Questions tagged [wireshark]
The wireshark tag has no usage guidance.
98
questions
0
votes
1answer
29 views
Macos with Virtualbox and Wireshark on LAN network
I have a virtual machine on a macos, within that virtual machine I have a Debian distribution and I want to use Wireshark to capture all the traffic from the lan network, from virtualbox. I have ...
0
votes
0answers
16 views
wireshark how to capture 802.11 packets Debian kernel 5.7 wifi intel wireless-AC 9560
I am using a Intel Corporation Wireless-AC 9560 [Jefferson Peak] (rev 10) Wifi chipset with driver iwlwifi.
When on monitor mode, with airodump-ng, i can capture packets and get their 802.11 headers ...
0
votes
0answers
36 views
Can I sniff packets on a host interface macvtap through a guest OS on QEMU/KVM?
I have a RHEL server (host) with 4 VMs. One of those VMs is Windows 10 with Wireshark. I want to use Wireshark to sniff packets going over one of the server's ethernet ports, lets call it enp2s0f2.
In ...
0
votes
1answer
36 views
Wireshark can't see the dropped packets by iptables
I'm running wireshark(2.6.8) and iptables(v1.8.2 nf_tables) instances on my computer. I saw that others can see the dropped packets with wireshark:
How can Wireshark see packets dropped by iptables?
...
4
votes
0answers
38 views
Is there a command like `time` that monitors the network traffic of commands?
I can use the time command to measure the time some command takes:
time node -e ""
node -e "" 0.06s user 0.01s system 92% cpu 0.076 total
Is there a similar way to measure a ...
1
vote
1answer
85 views
Using tcpdump to trace IP of strangers(predators) on omegle
I am using tcpdump to capture packets while being on omegle. However, I have been fairly unsuccessful to get strangers IP. All the IP I see are traced back to either 172...* which is for google 104....
0
votes
0answers
26 views
Why do I get an error when setting monitor mode if the interface is monitor mode capable?
I have these features on my system:
iw list
Wiphy phy4
max # scan SSIDs: 10
max scan IEs length: 255 bytes
max # sched scan SSIDs: 0
max # match sets: 0
max # scan plans: 1
...
0
votes
0answers
125 views
Bluetooth headset does not autoconnect (Ubuntu)
My Bluedio T4 headset does not automatically connect in Ubuntu Linux 20.04 LTS
The device is Trusted and is enabled in PulseAudio /etc/pulse/default.pa.
Using Wireshark I can see it's connected ...
0
votes
0answers
33 views
Wireshark wlan0mon doesn't catch packages
I've activated wlan0 in monitor mode but in wireshark it doesn't catch any packages.
It says only wlan0mon no addresses , no capture filters
sudo airmon-ng start wlan0
PHY Interface Driver ...
0
votes
0answers
31 views
Iptables not rewriting all packets
I would like to rewrite the srcaddr of all packets that is going out from an interface. I have the following topoly:
Client --- Server --- Website
201.70.145.218 10.221.201....
0
votes
0answers
31 views
How to use TCPREPLAY to decrypt a PCAPNG file?
I have a pcapng (wireshark) file encrypted with cryptcat. I also have the password. Just not sure how to decipher the packet.
The following pcapng:
Source IP - 172.16.0.37 Port Source - 40986
...
0
votes
0answers
23 views
How to find min, max data rate of pcap file
I have pcap file and I want to find min and max data rate.
I use Capinfos, it shows only average data rate. I would ask how to do that?
0
votes
0answers
49 views
Library loading works differently between 2 machines, what's the core difference?
Big picture stuff
We want to migrate a project from CentOS7 to CentOS8. One of the things we use is wireshark, more specifically tshark 2.6.6, and need lua support. As no 2.6 is available in official ...
0
votes
1answer
34 views
CLI Utility to see the http requests that'll be made by a command
I have a script which invokes some library code that makes some HTTP and HTTPS requests, let's call it script.sh
Is there a command which would look like some-wireshark-type-utility ./script.sh and ...
0
votes
0answers
7 views
Sniffing to Signal Coming From a Controller to Raspberry Pi
I am working on a project on Raspberry Pi to send commands to a controller. I am using ttyUSB0 port of the Rpi with RS485 to communicate with controller. Normally, there is a dos program which does ...
1
vote
1answer
352 views
No such file or directory: /sys/kernel/debug/usb/usbmon/
I am trying to install wiresahrk on my linux mint 19.2 machine.
When executing as root it says:
The capture session could not be initiated on interface 'usbmon1' (Can't open USB bus file /sys/kernel/...
