Questions tagged [wireshark]

The tag has no usage guidance.

Filter by
Sorted by
Tagged with
0 votes
0 answers
18 views

find in tshark/wireshark tcp sessions with unique value in filter - ldap.attributes

I need to find in tshark/wireshark tcp sessions with an unique value in filter - ldap.attributes For example, in a picture In red - value from filter - ldap.attributes. Some filter in the dump can be ...
Mexanizm456's user avatar
0 votes
2 answers
24 views

Pinging two PCs and trying to capture ICMPs with third PC

I have a setup of three computers that are all on the same subnet and connected to a switch. All services are reachable. I'm pinging from PC(1) to PC(2). Opening tshark with PC(3) but cannot see ...
ptiza_v_nebe's user avatar
0 votes
0 answers
51 views

replace hex value to random hex value with the same length in pcap file

I need to replace hex value to random hex value with the same length in pcap file. I work in debian 10 in bash. I have pcap file for example with this tcp payload in some packets: I want to replace ...
Mexanizm456's user avatar
0 votes
0 answers
29 views

tcpdump: how to see source and destination of HE_MU packets?

I'm currently testing a router and trying to capture HE_MU packets. For this I have a setup with 5 end-user devices and a device that acts as a packet sniffer and also hosts iperf3 servers. I put ...
Shafigh's user avatar
1 vote
0 answers
36 views

TCPDUMP Missing response Code header in Back to back execution

I am running two TCPDUMP Commands back to back. Here is the sequence Run the below command root@open5Gs:/home/test# tcpdump -l -vvv -s0 -i any -B 4096 -nn -w /home/test/tc060.pcap -c 1500 Execute ...
Sayantan_Dell's user avatar
0 votes
0 answers
112 views

How to show packet ingress/egress direction with wireshark/tshark?

I am diagnosing traffic through a Linux router. I regularly use the tshark with the options -T fields and -e frame.interface_name to see from which interface each frame was captured. This information ...
JohnM's user avatar
  • 1
1 vote
1 answer
147 views

Can `tcpdump ether host` filter with a mask to get, for example, hosts with a specific OUI?

I'm trying to filter traffic by src ether host to see all devices with a specific MAC prefix. If this were like IP, it might filter with src ether host aa:bb:cc:00:00:00/24 to see OUI's matching aa:...
KJ7LNW's user avatar
  • 273
1 vote
0 answers
52 views

How to capture SATA traffic under Linux?

Using usbmon it's possible to capture USB traffic in Wireshark. I want to do the same for SATA. Is it possible? If it is not possible in Wireshark directly it would be nice to later open the capture ...
zomega's user avatar
  • 843
1 vote
1 answer
55 views

GeoIP not working when processing PCAP with tshark as su

I am working with lots of PCAP files and trying to convert them into .tsv files for tabular analysis. So I'm using tshark in a Ubuntu 22 VirtualBox machine to dissect each packet. I have a bash ...
CopyOfA's user avatar
  • 113
1 vote
1 answer
261 views

How do I generate a Snort pcap file?

I am new to using snort and still learning in university. I am wondering after I find an intrusion how can I log it and save it as a pcap file? What would the syntax look like to do this? So I can ...
Albion69's user avatar
0 votes
0 answers
59 views

How to sniff in/out packets of a Windows 10 VM from Kali host?

When I created a Windows 10 vm inside of a Windows 10 host, a device was automatically created for it that I could monitor with Wireshark and see only the traffic going in and out of that VM. I ...
Ego's user avatar
  • 3
0 votes
1 answer
92 views

Wi-Fi DHCP debugging for cell phone needed

Every then and now, my android cell phone cannot connect to my Wi-Fi and says: unable to obtain IP address. After some time (sometimes minutes, sometimes hours) connection is back to normal. This is ...
Reinhard Mayr's user avatar
2 votes
0 answers
118 views

Issues with AP and station mode simultaneously on a AP-STA wifi module

I have an iMX8MP board running Linux. The board is equipped with a Wifi module with AP-STA capability. I want this system to start an access point at boot and to connect to an external wifi once the ...
firion's user avatar
  • 149
0 votes
1 answer
128 views

Can't decrypt https traffic with wireshark

I am trying to decrypt https traffic according to these guides: https://linuxhint.com/decrypt-ssl-tls-wireshark/ https://www.comparitech.com/net-admin/decrypt-ssl-with-wireshark/ But nothing is ...
Алекс Шевцов's user avatar
0 votes
0 answers
140 views

TCP packet excess delay

I am sending packets of known length from client (63396) to server (50001) frameTime 1659456858651175 frameSeq: 0 Packets 1 bytes 23425 frameTime 1659456858667639 frameSeq: 1 Packets 1 bytes 19556 ...
Avishek Banerjee's user avatar
0 votes
0 answers
238 views

How do I bridge an ethernet device to the wireless network interface from within a VirtualBox Ubuntu 20.04 LTS VM?

