Questions tagged [wireshark]
The wireshark tag has no usage guidance.
2
votes
0answers
25 views
Ctrl, Alt, and Super behave like Left Shift and I fixed it in a strange way
I use Arch Linux. I have Qumo Axe keyboard which as it turned out works only on Windows. On Linux, the bottom row keys (Ctrl, Alt, Super) behave like Left Shift, I tried to install drivers which I ...
0
votes
1answer
56 views
How to disable network-connectivity-check on linux mint?
(Virtualbox OS: Linux Mint 19.1 Tessa)
I am trying to disable the network-connectivity-check on Linux Mint.
This website shows how to disable it in the GUI for Ubuntu 17.10.
Unfortunately in Mint ...
0
votes
1answer
45 views
Cannot disable network time control (NTP)
I want to analyze some protocols (ARP, NDP, etc.) inside virtualbox (OS: Linux Mint 19.1 Tessa) using wireshark and tried to disable the "network time control"-synchronization.
yuza@VirtualBox:~$ ...
0
votes
0answers
9 views
Is it possible to print detailed info for specific field in tshark?
Is it possible to view detailed info like for example tshark -i eth0 -f "dst port 53" -n -V shows for certain field only? I tried with for example tshark -i eth0 -f "dst port 53" -n -T fields -e dns....
0
votes
0answers
13 views
Is there a way to find NetEm delay selected when using distribution table?
I am trying to find how much each packets are delayed when it is passed through NetEm from one PC to another via an ethernet cable. At the moment I am using Wireshark to find delay experienced by each ...
1
vote
1answer
94 views
How to capture WOL packets?
I used
sudo tcpdump -v -i eth0 ether proto 0x0842 or udp port 9
but didn't see anything when WakeMeOnLan from NirSoft wakes the computer.
The same with Wireshark
0
votes
1answer
32 views
Wireshark not showing HTTP queries
I am trying to using Wireshark, but when I set filter into http Wireshark not displaying any data.
Unfortunately, I can see only tcp/dhcp/arp protocols, but not http:
My Wireshark preferences:
I ...
1
vote
1answer
81 views
How to filter wireshark output data to only view ttyUSB0 data?
I'm Using Wireshark on Ubuntu 18.04 to monitor my ttyUSB0 USB port output as I'm developing something that requires that. On the website, I found how to get it to sniff USB ports but the output is ...
0
votes
1answer
50 views
possible packet loss
I have a program running on my local machine that prints data to port 50000. In a terminal on my local machine I run nc to connect to and print the data on the port. However, when using nc in terminal ...
1
vote
1answer
120 views
How to inspect decrypted TLS/SSL traffic in Wireshark from program not supporting SSLKEYLOGFILE?
TL;DR: I feel I'm pretty close to doing so by using sslsplit's interface mirroring, but I ran into an issue where the kernel is not replying to ARP requests that sslsplit is sending out on the ...
0
votes
1answer
55 views
Freshly installed Wireshark with enabled non-root listen users is not able to listen
I have Linux Mint 19 64-bit Cinnamon.
I have just installed wireshark-gtk with:
sudo apt-get install wireshark-gtk
while installing I was asked this:
Answering Yes as you can see, as I am the sole ...
1
vote
0answers
43 views
GUI for application with and without sudo
I was running wireshark when I realized that executing it using sudo and without sudo gave me a different user interface.
When running using sudo, it gives me nice sized icon and text. But running it ...
0
votes
1answer
334 views
How to trace snmp trap sent by client process?
We have a process(should be a client program) on RHEL 7.4 that send snmp traps to a Solaris server that has trap receiver process(should be a server program listening on 162/1691) on other machine(...
2
votes
1answer
325 views
How keyboard's drivers work on linux
I recently bought a new keyboard, it was cheap and of an unknown brand but i wasn't particularly worried. I found out that on linux pressing shift, super, left-ctrl or left-alt with this keyboard made ...
1
vote
2answers
606 views
Kali Linux Can't Log in as non-root user and wireshark complaining about root
When I opened wireshark (fresh install of live usb kali with persistence) for the first time it complained about me being root. This is what I found in googling it:
Yes it's recommended and ...
0
votes
1answer
184 views
“-qt=5 -version returned non-zero exit status” error when installing Wireshark
When I wanted to install Wireshark software from Source Code on Debian 8 Linux distro, I saw the following error messages:
...
