Questions tagged [wireshark]
The wireshark tag has no usage guidance.
123
questions
0
votes
0
answers
18
views
find in tshark/wireshark tcp sessions with unique value in filter - ldap.attributes
I need to find in tshark/wireshark tcp sessions with an unique value in filter - ldap.attributes
For example, in a picture
In red - value from filter - ldap.attributes. Some filter in the dump can be ...
- 41
0
votes
2
answers
24
views
Pinging two PCs and trying to capture ICMPs with third PC
I have a setup of three computers that are all on the same subnet and connected to a switch. All services are reachable. I'm pinging from PC(1) to PC(2). Opening tshark with PC(3) but cannot see ...
- 83
0
votes
0
answers
51
views
replace hex value to random hex value with the same length in pcap file
I need to replace hex value to random hex value with the same length in pcap file.
I work in debian 10 in bash.
I have pcap file for example with this tcp payload in some packets:
I want to replace ...
- 41
0
votes
0
answers
29
views
tcpdump: how to see source and destination of HE_MU packets?
I'm currently testing a router and trying to capture HE_MU packets.
For this I have a setup with 5 end-user devices and a device that acts as a packet sniffer and also hosts iperf3 servers.
I put ...
- 1
1
vote
0
answers
36
views
TCPDUMP Missing response Code header in Back to back execution
I am running two TCPDUMP Commands back to back. Here is the sequence
Run the below command
root@open5Gs:/home/test# tcpdump -l -vvv -s0 -i any -B 4096 -nn -w /home/test/tc060.pcap -c 1500
Execute ...
0
votes
0
answers
112
views
How to show packet ingress/egress direction with wireshark/tshark?
I am diagnosing traffic through a Linux router. I regularly use the tshark with the options -T fields and -e frame.interface_name to see from which interface each frame was captured. This information ...
- 1
1
vote
1
answer
147
views
Can `tcpdump ether host` filter with a mask to get, for example, hosts with a specific OUI?
I'm trying to filter traffic by src ether host to see all devices with a specific MAC prefix. If this were like IP, it might filter with src ether host aa:bb:cc:00:00:00/24 to see OUI's matching aa:...
- 273
1
vote
0
answers
52
views
How to capture SATA traffic under Linux?
Using usbmon it's possible to capture USB traffic in Wireshark.
I want to do the same for SATA.
Is it possible?
If it is not possible in Wireshark directly it would be nice to later open the capture ...
- 843
1
vote
1
answer
55
views
GeoIP not working when processing PCAP with tshark as su
I am working with lots of PCAP files and trying to convert them into .tsv files for tabular analysis. So I'm using tshark in a Ubuntu 22 VirtualBox machine to dissect each packet. I have a bash ...
- 113
1
vote
1
answer
261
views
How do I generate a Snort pcap file?
I am new to using snort and still learning in university. I am wondering after I find an intrusion how can I log it and save it as a pcap file? What would the syntax look like to do this? So I can ...
- 21
0
votes
0
answers
59
views
How to sniff in/out packets of a Windows 10 VM from Kali host?
When I created a Windows 10 vm inside of a Windows 10 host, a device was automatically created for it that I could monitor with Wireshark and see only the traffic going in and out of that VM. I ...
- 3
0
votes
1
answer
92
views
Wi-Fi DHCP debugging for cell phone needed
Every then and now, my android cell phone cannot connect to my Wi-Fi and says: unable to obtain IP address. After some time (sometimes minutes, sometimes hours) connection is back to normal.
This is ...
2
votes
0
answers
118
views
Issues with AP and station mode simultaneously on a AP-STA wifi module
I have an iMX8MP board running Linux. The board is equipped with a Wifi module with AP-STA capability. I want this system to start an access point at boot and to connect to an external wifi once the ...
- 149
0
votes
1
answer
128
views
Can't decrypt https traffic with wireshark
I am trying to decrypt https traffic according to these guides:
https://linuxhint.com/decrypt-ssl-tls-wireshark/
https://www.comparitech.com/net-admin/decrypt-ssl-with-wireshark/
But nothing is ...
- 41
0
votes
0
answers
140
views
TCP packet excess delay
I am sending packets of known length from client (63396) to server (50001)
frameTime 1659456858651175 frameSeq: 0 Packets 1 bytes 23425
frameTime 1659456858667639 frameSeq: 1 Packets 1 bytes 19556
...
0
votes
0
answers
238
views
How do I bridge an ethernet device to the wireless network interface from within a VirtualBox Ubuntu 20.04 LTS VM?
I have a VirtualBox Ubuntu VM, the "VM", set up on my primary Windows machine, using bridged VirtualBox connections to the wireless interface and the ethernet port (i.e. Ethernet <-> ...
