Questions tagged [wireshark]
The wireshark tag has no usage guidance.
87
questions
0
votes
1answer
18 views
CLI Utility to see the http requests that'll be made by a command
I have a script which invokes some library code that makes some HTTP and HTTPS requests, let's call it script.sh
Is there a command which would look like some-wireshark-type-utility ./script.sh and ...
0
votes
0answers
6 views
Sniffing to Signal Coming From a Controller to Raspberry Pi
I am working on a project on Raspberry Pi to send commands to a controller. I am using ttyUSB0 port of the Rpi with RS485 to communicate with controller. Normally, there is a dos program which does ...
0
votes
1answer
118 views
No such file or directory: /sys/kernel/debug/usb/usbmon/
I am trying to install wiresahrk on my linux mint 19.2 machine.
When executing as root it says:
The capture session could not be initiated on interface 'usbmon1' (Can't open USB bus file /sys/kernel/...
0
votes
1answer
65 views
Why is a packet is not sent until ACK is received when window size is sufficient
The considered application (server) has a number of clients connected. It processes each message from the client and sends two output messages. The output messages are generated sequencially and ...
1
vote
0answers
18 views
I need to install Wireshark on my CentOS VM
I used the following commands to install the tool:
$ yum install gcc gcc-c++ bison flex libpcap-devel qt-devel gtk3-devel rpm-build libtool c-ares-devel qt5-qtbase-devel qt5-qtmultimedia-devel qt5-...
0
votes
1answer
24 views
Repeat Tshark command when first done
I have this command that i need to repeat for ever till i stop it.
I have to send a capture to my supplier for VOIP support for a intermitent trouble.
But 10mb is taking like five minutes to complete....
2
votes
2answers
301 views
Tc qdisc delay not seen in tcpdump recording
I have two linux containers connected with a veth-pair. At veth-interface of one container I set up tc qdisc netem delay and send traffic from it to the other container. If I watch traffic on both ...
2
votes
0answers
42 views
Ctrl, Alt, and Super behave like Left Shift and I fixed it in a strange way
I use Arch Linux. I have Qumo Axe keyboard which as it turned out works only on Windows. On Linux, the bottom row keys (Ctrl, Alt, Super) behave like Left Shift, I tried to install drivers which I ...
0
votes
1answer
620 views
How to disable network-connectivity-check on linux mint?
(Virtualbox OS: Linux Mint 19.1 Tessa)
I am trying to disable the network-connectivity-check on Linux Mint.
This website shows how to disable it in the GUI for Ubuntu 17.10.
Unfortunately in Mint ...
0
votes
1answer
165 views
Cannot disable network time control (NTP)
I want to analyze some protocols (ARP, NDP, etc.) inside virtualbox (OS: Linux Mint 19.1 Tessa) using wireshark and tried to disable the "network time control"-synchronization.
yuza@VirtualBox:~$ ...
0
votes
0answers
14 views
Is it possible to print detailed info for specific field in tshark?
Is it possible to view detailed info like for example tshark -i eth0 -f "dst port 53" -n -V shows for certain field only? I tried with for example tshark -i eth0 -f "dst port 53" -n -T fields -e dns....
0
votes
0answers
32 views
Is there a way to find NetEm delay selected when using distribution table?
I am trying to find how much each packets are delayed when it is passed through NetEm from one PC to another via an ethernet cable. At the moment I am using Wireshark to find delay experienced by each ...
2
votes
2answers
980 views
How to capture WOL packets?
I used
sudo tcpdump -v -i eth0 ether proto 0x0842 or udp port 9
but didn't see anything when WakeMeOnLan from NirSoft wakes the computer.
The same with Wireshark
0
votes
1answer
40 views
Wireshark not showing HTTP queries
I am trying to using Wireshark, but when I set filter into http Wireshark not displaying any data.
Unfortunately, I can see only tcp/dhcp/arp protocols, but not http:
My Wireshark preferences:
I ...
1
vote
1answer
287 views
How to filter wireshark output data to only view ttyUSB0 data?
I'm Using Wireshark on Ubuntu 18.04 to monitor my ttyUSB0 USB port output as I'm developing something that requires that. On the website, I found how to get it to sniff USB ports but the output is ...
0
votes
1answer
139 views
possible packet loss
I have a program running on my local machine that prints data to port 50000. In a terminal on my local machine I run nc to connect to and print the data on the port. However, when using nc in terminal ...
