to show it as a string: Can't restore interface wlp18s0 ...
3
votes
2answers
1k views

Can't get Wireshark to run as user on CentOS

It's the first time I'm installing and configuring Wireshark in a rpm-based distro. In the past I've installed it properly on Ubuntu, Mint or Debian. Don't know why, but it seems I cannot run it as ...
2
votes
1answer
825 views

“tshark: There are no interfaces on which a capture can be done” in Amazon Linux AMI

My goal is to capture packets with tshark in Amazon Linux AMI. While typing tshark in the command line there's an error: "tshark: There are no interfaces on which a capture can be done" How to ...
2
votes
2answers
105 views

Tshark not running via gdb

I have successfully installed wireshark on centos 6.4 I can run the command tshark it works perfectly fine. I want to run gdb so that I want to learn how it decodes tcp and udp packet as I am writing ...
1
vote
1answer
76 views

Wireshark packet dissection codes?

Hi all we have a system which could capture packets accordingly. The only problem now we need some codes on how to interpret the packet just like how wireshark does it so well. Anyplace we can get ...
1
vote
2answers
93 views

How to have a pop-up window for password appear when opening application?

We have build wireshark adding some functionality related to our use, in Scientific Linux 6 system. After this when I start this using normal user, it will not allow me to use the network interface. ...
0
votes
1answer
60 views

tshark command for finding MAC of a specified network

What tshark command could start listening to a specific network and see who (MAC-wise) is connecting to it? I already have the network card in monitor mode at the correct channel. WireShark can ...
-1
votes
2answers
789 views

yum install wireshark-gnome [on hold]

I tried using command yum install wireshark-gnome to install wireshark on RedHat 6.3. And I make sure the network is ok. But it fails cause by below prompt. Loaded plugins: product-id, security, ...
1
vote
1answer
128 views

Using Wireshark on Linux to observe coupled HTTP-request and HTTP-respond

I use Wireshark on Linux to observe my HTTP traffic. Other programms like Firefox Live Http Headers show coupled http-request from my browser and http-respond from any server. How using programs like ...
4
votes
1answer
303 views

Tell tcpdump to skip custom header

I have an IP packet with x bytes of custom header coming in on an interface. Is there a way to tell tcpdump or tshark to ignore the first x bytes and decode and display the IP packet? Any pointers ...
2
votes
1answer
442 views

Why is a echo-request ping packet 84 bytes in the log of iptables?

When I log the length of a echo-request packet, iptables -A OUTPUT -p icmp -m icmp --icmp-type 8 -j LOG I saw the length was LEN=84, but in wireshark, the captured packet size was 0x60, why does it ...
2
votes
1answer
435 views

Is tshark using different syntax with wireshark?

The filter !ssh works in wireshark but not in tshark!, When I do tshark '!ssh', it complains about the filter, so what's wrong here?