Stack Exchange Network

Stack Exchange network consists of 175 Q&A communities including Stack Overflow, the largest, most trusted online community for developers to learn, share their knowledge, and build their careers.

Visit Stack Exchange

Questions tagged [wireshark]

The tag has no usage guidance.

2
votes
0answers
25 views

Ctrl, Alt, and Super behave like Left Shift and I fixed it in a strange way

I use Arch Linux. I have Qumo Axe keyboard which as it turned out works only on Windows. On Linux, the bottom row keys (Ctrl, Alt, Super) behave like Left Shift, I tried to install drivers which I ...
0
votes
1answer
56 views

How to disable network-connectivity-check on linux mint?

(Virtualbox OS: Linux Mint 19.1 Tessa) I am trying to disable the network-connectivity-check on Linux Mint. This website shows how to disable it in the GUI for Ubuntu 17.10. Unfortunately in Mint ...
0
votes
1answer
45 views

Cannot disable network time control (NTP)

I want to analyze some protocols (ARP, NDP, etc.) inside virtualbox (OS: Linux Mint 19.1 Tessa) using wireshark and tried to disable the "network time control"-synchronization. yuza@VirtualBox:~$ ...
0
votes
0answers
9 views

Is it possible to print detailed info for specific field in tshark?

Is it possible to view detailed info like for example tshark -i eth0 -f "dst port 53" -n -V shows for certain field only? I tried with for example tshark -i eth0 -f "dst port 53" -n -T fields -e dns....
0
votes
0answers
13 views

Is there a way to find NetEm delay selected when using distribution table?

I am trying to find how much each packets are delayed when it is passed through NetEm from one PC to another via an ethernet cable. At the moment I am using Wireshark to find delay experienced by each ...
1
vote
1answer
94 views

How to capture WOL packets?

I used sudo tcpdump -v -i eth0 ether proto 0x0842 or udp port 9 but didn't see anything when WakeMeOnLan from NirSoft wakes the computer. The same with Wireshark
0
votes
1answer
32 views

Wireshark not showing HTTP queries

I am trying to using Wireshark, but when I set filter into http Wireshark not displaying any data. Unfortunately, I can see only tcp/dhcp/arp protocols, but not http: My Wireshark preferences: I ...
1
vote
1answer
81 views

How to filter wireshark output data to only view ttyUSB0 data?

I'm Using Wireshark on Ubuntu 18.04 to monitor my ttyUSB0 USB port output as I'm developing something that requires that. On the website, I found how to get it to sniff USB ports but the output is ...
0
votes
1answer
50 views

possible packet loss

I have a program running on my local machine that prints data to port 50000. In a terminal on my local machine I run nc to connect to and print the data on the port. However, when using nc in terminal ...
1
vote
1answer
120 views

How to inspect decrypted TLS/SSL traffic in Wireshark from program not supporting SSLKEYLOGFILE?

TL;DR: I feel I'm pretty close to doing so by using sslsplit's interface mirroring, but I ran into an issue where the kernel is not replying to ARP requests that sslsplit is sending out on the ...
0
votes
1answer
55 views

Freshly installed Wireshark with enabled non-root listen users is not able to listen

I have Linux Mint 19 64-bit Cinnamon. I have just installed wireshark-gtk with: sudo apt-get install wireshark-gtk while installing I was asked this: Answering Yes as you can see, as I am the sole ...
1
vote
0answers
43 views

GUI for application with and without sudo

I was running wireshark when I realized that executing it using sudo and without sudo gave me a different user interface. When running using sudo, it gives me nice sized icon and text. But running it ...
0
votes
1answer
334 views

How to trace snmp trap sent by client process?

We have a process(should be a client program) on RHEL 7.4 that send snmp traps to a Solaris server that has trap receiver process(should be a server program listening on 162/1691) on other machine(...
2
votes
1answer
325 views

How keyboard's drivers work on linux

I recently bought a new keyboard, it was cheap and of an unknown brand but i wasn't particularly worried. I found out that on linux pressing shift, super, left-ctrl or left-alt with this keyboard made ...
1
vote
2answers
606 views

Kali Linux Can't Log in as non-root user and wireshark complaining about root

When I opened wireshark (fresh install of live usb kali with persistence) for the first time it complained about me being root. This is what I found in googling it: Yes it's recommended and ...
0
votes
1answer
184 views