1
vote
1answer
240 views
How to inspect decrypted TLS/SSL traffic in Wireshark from program not supporting SSLKEYLOGFILE?
TL;DR: I feel I'm pretty close to doing so by using sslsplit's interface mirroring, but I ran into an issue where the kernel is not replying to ARP requests that sslsplit is sending out on the ...
0
votes
1answer
88 views
Freshly installed Wireshark with enabled non-root listen users is not able to listen
I have Linux Mint 19 64-bit Cinnamon.
I have just installed wireshark-gtk with:
sudo apt-get install wireshark-gtk
while installing I was asked this:
Answering Yes as you can see, as I am the sole ...
1
vote
0answers
51 views
GUI for application with and without sudo
I was running wireshark when I realized that executing it using sudo and without sudo gave me a different user interface.
When running using sudo, it gives me nice sized icon and text. But running it ...
0
votes
1answer
636 views
How to trace snmp trap sent by client process?
We have a process(should be a client program) on RHEL 7.4 that send snmp traps to a Solaris server that has trap receiver process(should be a server program listening on 162/1691) on other machine(...
3
votes
1answer
536 views
How keyboard's drivers work on linux
I recently bought a new keyboard, it was cheap and of an unknown brand but i wasn't particularly worried. I found out that on linux pressing shift, super, left-ctrl or left-alt with this keyboard made ...
1
vote
2answers
879 views
Kali Linux Can't Log in as non-root user and wireshark complaining about root
When I opened wireshark (fresh install of live usb kali with persistence) for the first time it complained about me being root. This is what I found in googling it:
Yes it's recommended and ...
0
votes
1answer
220 views
“-qt=5 -version returned non-zero exit status” error when installing Wireshark
When I wanted to install Wireshark software from Source Code on Debian 8 Linux distro, I saw the following error messages:
...
...
checking for uic... /usr/bin/uic
checking for qtchooser... (cached) /...
2
votes
2answers
2k views
Incoming and outgoing traffic when NOTHING is running
In a system with nothing running (at least nothing I know of). Listening of incoming and outgoing traffic prints this output:
192.168.1.1 => all-systems.mcast.net 0b ...
0
votes
1answer
829 views
tshark filters in Centos 7
I am working on some tshark filters , need to split a pcap on timebasis for particular SIP and DIP, I have tried editcap but it can go with time basis only I cannot pass IPADDRESS to editcap, I saw ...
0
votes
0answers
21 views
Wireshark mute..why?
I have two host+one router
192.168.0.1 router
192.168.0.2 pc
192.168.0.5 macos
On pc i want to capture all packets of macos with wireshark
Interface on pc is bridged,br0
I put br0 in promisc mode ...
1
vote
1answer
238 views
can I configure SSH so it does not use encryption?
I have an ssh client connecting to an ssh server. I want to investigate what's going on between them, so I would like to dump the traffic with tcpdump and then analyze it with Wireshark. However, I ...
0
votes
2answers
529 views
See graph of text tcpdump
I saved some dump from tcpdump using
tcpdump -n -i eth0 -tttt -Q in > "dump01.dump"
so i got output like this:
20:39:12.808672 IP 94.xx.xxx.202.49183 > 151.xx.xx.xx.61479: UDP, length 104
20:...
12
votes
1answer
24k views
How to filter by host name in Wireshark?
Display filter in form ip.src_host eq my.host.name.com yields no matching packets, but there is traffic to and from this host.
DNS name is resolved successfully, and filters using ip addresses like ip....
1
vote
1answer
175 views
wireshark packet capture point [closed]
I am using tc qdisc to add delay to packets on my interface eth2 as follows
sudo tc qdisc add dev eth2 root netem delay 100ms 10ms 25%
Then I pinged a host and got some result. The results on the ...
13
votes
4answers
21k views
How to trace networking activity of a command?
I want to trace the networking activity of a command, I tried tcpdump and strace without success.
For an example, If I am installing a package or using any command that tries to reach some site, I ...
0
votes
1answer
2k views
Cannot use Monitor mode in Kali using TP-LINK TL-WN722N
I recently bought a TP-LINK TL-WN722N adapter that claims to support Monitor mode and captures any traffic using Wireshark. I tried using Monitor mode with the following commands in Kali Linux,
sudo ...
1
vote
2answers
3k views
How to choose a response for interactive prompt during installation from a shell script
I am writing a shell script to install all my required applications on my Ubuntu PC in one shot (while I can take a stroll or do something else). For most applications adding -y to the end of the apt-...