- 1
0
votes
1
answer
39
views
Sending all lan traffic to monitor PC
I setup a Windows Server 2022 PC to monitor all LAN traffic. I have the computer connected by Ethernet to the monitor PC and have this as a Firewall script for my DD-wrt router:
iptables -t mangle -A ...
0
votes
1
answer
228
views
Wireshark blocking the WiFi
I'm on Arch Linux installed on a Macbook Air. WiFi runs just fine. But whenever I start to capture network on the WiFi Card on Wireshark, it just suddenly stops working. Pinging google replies "...
- 11
2
votes
1
answer
802
views
Capture DNS traffic to and from a network namespace using tshark
How can I capture traffic specifically from a network interface inside a network namespace using tshark? In my case, the network interface tun0 is moved into the network namespace called vpn.
Normally ...
- 225
1
vote
1
answer
176
views
-Y and read {src,dst} port and tshark
tshark get data from interface or pcap files. When it read data from interface, user has to write filter with -f (accortding to pcap-filter(7)) and when read from file user has to write filter with -Y ...
- 10.7k
1
vote
1
answer
739
views
how to modify pcap file for Additional Information in packet
I have one Pcap File which consist of Some Information.
I need to modify the data in the file.
Example:
As you can see There are details of packets and in Additional Record section I have TXT value ...
1
vote
1
answer
480
views
Is it possible to detect if a Router WPS button has been pressed or not by just passively monitoring traffic?
I mean you could check if the wps button has been pressed or not using this command
wpa_cli wps_pbc
But i am wondering if it's possible to do it using airodump-ng
Without any one connecting to it.
...
- 131
1
vote
0
answers
32
views
Unable to capture node-to-node traffic in a wireless access point
I have created a wireless access point on ubuntu and I have written a program that parses network traffic obtained via tshark and condenses it into a readable form. I am able to capture traffic going ...
0
votes
1
answer
408
views
Understanding ACK numbers
I try to understand the reason of unordered ACK numbers. I have the following logs in wireshark:
34936 → 80 [SYN] Seq=0 Win=64240 Len=0 MSS=1460 SACK_PERM=1 TSval=3595656117 TSecr=0 WS=128
2 0....
- 84
1
vote
2
answers
517
views
How can i aggregate all txt file with one command for cracking?
I wanted to find passphrase from .cap file and .txt file (Password Dictionary). But I have too many .txt file's there. Can I use those file one by one for cracking? My command is given below: I tried ...
- 11
0
votes
1
answer
201
views
unable to start wireshark
I have a system that runs ARCO linux (Arch based). I've used it to run wireshark just fine previously. I then wanted to use an older version of wireshark, and went and got the sources for wireshark-2....
- 2,037
1
vote
1
answer
759
views
How to use a network interface as read-only?
I have a switch in my home lab that I want to run some experiments with, especially with regards to VLANs and some other protocols that I want to better understand. Now, this switch (a TP-Link 5-port ...
- 111
0
votes
0
answers
922
views
tcpdump to perform wireless capture with advanced filters
I’m trying to use tcpdump to perform realtime wireless captures (without the option to save the file) on a MAC. My wireless interface is en0. I want to use similar filters as I would in Wireshark. My ...
- 57
0
votes
0
answers
40
views
scan specific udp port for local network
So I have a Prometheus server which I use to capture input from port 512 UDP, I have it open, but now I have a problem checking which 512 UDP port on my network is the sender. I tried reading the nmap ...
2
votes
1
answer
2k
views
How to change color of options in Wireshark in Kali linux?
I am using wireshark in kali linux and all the options are coming out in white. I am not able to read a single thing,
Is there any way to change this? I have tried and search the internet for past ...
- 147
1
vote
1
answer
1k
views
missing TLS protocol in wireshark preferences
I've installed wireshark on Centos 7.9.2009 however I don't find TLS on the protocols list in preferences settings.
Is it something missing to be installed yet or the wireshark version available on ...
- 3,691
1
vote
1
answer
2k
views
Why is HAProxy forwarding HTTP2 requests as HTTP 1.1?
I'm trying to configure a load balancer between 2 servers with HAPoxy, this is my configuration:
frontend haproxynode
bind *:443 ssl crt /etc/ssl/private/isel.pem alpn h2,http/1.1
mode tcp
...
- 11
-1
votes
1
answer
4k
views
Determine the PID of a process that is calling out to an IP
My wifi card is tryign to make a connection to a seemingly random IP address on the local network. I want to find which process on the client is trying to make this connection to determine why.
This ...