0
votes
1answer
182 views
Why is a packet is not sent until ACK is received when window size is sufficient
The considered application (server) has a number of clients connected. It processes each message from the client and sends two output messages. The output messages are generated sequencially and ...
1
vote
0answers
22 views
I need to install Wireshark on my CentOS VM
I used the following commands to install the tool:
$ yum install gcc gcc-c++ bison flex libpcap-devel qt-devel gtk3-devel rpm-build libtool c-ares-devel qt5-qtbase-devel qt5-qtmultimedia-devel qt5-...
0
votes
1answer
28 views
Repeat Tshark command when first done
I have this command that i need to repeat for ever till i stop it.
I have to send a capture to my supplier for VOIP support for a intermitent trouble.
But 10mb is taking like five minutes to complete....
2
votes
2answers
569 views
Tc qdisc delay not seen in tcpdump recording
I have two linux containers connected with a veth-pair. At veth-interface of one container I set up tc qdisc netem delay and send traffic from it to the other container. If I watch traffic on both ...
2
votes
0answers
47 views
Ctrl, Alt, and Super behave like Left Shift and I fixed it in a strange way
I use Arch Linux. I have Qumo Axe keyboard which as it turned out works only on Windows. On Linux, the bottom row keys (Ctrl, Alt, Super) behave like Left Shift, I tried to install drivers which I ...
0
votes
1answer
1k views
How to disable network-connectivity-check on linux mint?
(Virtualbox OS: Linux Mint 19.1 Tessa)
I am trying to disable the network-connectivity-check on Linux Mint.
This website shows how to disable it in the GUI for Ubuntu 17.10.
Unfortunately in Mint ...
0
votes
1answer
510 views
Cannot disable network time control (NTP)
I want to analyze some protocols (ARP, NDP, etc.) inside virtualbox (OS: Linux Mint 19.1 Tessa) using wireshark and tried to disable the "network time control"-synchronization.
yuza@VirtualBox:~$ ...
2
votes
2answers
2k views
How to capture WOL packets?
I used
sudo tcpdump -v -i eth0 ether proto 0x0842 or udp port 9
but didn't see anything when WakeMeOnLan from NirSoft wakes the computer.
The same with Wireshark
0
votes
1answer
101 views
Wireshark not showing HTTP queries
I am trying to using Wireshark, but when I set filter into http Wireshark not displaying any data.
Unfortunately, I can see only tcp/dhcp/arp protocols, but not http:
My Wireshark preferences:
I ...
1
vote
1answer
477 views
How to filter wireshark output data to only view ttyUSB0 data?
I'm Using Wireshark on Ubuntu 18.04 to monitor my ttyUSB0 USB port output as I'm developing something that requires that. On the website, I found how to get it to sniff USB ports but the output is ...
0
votes
1answer
145 views
possible packet loss
I have a program running on my local machine that prints data to port 50000. In a terminal on my local machine I run nc to connect to and print the data on the port. However, when using nc in terminal ...
1
vote
1answer
369 views
How to inspect decrypted TLS/SSL traffic in Wireshark from program not supporting SSLKEYLOGFILE?
TL;DR: I feel I'm pretty close to doing so by using sslsplit's interface mirroring, but I ran into an issue where the kernel is not replying to ARP requests that sslsplit is sending out on the ...
0
votes
1answer
120 views
Freshly installed Wireshark with enabled non-root listen users is not able to listen
I have Linux Mint 19 64-bit Cinnamon.
I have just installed wireshark-gtk with:
sudo apt-get install wireshark-gtk
while installing I was asked this:
Answering Yes as you can see, as I am the sole ...
1
vote
0answers
64 views
GUI for application with and without sudo
I was running wireshark when I realized that executing it using sudo and without sudo gave me a different user interface.
When running using sudo, it gives me nice sized icon and text. But running it ...
0
votes
1answer
829 views
How to trace snmp trap sent by client process?
We have a process(should be a client program) on RHEL 7.4 that send snmp traps to a Solaris server that has trap receiver process(should be a server program listening on 162/1691) on other machine(...
3
votes
1answer
1k views
How keyboard's drivers work on linux
I recently bought a new keyboard, it was cheap and of an unknown brand but i wasn't particularly worried. I found out that on linux pressing shift, super, left-ctrl or left-alt with this keyboard made ...
1
vote
2answers
1k views
Kali Linux Can't Log in as non-root user and wireshark complaining about root
When I opened wireshark (fresh install of live usb kali with persistence) for the first time it complained about me being root. This is what I found in googling it:
Yes it's recommended and ...