“-qt=5 -version returned non-zero exit status” error when installing Wireshark

When I wanted to install Wireshark software from Source Code on Debian 8 Linux distro, I saw the following error messages: ... ... checking for uic... /usr/bin/uic checking for qtchooser... (cached) /...
3
votes
2answers
812 views

Incoming and outgoing traffic when NOTHING is running

In a system with nothing running (at least nothing I know of). Listening of incoming and outgoing traffic prints this output: 192.168.1.1 => all-systems.mcast.net 0b ...
0
votes
1answer
579 views

tshark filters in Centos 7

I am working on some tshark filters , need to split a pcap on timebasis for particular SIP and DIP, I have tried editcap but it can go with time basis only I cannot pass IPADDRESS to editcap, I saw ...
0
votes
0answers
20 views

Wireshark mute..why?

I have two host+one router 192.168.0.1 router 192.168.0.2 pc 192.168.0.5 macos On pc i want to capture all packets of macos with wireshark Interface on pc is bridged,br0 I put br0 in promisc mode ...
1
vote
1answer
152 views

can I configure SSH so it does not use encryption?

I have an ssh client connecting to an ssh server. I want to investigate what's going on between them, so I would like to dump the traffic with tcpdump and then analyze it with Wireshark. However, I ...
0
votes
2answers
369 views

See graph of text tcpdump

I saved some dump from tcpdump using tcpdump -n -i eth0 -tttt -Q in > "dump01.dump" so i got output like this: 20:39:12.808672 IP 94.xx.xxx.202.49183 > 151.xx.xx.xx.61479: UDP, length 104 20:...
7
votes
1answer
17k views

How to filter by host name in Wireshark?

Display filter in form ip.src_host eq my.host.name.com yields no matching packets, but there is traffic to and from this host. DNS name is resolved successfully, and filters using ip addresses like ip....
1
vote
1answer
120 views

wireshark packet capture point [closed]

I am using tc qdisc to add delay to packets on my interface eth2 as follows sudo tc qdisc add dev eth2 root netem delay 100ms 10ms 25% Then I pinged a host and got some result. The results on the ...
12
votes
4answers
14k views

How to trace networking activity of a command?

I want to trace the networking activity of a command, I tried tcpdump and strace without success. For an example, If I am installing a package or using any command that tries to reach some site, I ...
0
votes
1answer
2k views

Cannot use Monitor mode in Kali using TP-LINK TL-WN722N

I recently bought a TP-LINK TL-WN722N adapter that claims to support Monitor mode and captures any traffic using Wireshark. I tried using Monitor mode with the following commands in Kali Linux, sudo ...
1
vote
2answers
2k views

How to choose a response for interactive prompt during installation from a shell script

I am writing a shell script to install all my required applications on my Ubuntu PC in one shot (while I can take a stroll or do something else). For most applications adding -y to the end of the apt-...
1
vote
1answer
495 views

TCP parameters SACK and Window scaling do not change on Ubuntu 16.04

I want to turn off SACK and window scaling options in TCP in Ubuntu 16.04 running in a VMware virtual machine on windows 10. I am actually sending some packets through my Ubuntu to an embedded device ...
2
votes
1answer
123 views

Can I restrict Wireshark to only work with a specific interface

I have a user who is running a package call mininet to simulate networks on the loopback interface. They will likely need to use Wireshark to debug these virtual networks they create. However we have ...
2
votes
1answer
735 views

Wireshark: Remote capture over UART

TL;DR: How to pipe properly over UART the output of a remote tcpdump to a local wireshark ? I try to capture packets that flow through an embedded device to which I don't have the ability to install ...
1
vote
0answers
506 views

tcpdump: Show even invalid ethernet packets

I'm attempting to debug a hardware issue where an embedded board transmits seemingly faulty ethernet packets. I connected the embedded board to a debugging machine's ethernet port to listen to the ...
1
vote
0answers
1k views

How to capture http requests headers and body

I need to capture all incoming/outcoming http traffic of a unix machine, and then run a script on each http header/body. I have found that tcpdump captures all the requests, but big ones end up being ...
0
votes
1answer
250 views

Why can't find which program is using port 1080?