- 203
0
votes
1
answer
420
views
CORE and Wireshark
I use the CORE network emulator. I try to run Wireshark on one of the nodes via the terminal, but I get this error:
QStandardPaths: XDG_RUNTIME_DIR not set, defaulting to '/tmp/runtime-root'
qt.qpa....
- 101
0
votes
1
answer
718
views
Macos with Virtualbox and Wireshark on LAN network
I have a virtual machine on a macos, within that virtual machine I have a Debian distribution and I want to use Wireshark to capture all the traffic from the lan network, from virtualbox. I have ...
- 111
0
votes
1
answer
638
views
Wireshark can't see the dropped packets by iptables
I'm running wireshark(2.6.8) and iptables(v1.8.2 nf_tables) instances on my computer. I saw that others can see the dropped packets with wireshark:
How can Wireshark see packets dropped by iptables?
...
4
votes
0
answers
321
views
Is there a command like `time` that monitors the network traffic of commands?
I can use the time command to measure the time some command takes:
time node -e ""
node -e "" 0.06s user 0.01s system 92% cpu 0.076 total
Is there a similar way to measure a ...
- 1,493
1
vote
1
answer
495
views
Using tcpdump to trace IP of strangers(predators) on omegle
I am using tcpdump to capture packets while being on omegle. However, I have been fairly unsuccessful to get strangers IP. All the IP I see are traced back to either 172...* which is for google 104....
- 256
0
votes
0
answers
130
views
Why do I get an error when setting monitor mode if the interface is monitor mode capable?
I have these features on my system:
iw list
Wiphy phy4
max # scan SSIDs: 10
max scan IEs length: 255 bytes
max # sched scan SSIDs: 0
max # match sets: 0
max # scan plans: 1
...
- 101
1
vote
1
answer
430
views
How to find min, max data rate of pcap file
I have pcap file and I want to find min and max data rate.
I use Capinfos, it shows only average data rate. I would ask how to do that?
- 83
0
votes
1
answer
347
views
CLI Utility to see the http requests that'll be made by a command
I have a script which invokes some library code that makes some HTTP and HTTPS requests, let's call it script.sh
Is there a command which would look like some-wireshark-type-utility ./script.sh and ...
- 514
1
vote
1
answer
1k
views
No such file or directory: /sys/kernel/debug/usb/usbmon/
I am trying to install wiresahrk on my linux mint 19.2 machine.
When executing as root it says:
The capture session could not be initiated on interface 'usbmon1' (Can't open USB bus file /sys/kernel/...
- 23
0
votes
1
answer
2k
views
Why is a packet is not sent until ACK is received when window size is sufficient
The considered application (server) has a number of clients connected. It processes each message from the client and sends two output messages. The output messages are generated sequencially and ...
- 111
1
vote
0
answers
186
views
I need to install Wireshark on my CentOS VM
I used the following commands to install the tool:
$ yum install gcc gcc-c++ bison flex libpcap-devel qt-devel gtk3-devel rpm-build libtool c-ares-devel qt5-qtbase-devel qt5-qtmultimedia-devel qt5-...
- 11
0
votes
1
answer
63
views
Repeat Tshark command when first done
I have this command that i need to repeat for ever till i stop it.
I have to send a capture to my supplier for VOIP support for a intermitent trouble.
But 10mb is taking like five minutes to complete....
5
votes
2
answers
2k
views
Tc qdisc delay not seen in tcpdump recording
I have two linux containers connected with a veth-pair. At veth-interface of one container I set up tc qdisc netem delay and send traffic from it to the other container. If I watch traffic on both ...
- 304
2
votes
0
answers
121
views
Ctrl, Alt, and Super behave like Left Shift and I fixed it in a strange way
I use Arch Linux. I have Qumo Axe keyboard which as it turned out works only on Windows. On Linux, the bottom row keys (Ctrl, Alt, Super) behave like Left Shift, I tried to install drivers which I ...
- 21
1
vote
1
answer
3k
views
How to disable network-connectivity-check on linux mint?
(Virtualbox OS: Linux Mint 19.1 Tessa)
I am trying to disable the network-connectivity-check on Linux Mint.
This website shows how to disable it in the GUI for Ubuntu 17.10.
Unfortunately in Mint ...
- 581
0
votes
1
answer
3k
views
Cannot disable network time control (NTP)
I want to analyze some protocols (ARP, NDP, etc.) inside virtualbox (OS: Linux Mint 19.1 Tessa) using wireshark and tried to disable the "network time control"-synchronization.
yuza@VirtualBox:~$ ...
- 581
6
votes
2
answers
10k
views
How to capture WOL packets?
I used
sudo tcpdump -v -i eth0 ether proto 0x0842 or udp port 9
but didn't see anything when WakeMeOnLan from NirSoft wakes the computer.
The same with Wireshark
- 3,191