I have a VirtualBox Ubuntu VM, the "VM", set up on my primary Windows machine, using bridged VirtualBox connections to the wireless interface and the ethernet port (i.e. Ethernet <-> ...
UrsTemp's user avatar
0 votes
1 answer
39 views

Sending all lan traffic to monitor PC

I setup a Windows Server 2022 PC to monitor all LAN traffic. I have the computer connected by Ethernet to the monitor PC and have this as a Firewall script for my DD-wrt router: iptables -t mangle -A ...
SomethingsGottaGive's user avatar
0 votes
1 answer
228 views

Wireshark blocking the WiFi

I'm on Arch Linux installed on a Macbook Air. WiFi runs just fine. But whenever I start to capture network on the WiFi Card on Wireshark, it just suddenly stops working. Pinging google replies "...
Kyi Zet's user avatar
  • 11
2 votes
1 answer
802 views

Capture DNS traffic to and from a network namespace using tshark

How can I capture traffic specifically from a network interface inside a network namespace using tshark? In my case, the network interface tun0 is moved into the network namespace called vpn. Normally ...
EarthIsHome's user avatar
1 vote
1 answer
176 views

-Y and read {src,dst} port and tshark

tshark get data from interface or pcap files. When it read data from interface, user has to write filter with -f (accortding to pcap-filter(7)) and when read from file user has to write filter with -Y ...
PersianGulf's user avatar
  • 10.7k
1 vote
1 answer
739 views

how to modify pcap file for Additional Information in packet

I have one Pcap File which consist of Some Information. I need to modify the data in the file. Example: As you can see There are details of packets and in Additional Record section I have TXT value ...
Amogh Saxena - REXTER's user avatar
1 vote
1 answer
480 views

Is it possible to detect if a Router WPS button has been pressed or not by just passively monitoring traffic?

I mean you could check if the wps button has been pressed or not using this command wpa_cli wps_pbc But i am wondering if it's possible to do it using airodump-ng Without any one connecting to it. ...
mina nageh's user avatar
1 vote
0 answers
32 views

Unable to capture node-to-node traffic in a wireless access point

I have created a wireless access point on ubuntu and I have written a program that parses network traffic obtained via tshark and condenses it into a readable form. I am able to capture traffic going ...
Abhinav Gupta's user avatar
0 votes
1 answer
408 views

Understanding ACK numbers

I try to understand the reason of unordered ACK numbers. I have the following logs in wireshark: 34936 → 80 [SYN] Seq=0 Win=64240 Len=0 MSS=1460 SACK_PERM=1 TSval=3595656117 TSecr=0 WS=128 2 0....
Tina's user avatar
  • 84
1 vote
2 answers
517 views

How can i aggregate all txt file with one command for cracking?

I wanted to find passphrase from .cap file and .txt file (Password Dictionary). But I have too many .txt file's there. Can I use those file one by one for cracking? My command is given below: I tried ...
Robi's user avatar
  • 11
0 votes
1 answer
201 views

unable to start wireshark

I have a system that runs ARCO linux (Arch based). I've used it to run wireshark just fine previously. I then wanted to use an older version of wireshark, and went and got the sources for wireshark-2....
stdcerr's user avatar
  • 2,037
1 vote
1 answer
759 views

How to use a network interface as read-only?

I have a switch in my home lab that I want to run some experiments with, especially with regards to VLANs and some other protocols that I want to better understand. Now, this switch (a TP-Link 5-port ...
mh166's user avatar
  • 111
0 votes
0 answers
922 views

tcpdump to perform wireless capture with advanced filters

I’m trying to use tcpdump to perform realtime wireless captures (without the option to save the file) on a MAC. My wireless interface is en0. I want to use similar filters as I would in Wireshark. My ...
wiwinut's user avatar
  • 57
0 votes
0 answers
40 views

scan specific udp port for local network

So I have a Prometheus server which I use to capture input from port 512 UDP, I have it open, but now I have a problem checking which 512 UDP port on my network is the sender. I tried reading the nmap ...
Vikri Usman Rizky's user avatar
2 votes
1 answer
2k views

How to change color of options in Wireshark in Kali linux?

I am using wireshark in kali linux and all the options are coming out in white. I am not able to read a single thing, Is there any way to change this? I have tried and search the internet for past ...
Turing101's user avatar
  • 147
1 vote
1 answer
1k views

missing TLS protocol in wireshark preferences

I've installed wireshark on Centos 7.9.2009 however I don't find TLS on the protocols list in preferences settings. Is it something missing to be installed yet or the wireshark version available on ...
Chris's user avatar
  • 3,691
1 vote
1 answer
2k views

Why is HAProxy forwarding HTTP2 requests as HTTP 1.1?