...
checking for uic... /usr/bin/uic
checking for qtchooser... (cached) /...
3
votes
2answers
812 views
Incoming and outgoing traffic when NOTHING is running
In a system with nothing running (at least nothing I know of). Listening of incoming and outgoing traffic prints this output:
192.168.1.1 => all-systems.mcast.net 0b ...
0
votes
1answer
579 views
tshark filters in Centos 7
I am working on some tshark filters , need to split a pcap on timebasis for particular SIP and DIP, I have tried editcap but it can go with time basis only I cannot pass IPADDRESS to editcap, I saw ...
0
votes
0answers
20 views
Wireshark mute..why?
I have two host+one router
192.168.0.1 router
192.168.0.2 pc
192.168.0.5 macos
On pc i want to capture all packets of macos with wireshark
Interface on pc is bridged,br0
I put br0 in promisc mode ...
1
vote
1answer
152 views
can I configure SSH so it does not use encryption?
I have an ssh client connecting to an ssh server. I want to investigate what's going on between them, so I would like to dump the traffic with tcpdump and then analyze it with Wireshark. However, I ...
0
votes
2answers
369 views
See graph of text tcpdump
I saved some dump from tcpdump using
tcpdump -n -i eth0 -tttt -Q in > "dump01.dump"
so i got output like this:
20:39:12.808672 IP 94.xx.xxx.202.49183 > 151.xx.xx.xx.61479: UDP, length 104
20:...
7
votes
1answer
17k views
How to filter by host name in Wireshark?
Display filter in form ip.src_host eq my.host.name.com yields no matching packets, but there is traffic to and from this host.
DNS name is resolved successfully, and filters using ip addresses like ip....
1
vote
1answer
120 views
wireshark packet capture point [closed]
I am using tc qdisc to add delay to packets on my interface eth2 as follows
sudo tc qdisc add dev eth2 root netem delay 100ms 10ms 25%
Then I pinged a host and got some result. The results on the ...
12
votes
4answers
14k views
How to trace networking activity of a command?
I want to trace the networking activity of a command, I tried tcpdump and strace without success.
For an example, If I am installing a package or using any command that tries to reach some site, I ...
0
votes
1answer
2k views
Cannot use Monitor mode in Kali using TP-LINK TL-WN722N
I recently bought a TP-LINK TL-WN722N adapter that claims to support Monitor mode and captures any traffic using Wireshark. I tried using Monitor mode with the following commands in Kali Linux,
sudo ...
1
vote
2answers
2k views
How to choose a response for interactive prompt during installation from a shell script
I am writing a shell script to install all my required applications on my Ubuntu PC in one shot (while I can take a stroll or do something else). For most applications adding -y to the end of the apt-...
1
vote
1answer
495 views
TCP parameters SACK and Window scaling do not change on Ubuntu 16.04
I want to turn off SACK and window scaling options in TCP in Ubuntu 16.04 running in a VMware virtual machine on windows 10.
I am actually sending some packets through my Ubuntu to an embedded device ...
2
votes
1answer
123 views
Can I restrict Wireshark to only work with a specific interface
I have a user who is running a package call mininet to simulate networks on the loopback interface. They will likely need to use Wireshark to debug these virtual networks they create. However we have ...
2
votes
1answer
735 views
Wireshark: Remote capture over UART
TL;DR: How to pipe properly over UART the output of a remote tcpdump to a local wireshark ?
I try to capture packets that flow through an embedded device to which I don't have the ability to install ...
1
vote
0answers
506 views
tcpdump: Show even invalid ethernet packets
I'm attempting to debug a hardware issue where an embedded board transmits seemingly faulty ethernet packets.
I connected the embedded board to a debugging machine's ethernet port to listen to the ...
1
vote
0answers
1k views
How to capture http requests headers and body
I need to capture all incoming/outcoming http traffic of a unix machine, and then run a script on each http header/body.
I have found that tcpdump captures all the requests, but big ones end up being ...
0
votes
1answer
250 views
Why can't find which program is using port 1080?
To open wireshark and select interfaces lo,here is graph captured all packages between port 1080 and others in 127.0.0.1.
1.Why the number of other ports in 127.0.0.1 is always increasing?
The port ...
2
votes
0answers
656 views
How to filter pcap files using tshark
I have to extract data transfered (download, upload) for some specific sites using tshark. Let say, I want to find data downloaded from www.google.com. What fields should I specify in tshark fields ...