1
vote
1answer
666 views
TCP parameters SACK and Window scaling do not change on Ubuntu 16.04
I want to turn off SACK and window scaling options in TCP in Ubuntu 16.04 running in a VMware virtual machine on windows 10.
I am actually sending some packets through my Ubuntu to an embedded device ...
2
votes
1answer
182 views
Can I restrict Wireshark to only work with a specific interface
I have a user who is running a package call mininet to simulate networks on the loopback interface. They will likely need to use Wireshark to debug these virtual networks they create. However we have ...
3
votes
1answer
930 views
Wireshark: Remote capture over UART
TL;DR: How to pipe properly over UART the output of a remote tcpdump to a local wireshark ?
I try to capture packets that flow through an embedded device to which I don't have the ability to install ...
1
vote
0answers
664 views
tcpdump: Show even invalid ethernet packets
I'm attempting to debug a hardware issue where an embedded board transmits seemingly faulty ethernet packets.
I connected the embedded board to a debugging machine's ethernet port to listen to the ...
1
vote
0answers
1k views
How to capture http requests headers and body
I need to capture all incoming/outcoming http traffic of a unix machine, and then run a script on each http header/body.
I have found that tcpdump captures all the requests, but big ones end up being ...
0
votes
1answer
298 views
Why can't find which program is using port 1080?
To open wireshark and select interfaces lo,here is graph captured all packages between port 1080 and others in 127.0.0.1.
1.Why the number of other ports in 127.0.0.1 is always increasing?
The port ...
2
votes
0answers
760 views
How to filter pcap files using tshark
I have to extract data transfered (download, upload) for some specific sites using tshark. Let say, I want to find data downloaded from www.google.com. What fields should I specify in tshark fields ...
1
vote
2answers
82 views
unknown / unauthorized usage of my bandwidth
I currently need to work on 3g internet, so i really want to optimize the usage of my slow bandwidth.
But some things are happening against my will, like this one : (use ~50kB/s without asking)
GET /...
-2
votes
1answer
2k views
Can't install Gpart in Kali Linux 2.0
When I ran apt-get install gpart, I got the following message:
apt-get install gpart
Reading package lists... Done
Building dependency tree
Reading state information... Done
You might want to ...
1
vote
1answer
1k views
How to follow tcp streams continuously along the capture with tshark / wireshark?
I display the TCP stream of an already finished capture written in out.pcap with
END=$(tshark -r out.pcap -T fields -e tcp.stream | sort -n | tail -1);
for ((i=0;i<=END;i++));
do
echo $i; tshark ...
1
vote
0answers
67 views
How to open a changing file with wireshark?
Given a pcap file that is being created in the background, e.g
tshark -w out.pcap > /dev/null &
How can I open the changing file with wireshark
wireshark -r out.pcap
Does nont work
3
votes
2answers
63 views
Get public IPs of accessed webpages?
I would like to be able to get the public IPs of the websites I am accessing with my PC in a way such as:
www.google.es - public IP1
www.cdn.facebook.com - public IP2
and so on. I think this ...
4
votes
2answers
301 views
How to gradually encrypt the tshark output file along the capture?
In order to secure a packet capture, which method would you use to make all (or close to all) past captured packet utterly unaccessible unless a given password is given.
My habbits are
to mount an ...
-2
votes
1answer
87 views
Wireshark - Facebook Account [closed]
Someone use Wireshark software, if he browse on the internet from home (using the same router) and I'm also at home, is he able to find the password of my Facebook account? I think I'm using the TCP ...
1
vote
1answer
207 views
wireshark how do I filter for items not in an array?
the syntax;
tcp.port in {80 443 8080}
works great for filtering ports, but;
tcp.port not in {80 443 8080}
doesn't seem to be valid.
UPDATE:
how dumb am i...
not tcp.port in {80 443 8080}
this ...
1
vote
1answer
692 views
how to get list of sites/domains linked to in wireshark
I have been trying to figure out how many sites does firefox connect wth and for that have been using wireshark. What I have done is made a new profile and whenever I run firefox in the browser it is ...
1
vote
1answer
1k views
Server solution, forwarding HTTP traffic
I'm looking for a solution to redirect GET/POST HTTP requests on a server.
The easy part would be port translation and hostname redirection (HTTP 3xx redirection):
When my server in a DMZ receives ...
