Questions tagged [wireshark]
The wireshark tag has no usage guidance.
108
questions
0
votes
0
answers
6
views
Reassembling fragments in PCAP file
We have PCAP files with long and heavily fragmented datagrams. We want to read them in Python but that avenue may not work out due to lack of PCAP reassembly support in feasible libraries. Our ...
- 582
0
votes
1
answer
36
views
Wireshark blocking the WiFi
I'm on Arch Linux installed on a Macbook Air. WiFi runs just fine. But whenever I start to capture network on the WiFi Card on Wireshark, it just suddenly stops working. Pinging google replies "...
- 11
2
votes
1
answer
68
views
Capture DNS traffic to and from a network namespace using tshark
How can I capture traffic specifically from a network interface inside a network namespace using tshark? In my case, the network interface tun0 is moved into the network namespace called vpn.
Normally ...
- 181
0
votes
0
answers
18
views
-Y and read {src,dst} port and tshark
tshark get data from interface or pcap files. When it read data from interface, user has to write filter with -f (accortding to pcap-filter(7)) and when read from file user has to write filter with -Y ...
- 10.2k
1
vote
1
answer
54
views
how to modify pcap file for Additional Information in packet
I have one Pcap File which consist of Some Information.
I need to modify the data in the file.
Example:
As you can see There are details of packets and in Additional Record section I have TXT value ...
1
vote
1
answer
97
views
Is it possible to detect if a Router WPS button has been pressed or not by just passively monitoring traffic?
I mean you could check if the wps button has been pressed or not using this command
wpa_cli wps_pbc
But i am wondering if it's possible to do it using airodump-ng
Without any one connecting to it.
...
- 131
1
vote
0
answers
28
views
Unable to capture node-to-node traffic in a wireless access point
I have created a wireless access point on ubuntu and I have written a program that parses network traffic obtained via tshark and condenses it into a readable form. I am able to capture traffic going ...
0
votes
0
answers
16
views
can mergecap be modified to allow listing the source files?
I realize mergecap is relatively old. I checked the mergecap docs page, googled, etc., and do not see any mention of a mergecap capability that I believe would be beneficial.
When we mergecap, we ...
- 1
0
votes
1
answer
51
views
Understanding ACK numbers
I try to understand the reason of unordered ACK numbers. I have the following logs in wireshark:
34936 → 80 [SYN] Seq=0 Win=64240 Len=0 MSS=1460 SACK_PERM=1 TSval=3595656117 TSecr=0 WS=128
2 0....
- 74
0
votes
1
answer
44
views
How can i aggregate all txt file with one command for cracking?
I wanted to find passphrase from .cap file and .txt file (Password Dictionary). But I have too many .txt file's there. Can I use those file one by one for cracking? My command is given below: I tried ...
- 1
0
votes
1
answer
47
views
unable to start wireshark
I have a system that runs ARCO linux (Arch based). I've used it to run wireshark just fine previously. I then wanted to use an older version of wireshark, and went and got the sources for wireshark-2....
- 1,937
1
vote
1
answer
154
views
How to use a network interface as read-only?
I have a switch in my home lab that I want to run some experiments with, especially with regards to VLANs and some other protocols that I want to better understand. Now, this switch (a TP-Link 5-port ...
- 111
0
votes
0
answers
217
views
tcpdump to perform wireless capture with advanced filters
I’m trying to use tcpdump to perform realtime wireless captures (without the option to save the file) on a MAC. My wireless interface is en0. I want to use similar filters as I would in Wireshark. My ...
- 47
0
votes
0
answers
18
views
scan specific udp port for local network
So I have a Prometheus server which I use to capture input from port 512 UDP, I have it open, but now I have a problem checking which 512 UDP port on my network is the sender. I tried reading the nmap ...
3
votes
1
answer
483
views
How to change color of options in Wireshark in Kali linux?
I am using wireshark in kali linux and all the options are coming out in white. I am not able to read a single thing,
Is there any way to change this? I have tried and search the internet for past ...
- 157
1
vote
1
answer
443
views
missing TLS protocol in wireshark preferences
I've installed wireshark on Centos 7.9.2009 however I don't find TLS on the protocols list in preferences settings.
Is it something missing to be installed yet or the wireshark version available on ...
- 2,537
1
vote
1
answer
1k
views
Why is HAProxy forwarding HTTP2 requests as HTTP 1.1?
I'm trying to configure a load balancer between 2 servers with HAPoxy, this is my configuration:
frontend haproxynode
bind *:443 ssl crt /etc/ssl/private/isel.pem alpn h2,http/1.1
mode tcp
...