1
vote
2answers
78 views
unknown / unauthorized usage of my bandwidth
I currently need to work on 3g internet, so i really want to optimize the usage of my slow bandwidth.
But some things are happening against my will, like this one : (use ~50kB/s without asking)
GET /...
-2
votes
1answer
1k views
Can't install Gpart in Kali Linux 2.0
When I ran apt-get install gpart, I got the following message:
apt-get install gpart
Reading package lists... Done
Building dependency tree
Reading state information... Done
You might want to ...
1
vote
1answer
877 views
How to follow tcp streams continuously along the capture with tshark / wireshark?
I display the TCP stream of an already finished capture written in out.pcap with
END=$(tshark -r out.pcap -T fields -e tcp.stream | sort -n | tail -1);
for ((i=0;i<=END;i++));
do
echo $i; tshark ...
1
vote
0answers
63 views
How to open a changing file with wireshark?
Given a pcap file that is being created in the background, e.g
tshark -w out.pcap > /dev/null &
How can I open the changing file with wireshark
wireshark -r out.pcap
Does nont work
3
votes
2answers
62 views
Get public IPs of accessed webpages?
I would like to be able to get the public IPs of the websites I am accessing with my PC in a way such as:
www.google.es - public IP1
www.cdn.facebook.com - public IP2
and so on. I think this ...
4
votes
2answers
254 views
How to gradually encrypt the tshark output file along the capture?
In order to secure a packet capture, which method would you use to make all (or close to all) past captured packet utterly unaccessible unless a given password is given.
My habbits are
to mount an ...
-2
votes
1answer
77 views
Wireshark - Facebook Account [closed]
Someone use Wireshark software, if he browse on the internet from home (using the same router) and I'm also at home, is he able to find the password of my Facebook account? I think I'm using the TCP ...
1
vote
0answers
139 views
wireshark how do I filter for items not in an array?
the syntax;
tcp.port in {80 443 8080}
works great for filtering ports, but;
tcp.port not in {80 443 8080}
doesn't seem to be valid.
UPDATE:
how dumb am i...
not tcp.port in {80 443 8080}
this ...
1
vote
1answer
501 views
how to get list of sites/domains linked to in wireshark
I have been trying to figure out how many sites does firefox connect wth and for that have been using wireshark. What I have done is made a new profile and whenever I run firefox in the browser it is ...
1
vote
1answer
863 views
Server solution, forwarding HTTP traffic
I'm looking for a solution to redirect GET/POST HTTP requests on a server.
The easy part would be port translation and hostname redirection (HTTP 3xx redirection):
When my server in a DMZ receives ...
1
vote
1answer
616 views
How to print all MAC addresses of devices interacting with wifis in my area to stdout
How do I configure a tool like wireshark, kismet, tcpdump to passively listen to wifi traffic?
How do I get one of these tools to print these MAC addresses to stdout? I want just one MAC address per ...
0
votes
0answers
54 views
useradd failing [duplicate]
Debian 8, I'm trying to allow a user to run Wireshark.
user1@system:~$ sudo useradd -G wireshark user11
useradd: user 'user11' already exists
However:
user11@system:~$ groups
user11 cdrom floppy ...
1
vote
0answers
147 views
Is there a utility that allows to create structured data from tcpdump hexdumps?
Sometimes I have to use tcpdump to troubleshoot problems with networking protocols that tcpdump does not know how to parse.
Is there a utility that could read tcpdump packets in hex dump format and ...
2
votes
1answer
571 views
Sniffing usb serial connection
I'm trying to read the usb/serial connection under Ubuntu 15.04 without beeing a real 'member' of the connection. Since there can only be 2 instances reading/writing on the bus.
I've used modprobe ...
3
votes
1answer
2k views
How can Wireshark see packets dropped by iptables?
I recently installed my hard drive in a new computer and after some fiddling around I noticed my iptables rules were dropping DNS responses for some reason, turns out they were configured to allow ...
1
vote
0answers
366 views
QT application doesn't receive udp broadcast since linux kernel 3.13.0-70
I'm developing a QT application on Ubuntu and suddenly had problems because QT app doesn't receive UDP broadcast messages. They are visible in Wireshark on that machine, but never received in QT.
...
1
vote
2answers
2k views
Capturing Traffic of Router
My machine is connected to a wireless router. Is it possible to analyse packets coming and going to the router? Can I use the bridged mode for achieving this? Actually I want the original packets ...
