Questions tagged [wireshark]
The wireshark tag has no usage guidance.
102
questions
0
votes
0answers
36 views
tcpdump to perform wireless capture with advanced filters
I’m trying to use tcpdump to perform realtime wireless captures (without the option to save the file) on a MAC. My wireless interface is en0. I want to use similar filters as I would in Wireshark. My ...
0
votes
0answers
29 views
Why does Wireshark Wi-Fi capture contain only Packets to STA. Packets from STA are missing (Chipset ralink 5370 under RaspOS)
I want to prepare a capture system for analyzing roaming technologies and capabilities of APs and clients in my own network.
The observed Client is a Huawei P8 Lite (2017), the AP is a Fritzbox 5390. ...
0
votes
0answers
10 views
scan specific udp port for local network
So I have a Prometheus server which I use to capture input from port 512 UDP, I have it open, but now I have a problem checking which 512 UDP port on my network is the sender. I tried reading the nmap ...
3
votes
1answer
56 views
How to change color of options in Wireshark in Kali linux?
I am using wireshark in kali linux and all the options are coming out in white. I am not able to read a single thing,
Is there any way to change this? I have tried and search the internet for past ...
1
vote
1answer
49 views
missing TLS protocol in wireshark preferences
I've installed wireshark on Centos 7.9.2009 however I don't find TLS on the protocols list in preferences settings.
Is it something missing to be installed yet or the wireshark version available on ...
0
votes
1answer
63 views
Why is HAProxy forwarding HTTP2 requests as HTTP 1.1?
I'm trying to configure a load balancer between 2 servers with HAPoxy, this is my configuration:
frontend haproxynode
bind *:443 ssl crt /etc/ssl/private/isel.pem alpn h2,http/1.1
mode tcp
...
0
votes
0answers
12 views
Ettercap only shows virtual hosts
I just installed Kali linux on VM. I learned some things and start working with ettercap and wireshark. When I first time scaned for hosts I found online that I need to reinstall ettercap, so I did ...
0
votes
1answer
345 views
Determine the PID of a process that is calling out to an IP
My wifi card is tryign to make a connection to a seemingly random IP address on the local network. I want to find which process on the client is trying to make this connection to determine why.
This ...
0
votes
1answer
82 views
CORE and Wireshark
I use the CORE network emulator. I try to run Wireshark on one of the nodes via the terminal, but I get this error:
QStandardPaths: XDG_RUNTIME_DIR not set, defaulting to '/tmp/runtime-root'
qt.qpa....
0
votes
1answer
154 views
Macos with Virtualbox and Wireshark on LAN network
I have a virtual machine on a macos, within that virtual machine I have a Debian distribution and I want to use Wireshark to capture all the traffic from the lan network, from virtualbox. I have ...
0
votes
0answers
75 views
wireshark how to capture 802.11 packets Debian kernel 5.7 wifi intel wireless-AC 9560
I am using a Intel Corporation Wireless-AC 9560 [Jefferson Peak] (rev 10) Wifi chipset with driver iwlwifi.
When on monitor mode, with airodump-ng, i can capture packets and get their 802.11 headers ...
0
votes
0answers
136 views
Can I sniff packets on a host interface macvtap through a guest OS on QEMU/KVM?
I have a RHEL server (host) with 4 VMs. One of those VMs is Windows 10 with Wireshark. I want to use Wireshark to sniff packets going over one of the server's ethernet ports, lets call it enp2s0f2.
In ...
0
votes
1answer
95 views
Wireshark can't see the dropped packets by iptables
I'm running wireshark(2.6.8) and iptables(v1.8.2 nf_tables) instances on my computer. I saw that others can see the dropped packets with wireshark:
How can Wireshark see packets dropped by iptables?
...
4
votes
0answers
57 views
Is there a command like `time` that monitors the network traffic of commands?
I can use the time command to measure the time some command takes:
time node -e ""
node -e "" 0.06s user 0.01s system 92% cpu 0.076 total
Is there a similar way to measure a ...
1
vote
1answer
267 views
Using tcpdump to trace IP of strangers(predators) on omegle
I am using tcpdump to capture packets while being on omegle. However, I have been fairly unsuccessful to get strangers IP. All the IP I see are traced back to either 172...* which is for google 104....
0
votes
0answers
34 views
Why do I get an error when setting monitor mode if the interface is monitor mode capable?
I have these features on my system:
iw list
Wiphy phy4
max # scan SSIDs: 10
max scan IEs length: 255 bytes
max # sched scan SSIDs: 0
max # match sets: 0
max # scan plans: 1
...