0
votes
1answer
236 views
“-qt=5 -version returned non-zero exit status” error when installing Wireshark
When I wanted to install Wireshark software from Source Code on Debian 8 Linux distro, I saw the following error messages:
...
...
checking for uic... /usr/bin/uic
checking for qtchooser... (cached) /...
2
votes
2answers
3k views
Incoming and outgoing traffic when NOTHING is running
In a system with nothing running (at least nothing I know of). Listening of incoming and outgoing traffic prints this output:
192.168.1.1 => all-systems.mcast.net 0b ...
0
votes
1answer
894 views
tshark filters in Centos 7
I am working on some tshark filters , need to split a pcap on timebasis for particular SIP and DIP, I have tried editcap but it can go with time basis only I cannot pass IPADDRESS to editcap, I saw ...
0
votes
0answers
22 views
Wireshark mute..why?
I have two host+one router
192.168.0.1 router
192.168.0.2 pc
192.168.0.5 macos
On pc i want to capture all packets of macos with wireshark
Interface on pc is bridged,br0
I put br0 in promisc mode ...
1
vote
1answer
363 views
can I configure SSH so it does not use encryption?
I have an ssh client connecting to an ssh server. I want to investigate what's going on between them, so I would like to dump the traffic with tcpdump and then analyze it with Wireshark. However, I ...
0
votes
2answers
640 views
See graph of text tcpdump
I saved some dump from tcpdump using
tcpdump -n -i eth0 -tttt -Q in > "dump01.dump"
so i got output like this:
20:39:12.808672 IP 94.xx.xxx.202.49183 > 151.xx.xx.xx.61479: UDP, length 104
20:...
14
votes
1answer
31k views
How to filter by host name in Wireshark?
Display filter in form ip.src_host eq my.host.name.com yields no matching packets, but there is traffic to and from this host.
DNS name is resolved successfully, and filters using ip addresses like ip....
1
vote
1answer
212 views
wireshark packet capture point [closed]
I am using tc qdisc to add delay to packets on my interface eth2 as follows
sudo tc qdisc add dev eth2 root netem delay 100ms 10ms 25%
Then I pinged a host and got some result. The results on the ...
18
votes
4answers
29k views
How to trace networking activity of a command?
I want to trace the networking activity of a command, I tried tcpdump and strace without success.
For an example, If I am installing a package or using any command that tries to reach some site, I ...
0
votes
1answer
3k views
Cannot use Monitor mode in Kali using TP-LINK TL-WN722N
I recently bought a TP-LINK TL-WN722N adapter that claims to support Monitor mode and captures any traffic using Wireshark. I tried using Monitor mode with the following commands in Kali Linux,
sudo ...
2
votes
2answers
4k views
How to choose a response for interactive prompt during installation from a shell script
I am writing a shell script to install all my required applications on my Ubuntu PC in one shot (while I can take a stroll or do something else). For most applications adding -y to the end of the apt-...
1
vote
1answer
716 views
TCP parameters SACK and Window scaling do not change on Ubuntu 16.04
I want to turn off SACK and window scaling options in TCP in Ubuntu 16.04 running in a VMware virtual machine on windows 10.
I am actually sending some packets through my Ubuntu to an embedded device ...
2
votes
1answer
244 views
Can I restrict Wireshark to only work with a specific interface
I have a user who is running a package call mininet to simulate networks on the loopback interface. They will likely need to use Wireshark to debug these virtual networks they create. However we have ...
3
votes
1answer
1k views
Wireshark: Remote capture over UART
TL;DR: How to pipe properly over UART the output of a remote tcpdump to a local wireshark ?
I try to capture packets that flow through an embedded device to which I don't have the ability to install ...
1
vote
0answers
856 views
tcpdump: Show even invalid ethernet packets
I'm attempting to debug a hardware issue where an embedded board transmits seemingly faulty ethernet packets.
I connected the embedded board to a debugging machine's ethernet port to listen to the ...
1
vote
0answers
2k views
How to capture http requests headers and body
I need to capture all incoming/outcoming http traffic of a unix machine, and then run a script on each http header/body.
I have found that tcpdump captures all the requests, but big ones end up being ...
0
votes
1answer
364 views
Why can't find which program is using port 1080?
To open wireshark and select interfaces lo,here is graph captured all packages between port 1080 and others in 127.0.0.1.
1.Why the number of other ports in 127.0.0.1 is always increasing?
The port ...