- 11
0
votes
1
answer
2k
views
Determine the PID of a process that is calling out to an IP
My wifi card is tryign to make a connection to a seemingly random IP address on the local network. I want to find which process on the client is trying to make this connection to determine why.
This ...
- 189
0
votes
1
answer
196
views
CORE and Wireshark
I use the CORE network emulator. I try to run Wireshark on one of the nodes via the terminal, but I get this error:
QStandardPaths: XDG_RUNTIME_DIR not set, defaulting to '/tmp/runtime-root'
qt.qpa....
- 101
0
votes
1
answer
414
views
Macos with Virtualbox and Wireshark on LAN network
I have a virtual machine on a macos, within that virtual machine I have a Debian distribution and I want to use Wireshark to capture all the traffic from the lan network, from virtualbox. I have ...
- 111
0
votes
1
answer
326
views
Wireshark can't see the dropped packets by iptables
I'm running wireshark(2.6.8) and iptables(v1.8.2 nf_tables) instances on my computer. I saw that others can see the dropped packets with wireshark:
How can Wireshark see packets dropped by iptables?
...
4
votes
0
answers
103
views
Is there a command like `time` that monitors the network traffic of commands?
I can use the time command to measure the time some command takes:
time node -e ""
node -e "" 0.06s user 0.01s system 92% cpu 0.076 total
Is there a similar way to measure a ...
- 1,287
1
vote
1
answer
336
views
Using tcpdump to trace IP of strangers(predators) on omegle
I am using tcpdump to capture packets while being on omegle. However, I have been fairly unsuccessful to get strangers IP. All the IP I see are traced back to either 172...* which is for google 104....
- 244
0
votes
0
answers
56
views
Why do I get an error when setting monitor mode if the interface is monitor mode capable?
I have these features on my system:
iw list
Wiphy phy4
max # scan SSIDs: 10
max scan IEs length: 255 bytes
max # sched scan SSIDs: 0
max # match sets: 0
max # scan plans: 1
...
- 101
0
votes
1
answer
106
views
How to find min, max data rate of pcap file
I have pcap file and I want to find min and max data rate.
I use Capinfos, it shows only average data rate. I would ask how to do that?
- 53
0
votes
1
answer
90
views
CLI Utility to see the http requests that'll be made by a command
I have a script which invokes some library code that makes some HTTP and HTTPS requests, let's call it script.sh
Is there a command which would look like some-wireshark-type-utility ./script.sh and ...
- 385
1
vote
1
answer
974
views
No such file or directory: /sys/kernel/debug/usb/usbmon/
I am trying to install wiresahrk on my linux mint 19.2 machine.
When executing as root it says:
The capture session could not be initiated on interface 'usbmon1' (Can't open USB bus file /sys/kernel/...
- 23
0
votes
1
answer
862
views
Why is a packet is not sent until ACK is received when window size is sufficient
The considered application (server) has a number of clients connected. It processes each message from the client and sends two output messages. The output messages are generated sequencially and ...
- 111
1
vote
0
answers
76
views
I need to install Wireshark on my CentOS VM
I used the following commands to install the tool:
$ yum install gcc gcc-c++ bison flex libpcap-devel qt-devel gtk3-devel rpm-build libtool c-ares-devel qt5-qtbase-devel qt5-qtmultimedia-devel qt5-...
- 11
0
votes
1
answer
36
views
Repeat Tshark command when first done
I have this command that i need to repeat for ever till i stop it.
I have to send a capture to my supplier for VOIP support for a intermitent trouble.
But 10mb is taking like five minutes to complete....
5
votes
2
answers
1k
views
Tc qdisc delay not seen in tcpdump recording
I have two linux containers connected with a veth-pair. At veth-interface of one container I set up tc qdisc netem delay and send traffic from it to the other container. If I watch traffic on both ...
- 264
2
votes
0
answers
73
views
Ctrl, Alt, and Super behave like Left Shift and I fixed it in a strange way
I use Arch Linux. I have Qumo Axe keyboard which as it turned out works only on Windows. On Linux, the bottom row keys (Ctrl, Alt, Super) behave like Left Shift, I tried to install drivers which I ...
- 21
1
vote
1
answer
3k
views
How to disable network-connectivity-check on linux mint?
(Virtualbox OS: Linux Mint 19.1 Tessa)
I am trying to disable the network-connectivity-check on Linux Mint.
This website shows how to disable it in the GUI for Ubuntu 17.10.
Unfortunately in Mint ...
- 491
0
votes
1
answer
2k
views
Cannot disable network time control (NTP)
I want to analyze some protocols (ARP, NDP, etc.) inside virtualbox (OS: Linux Mint 19.1 Tessa) using wireshark and tried to disable the "network time control"-synchronization.
yuza@VirtualBox:~$ ...