To open wireshark and select interfaces lo,here is graph captured all packages between port 1080 and others in 127.0.0.1. 1.Why the number of other ports in 127.0.0.1 is always increasing? The port ...
2
votes
0answers
656 views

How to filter pcap files using tshark

I have to extract data transfered (download, upload) for some specific sites using tshark. Let say, I want to find data downloaded from www.google.com. What fields should I specify in tshark fields ...
1
vote
2answers
78 views

unknown / unauthorized usage of my bandwidth

I currently need to work on 3g internet, so i really want to optimize the usage of my slow bandwidth. But some things are happening against my will, like this one : (use ~50kB/s without asking) GET /...
-2
votes
1answer
1k views

Can't install Gpart in Kali Linux 2.0

When I ran apt-get install gpart, I got the following message: apt-get install gpart Reading package lists... Done Building dependency tree Reading state information... Done You might want to ...
1
vote
1answer
877 views

How to follow tcp streams continuously along the capture with tshark / wireshark?

I display the TCP stream of an already finished capture written in out.pcap with END=$(tshark -r out.pcap -T fields -e tcp.stream | sort -n | tail -1); for ((i=0;i<=END;i++)); do echo $i; tshark ...
1
vote
0answers
63 views

How to open a changing file with wireshark?

Given a pcap file that is being created in the background, e.g tshark -w out.pcap > /dev/null & How can I open the changing file with wireshark wireshark -r out.pcap Does nont work
3
votes
2answers
62 views

Get public IPs of accessed webpages?

I would like to be able to get the public IPs of the websites I am accessing with my PC in a way such as: www.google.es - public IP1 www.cdn.facebook.com - public IP2 and so on. I think this ...
4
votes
2answers
254 views

How to gradually encrypt the tshark output file along the capture?

In order to secure a packet capture, which method would you use to make all (or close to all) past captured packet utterly unaccessible unless a given password is given. My habbits are to mount an ...
-2
votes
1answer
77 views

Wireshark - Facebook Account [closed]

Someone use Wireshark software, if he browse on the internet from home (using the same router) and I'm also at home, is he able to find the password of my Facebook account? I think I'm using the TCP ...
1
vote
0answers
139 views

wireshark how do I filter for items not in an array?

the syntax; tcp.port in {80 443 8080} works great for filtering ports, but; tcp.port not in {80 443 8080} doesn't seem to be valid. UPDATE: how dumb am i... not tcp.port in {80 443 8080} this ...
1
vote
1answer
501 views

how to get list of sites/domains linked to in wireshark

I have been trying to figure out how many sites does firefox connect wth and for that have been using wireshark. What I have done is made a new profile and whenever I run firefox in the browser it is ...
1
vote
1answer
863 views

Server solution, forwarding HTTP traffic

I'm looking for a solution to redirect GET/POST HTTP requests on a server. The easy part would be port translation and hostname redirection (HTTP 3xx redirection): When my server in a DMZ receives ...
1
vote
1answer
616 views

How to print all MAC addresses of devices interacting with wifis in my area to stdout

How do I configure a tool like wireshark, kismet, tcpdump to passively listen to wifi traffic? How do I get one of these tools to print these MAC addresses to stdout? I want just one MAC address per ...
0
votes
0answers
54 views

useradd failing [duplicate]

Debian 8, I'm trying to allow a user to run Wireshark. user1@system:~$ sudo useradd -G wireshark user11 useradd: user 'user11' already exists However: user11@system:~$ groups user11 cdrom floppy ...
1
vote
0answers
147 views

Is there a utility that allows to create structured data from tcpdump hexdumps?

Sometimes I have to use tcpdump to troubleshoot problems with networking protocols that tcpdump does not know how to parse. Is there a utility that could read tcpdump packets in hex dump format and ...
2
votes
1answer
571 views

Sniffing usb serial connection

I'm trying to read the usb/serial connection under Ubuntu 15.04 without beeing a real 'member' of the connection. Since there can only be 2 instances reading/writing on the bus. I've used modprobe ...
3
votes
1answer
2k views

How can Wireshark see packets dropped by iptables?

I recently installed my hard drive in a new computer and after some fiddling around I noticed my iptables rules were dropping DNS responses for some reason, turns out they were configured to allow ...
1
vote
0answers
366 views

QT application doesn't receive udp broadcast since linux kernel 3.13.0-70

I'm developing a QT application on Ubuntu and suddenly had problems because QT app doesn't receive UDP broadcast messages. They are visible in Wireshark on that machine, but never received in QT. ...
1
vote
2answers
2k views

Capturing Traffic of Router

My machine is connected to a wireless router. Is it possible to analyse packets coming and going to the router? Can I use the bridged mode for achieving this? Actually I want the original packets ...