0
votes
0answers
107 views
Wireshark wlan0mon doesn't catch packages
I've activated wlan0 in monitor mode but in wireshark it doesn't catch any packages.
It says only wlan0mon no addresses , no capture filters
sudo airmon-ng start wlan0
PHY Interface Driver ...
0
votes
0answers
36 views
Iptables not rewriting all packets
I would like to rewrite the srcaddr of all packets that is going out from an interface. I have the following topoly:
Client --- Server --- Website
201.70.145.218 10.221.201....
0
votes
0answers
50 views
How to find min, max data rate of pcap file
I have pcap file and I want to find min and max data rate.
I use Capinfos, it shows only average data rate. I would ask how to do that?
0
votes
1answer
50 views
CLI Utility to see the http requests that'll be made by a command
I have a script which invokes some library code that makes some HTTP and HTTPS requests, let's call it script.sh
Is there a command which would look like some-wireshark-type-utility ./script.sh and ...
1
vote
1answer
606 views
No such file or directory: /sys/kernel/debug/usb/usbmon/
I am trying to install wiresahrk on my linux mint 19.2 machine.
When executing as root it says:
The capture session could not be initiated on interface 'usbmon1' (Can't open USB bus file /sys/kernel/...
0
votes
1answer
472 views
Why is a packet is not sent until ACK is received when window size is sufficient
The considered application (server) has a number of clients connected. It processes each message from the client and sends two output messages. The output messages are generated sequencially and ...
1
vote
0answers
32 views
I need to install Wireshark on my CentOS VM
I used the following commands to install the tool:
$ yum install gcc gcc-c++ bison flex libpcap-devel qt-devel gtk3-devel rpm-build libtool c-ares-devel qt5-qtbase-devel qt5-qtmultimedia-devel qt5-...
0
votes
1answer
31 views
Repeat Tshark command when first done
I have this command that i need to repeat for ever till i stop it.
I have to send a capture to my supplier for VOIP support for a intermitent trouble.
But 10mb is taking like five minutes to complete....
3
votes
2answers
896 views
Tc qdisc delay not seen in tcpdump recording
I have two linux containers connected with a veth-pair. At veth-interface of one container I set up tc qdisc netem delay and send traffic from it to the other container. If I watch traffic on both ...
2
votes
0answers
57 views
Ctrl, Alt, and Super behave like Left Shift and I fixed it in a strange way
I use Arch Linux. I have Qumo Axe keyboard which as it turned out works only on Windows. On Linux, the bottom row keys (Ctrl, Alt, Super) behave like Left Shift, I tried to install drivers which I ...
1
vote
1answer
2k views
How to disable network-connectivity-check on linux mint?
(Virtualbox OS: Linux Mint 19.1 Tessa)
I am trying to disable the network-connectivity-check on Linux Mint.
This website shows how to disable it in the GUI for Ubuntu 17.10.
Unfortunately in Mint ...
0
votes
1answer
1k views
Cannot disable network time control (NTP)
I want to analyze some protocols (ARP, NDP, etc.) inside virtualbox (OS: Linux Mint 19.1 Tessa) using wireshark and tried to disable the "network time control"-synchronization.
yuza@VirtualBox:~$ ...
2
votes
2answers
4k views
How to capture WOL packets?
I used
sudo tcpdump -v -i eth0 ether proto 0x0842 or udp port 9
but didn't see anything when WakeMeOnLan from NirSoft wakes the computer.
The same with Wireshark
0
votes
1answer
440 views
Wireshark not showing HTTP queries
I am trying to using Wireshark, but when I set filter into http Wireshark not displaying any data.
Unfortunately, I can see only tcp/dhcp/arp protocols, but not http:
My Wireshark preferences:
I ...
1
vote
1answer
781 views
How to filter wireshark output data to only view ttyUSB0 data?
I'm Using Wireshark on Ubuntu 18.04 to monitor my ttyUSB0 USB port output as I'm developing something that requires that. On the website, I found how to get it to sniff USB ports but the output is ...
0
votes
1answer
152 views
possible packet loss
I have a program running on my local machine that prints data to port 50000. In a terminal on my local machine I run nc to connect to and print the data on the port. However, when using nc in terminal ...
2
votes
1answer
473 views
How to inspect decrypted TLS/SSL traffic in Wireshark from program not supporting SSLKEYLOGFILE?
TL;DR: I feel I'm pretty close to doing so by using sslsplit's interface mirroring, but I ran into an issue where the kernel is not replying to ARP requests that sslsplit is sending out on the ...