- 491
3
votes
2
answers
7k
views
How to capture WOL packets?
I used
sudo tcpdump -v -i eth0 ether proto 0x0842 or udp port 9
but didn't see anything when WakeMeOnLan from NirSoft wakes the computer.
The same with Wireshark
- 2,517
0
votes
1
answer
1k
views
Wireshark not showing HTTP queries
I am trying to using Wireshark, but when I set filter into http Wireshark not displaying any data.
Unfortunately, I can see only tcp/dhcp/arp protocols, but not http:
My Wireshark preferences:
I ...
1
vote
1
answer
1k
views
How to filter wireshark output data to only view ttyUSB0 data?
I'm Using Wireshark on Ubuntu 18.04 to monitor my ttyUSB0 USB port output as I'm developing something that requires that. On the website, I found how to get it to sniff USB ports but the output is ...
- 131
0
votes
1
answer
160
views
possible packet loss
I have a program running on my local machine that prints data to port 50000. In a terminal on my local machine I run nc to connect to and print the data on the port. However, when using nc in terminal ...
- 1
2
votes
1
answer
665
views
How to inspect decrypted TLS/SSL traffic in Wireshark from program not supporting SSLKEYLOGFILE?
TL;DR: I feel I'm pretty close to doing so by using sslsplit's interface mirroring, but I ran into an issue where the kernel is not replying to ARP requests that sslsplit is sending out on the ...
- 4,072
0
votes
1
answer
269
views
Freshly installed Wireshark with enabled non-root listen users is not able to listen
I have Linux Mint 19 64-bit Cinnamon.
I have just installed wireshark-gtk with:
sudo apt-get install wireshark-gtk
while installing I was asked this:
Answering Yes as you can see, as I am the sole ...
- 23.4k
1
vote
0
answers
85
views
GUI for application with and without sudo
I was running wireshark when I realized that executing it using sudo and without sudo gave me a different user interface.
When running using sudo, it gives me nice sized icon and text. But running it ...
- 113
0
votes
1
answer
1k
views
How to trace snmp trap sent by client process?
We have a process(should be a client program) on RHEL 7.4 that send snmp traps to a Solaris server that has trap receiver process(should be a server program listening on 162/1691) on other machine(...
- 1,256
4
votes
2
answers
3k
views
How keyboard's drivers work on linux
I recently bought a new keyboard, it was cheap and of an unknown brand but i wasn't particularly worried. I found out that on linux pressing shift, super, left-ctrl or left-alt with this keyboard made ...
- 49
1
vote
2
answers
1k
views
Kali Linux Can't Log in as non-root user and wireshark complaining about root
When I opened wireshark (fresh install of live usb kali with persistence) for the first time it complained about me being root. This is what I found in googling it:
Yes it's recommended and ...
- 1,725
0
votes
1
answer
292
views
"-qt=5 -version returned non-zero exit status" error when installing Wireshark
When I wanted to install Wireshark software from Source Code on Debian 8 Linux distro, I saw the following error messages:
...
...
checking for uic... /usr/bin/uic
checking for qtchooser... (cached) /...
- 297
2
votes
2
answers
6k
views
Incoming and outgoing traffic when NOTHING is running
In a system with nothing running (at least nothing I know of). Listening of incoming and outgoing traffic prints this output:
192.168.1.1 => all-systems.mcast.net 0b ...
- 323
0
votes
1
answer
1k
views
tshark filters in Centos 7
I am working on some tshark filters , need to split a pcap on timebasis for particular SIP and DIP, I have tried editcap but it can go with time basis only I cannot pass IPADDRESS to editcap, I saw ...
- 191
0
votes
0
answers
23
views
Wireshark mute..why?
I have two host+one router
192.168.0.1 router
192.168.0.2 pc
192.168.0.5 macos
On pc i want to capture all packets of macos with wireshark
Interface on pc is bridged,br0
I put br0 in promisc mode ...
- 10.9k
1
vote
1
answer
583
views
can I configure SSH so it does not use encryption?
I have an ssh client connecting to an ssh server. I want to investigate what's going on between them, so I would like to dump the traffic with tcpdump and then analyze it with Wireshark. However, I ...
- 441
0
votes
2
answers
942
views
See graph of text tcpdump
I saved some dump from tcpdump using
tcpdump -n -i eth0 -tttt -Q in > "dump01.dump"
so i got output like this:
20:39:12.808672 IP 94.xx.xxx.202.49183 > 151.xx.xx.xx.61479: UDP, length 104
20:...
- 11