I'm trying to configure a load balancer between 2 servers with HAPoxy, this is my configuration: frontend haproxynode bind *:443 ssl crt /etc/ssl/private/isel.pem alpn h2,http/1.1 mode tcp ...
Rodrigo Pina's user avatar
-1 votes
1 answer
4k views

Determine the PID of a process that is calling out to an IP

My wifi card is tryign to make a connection to a seemingly random IP address on the local network. I want to find which process on the client is trying to make this connection to determine why. This ...
Root James's user avatar
0 votes
1 answer
420 views

CORE and Wireshark

I use the CORE network emulator. I try to run Wireshark on one of the nodes via the terminal, but I get this error: QStandardPaths: XDG_RUNTIME_DIR not set, defaulting to '/tmp/runtime-root' qt.qpa....
V. Gai's user avatar
  • 101
0 votes
1 answer
718 views

Macos with Virtualbox and Wireshark on LAN network

I have a virtual machine on a macos, within that virtual machine I have a Debian distribution and I want to use Wireshark to capture all the traffic from the lan network, from virtualbox. I have ...
Adrián Pol's user avatar
0 votes
1 answer
638 views

Wireshark can't see the dropped packets by iptables

I'm running wireshark(2.6.8) and iptables(v1.8.2 nf_tables) instances on my computer. I saw that others can see the dropped packets with wireshark: How can Wireshark see packets dropped by iptables? ...
user426506's user avatar
4 votes
0 answers
321 views

Is there a command like `time` that monitors the network traffic of commands?

I can use the time command to measure the time some command takes: time node -e "" node -e "" 0.06s user 0.01s system 92% cpu 0.076 total Is there a similar way to measure a ...
HappyFace's user avatar
  • 1,493
1 vote
1 answer
495 views

Using tcpdump to trace IP of strangers(predators) on omegle

I am using tcpdump to capture packets while being on omegle. However, I have been fairly unsuccessful to get strangers IP. All the IP I see are traced back to either 172...* which is for google 104....
atheros's user avatar
  • 256
0 votes
0 answers
130 views

Why do I get an error when setting monitor mode if the interface is monitor mode capable?

I have these features on my system: iw list Wiphy phy4 max # scan SSIDs: 10 max scan IEs length: 255 bytes max # sched scan SSIDs: 0 max # match sets: 0 max # scan plans: 1 ...
itd's user avatar
  • 101
1 vote
1 answer
430 views

How to find min, max data rate of pcap file

I have pcap file and I want to find min and max data rate. I use Capinfos, it shows only average data rate. I would ask how to do that?
Jess Brown's user avatar
0 votes
1 answer
347 views

CLI Utility to see the http requests that'll be made by a command

I have a script which invokes some library code that makes some HTTP and HTTPS requests, let's call it script.sh Is there a command which would look like some-wireshark-type-utility ./script.sh and ...
Peeyush Kushwaha's user avatar
1 vote
1 answer
1k views

No such file or directory: /sys/kernel/debug/usb/usbmon/

I am trying to install wiresahrk on my linux mint 19.2 machine. When executing as root it says: The capture session could not be initiated on interface 'usbmon1' (Can't open USB bus file /sys/kernel/...
Niwla23's user avatar
  • 23
0 votes
1 answer
2k views

Why is a packet is not sent until ACK is received when window size is sufficient

The considered application (server) has a number of clients connected. It processes each message from the client and sends two output messages. The output messages are generated sequencially and ...
PasanW's user avatar
  • 111
1 vote
0 answers
186 views

I need to install Wireshark on my CentOS VM

I used the following commands to install the tool: $ yum install gcc gcc-c++ bison flex libpcap-devel qt-devel gtk3-devel rpm-build libtool c-ares-devel qt5-qtbase-devel qt5-qtmultimedia-devel qt5-...
user11702296's user avatar
0 votes
1 answer
63 views

Repeat Tshark command when first done

I have this command that i need to repeat for ever till i stop it. I have to send a capture to my supplier for VOIP support for a intermitent trouble. But 10mb is taking like five minutes to complete....
Orizon Mobile's user avatar
5 votes
2 answers
2k views

Tc qdisc delay not seen in tcpdump recording

I have two linux containers connected with a veth-pair. At veth-interface of one container I set up tc qdisc netem delay and send traffic from it to the other container. If I watch traffic on both ...
JenyaKh's user avatar
  • 304
2 votes
0 answers
121 views

Ctrl, Alt, and Super behave like Left Shift and I fixed it in a strange way

I use Arch Linux. I have Qumo Axe keyboard which as it turned out works only on Windows. On Linux, the bottom row keys (Ctrl, Alt, Super) behave like Left Shift, I tried to install drivers which I ...
TaPO4eg3D's user avatar
1 vote
1 answer
3k views

How to disable network-connectivity-check on linux mint?

(Virtualbox OS: Linux Mint 19.1 Tessa) I am trying to disable the network-connectivity-check on Linux Mint. This website shows how to disable it in the GUI for Ubuntu 17.10. Unfortunately in Mint ...
PatrickSteiner's user avatar
0 votes
1 answer
3k views

Cannot disable network time control (NTP)

I want to analyze some protocols (ARP, NDP, etc.) inside virtualbox (OS: Linux Mint 19.1 Tessa) using wireshark and tried to disable the "network time control"-synchronization. yuza@VirtualBox:~$ ...
PatrickSteiner's user avatar
6 votes
2 answers
10k views

How to capture WOL packets?

I used sudo tcpdump -v -i eth0 ether proto 0x0842 or udp port 9 but didn't see anything when WakeMeOnLan from NirSoft wakes the computer. The same with Wireshark
Dims's user avatar
  • 3,191