0
votes
1answer
190 views
Freshly installed Wireshark with enabled non-root listen users is not able to listen
I have Linux Mint 19 64-bit Cinnamon.
I have just installed wireshark-gtk with:
sudo apt-get install wireshark-gtk
while installing I was asked this:
Answering Yes as you can see, as I am the sole ...
1
vote
0answers
71 views
GUI for application with and without sudo
I was running wireshark when I realized that executing it using sudo and without sudo gave me a different user interface.
When running using sudo, it gives me nice sized icon and text. But running it ...
0
votes
1answer
1k views
How to trace snmp trap sent by client process?
We have a process(should be a client program) on RHEL 7.4 that send snmp traps to a Solaris server that has trap receiver process(should be a server program listening on 162/1691) on other machine(...
4
votes
1answer
2k views
How keyboard's drivers work on linux
I recently bought a new keyboard, it was cheap and of an unknown brand but i wasn't particularly worried. I found out that on linux pressing shift, super, left-ctrl or left-alt with this keyboard made ...
1
vote
2answers
1k views
Kali Linux Can't Log in as non-root user and wireshark complaining about root
When I opened wireshark (fresh install of live usb kali with persistence) for the first time it complained about me being root. This is what I found in googling it:
Yes it's recommended and ...
0
votes
1answer
258 views
“-qt=5 -version returned non-zero exit status” error when installing Wireshark
When I wanted to install Wireshark software from Source Code on Debian 8 Linux distro, I saw the following error messages:
...
...
checking for uic... /usr/bin/uic
checking for qtchooser... (cached) /...
2
votes
2answers
5k views
Incoming and outgoing traffic when NOTHING is running
In a system with nothing running (at least nothing I know of). Listening of incoming and outgoing traffic prints this output:
192.168.1.1 => all-systems.mcast.net 0b ...
0
votes
1answer
951 views
tshark filters in Centos 7
I am working on some tshark filters , need to split a pcap on timebasis for particular SIP and DIP, I have tried editcap but it can go with time basis only I cannot pass IPADDRESS to editcap, I saw ...
0
votes
0answers
23 views
Wireshark mute..why?
I have two host+one router
192.168.0.1 router
192.168.0.2 pc
192.168.0.5 macos
On pc i want to capture all packets of macos with wireshark
Interface on pc is bridged,br0
I put br0 in promisc mode ...
1
vote
1answer
472 views
can I configure SSH so it does not use encryption?
I have an ssh client connecting to an ssh server. I want to investigate what's going on between them, so I would like to dump the traffic with tcpdump and then analyze it with Wireshark. However, I ...
0
votes
2answers
772 views
See graph of text tcpdump
I saved some dump from tcpdump using
tcpdump -n -i eth0 -tttt -Q in > "dump01.dump"
so i got output like this:
20:39:12.808672 IP 94.xx.xxx.202.49183 > 151.xx.xx.xx.61479: UDP, length 104
20:...
16
votes
1answer
38k views
How to filter by host name in Wireshark?
Display filter in form ip.src_host eq my.host.name.com yields no matching packets, but there is traffic to and from this host.
DNS name is resolved successfully, and filters using ip addresses like ip....
1
vote
1answer
257 views
wireshark packet capture point [closed]
I am using tc qdisc to add delay to packets on my interface eth2 as follows
sudo tc qdisc add dev eth2 root netem delay 100ms 10ms 25%
Then I pinged a host and got some result. The results on the ...
19
votes
4answers
35k views
How to trace networking activity of a command?
I want to trace the networking activity of a command, I tried tcpdump and strace without success.
For an example, If I am installing a package or using any command that tries to reach some site, I ...
0
votes
1answer
3k views
Cannot use Monitor mode in Kali using TP-LINK TL-WN722N
I recently bought a TP-LINK TL-WN722N adapter that claims to support Monitor mode and captures any traffic using Wireshark. I tried using Monitor mode with the following commands in Kali Linux,
sudo ...
2
votes
2answers
4k views
How to choose a response for interactive prompt during installation from a shell script
I am writing a shell script to install all my required applications on my Ubuntu PC in one shot (while I can take a stroll or do something else). For most applications adding -y to the end of the apt-...
1
vote
1answer
774 views
TCP parameters SACK and Window scaling do not change on Ubuntu 16.04
I want to turn off SACK and window scaling options in TCP in Ubuntu 16.04 running in a VMware virtual machine on windows 10.
I am actually sending some packets through my Ubuntu to an embedded device ...
