2022 Developer Survey is open! Take survey.

Questions tagged [wireshark]

The tag has no usage guidance.

Filter by
Sorted by
Tagged with
0 votes
0 answers
6 views

Reassembling fragments in PCAP file

We have PCAP files with long and heavily fragmented datagrams. We want to read them in Python but that avenue may not work out due to lack of PCAP reassembly support in feasible libraries. Our ...
user avatar
0 votes
1 answer
36 views

Wireshark blocking the WiFi

I'm on Arch Linux installed on a Macbook Air. WiFi runs just fine. But whenever I start to capture network on the WiFi Card on Wireshark, it just suddenly stops working. Pinging google replies "...
user avatar
  • 11
2 votes
1 answer
68 views

Capture DNS traffic to and from a network namespace using tshark

How can I capture traffic specifically from a network interface inside a network namespace using tshark? In my case, the network interface tun0 is moved into the network namespace called vpn. Normally ...
user avatar
0 votes
0 answers
18 views

-Y and read {src,dst} port and tshark

tshark get data from interface or pcap files. When it read data from interface, user has to write filter with -f (accortding to pcap-filter(7)) and when read from file user has to write filter with -Y ...
user avatar
  • 10.2k
1 vote
1 answer
54 views

how to modify pcap file for Additional Information in packet

I have one Pcap File which consist of Some Information. I need to modify the data in the file. Example: As you can see There are details of packets and in Additional Record section I have TXT value ...
user avatar
1 vote
1 answer
97 views

Is it possible to detect if a Router WPS button has been pressed or not by just passively monitoring traffic?

I mean you could check if the wps button has been pressed or not using this command wpa_cli wps_pbc But i am wondering if it's possible to do it using airodump-ng Without any one connecting to it. ...
user avatar
1 vote
0 answers
28 views

Unable to capture node-to-node traffic in a wireless access point

I have created a wireless access point on ubuntu and I have written a program that parses network traffic obtained via tshark and condenses it into a readable form. I am able to capture traffic going ...
user avatar
0 votes
0 answers
16 views

can mergecap be modified to allow listing the source files?

I realize mergecap is relatively old. I checked the mergecap docs page, googled, etc., and do not see any mention of a mergecap capability that I believe would be beneficial. When we mergecap, we ...
user avatar
0 votes
1 answer
51 views

Understanding ACK numbers

I try to understand the reason of unordered ACK numbers. I have the following logs in wireshark: 34936 → 80 [SYN] Seq=0 Win=64240 Len=0 MSS=1460 SACK_PERM=1 TSval=3595656117 TSecr=0 WS=128 2 0....
user avatar
  • 74
0 votes
1 answer
44 views

How can i aggregate all txt file with one command for cracking?

I wanted to find passphrase from .cap file and .txt file (Password Dictionary). But I have too many .txt file's there. Can I use those file one by one for cracking? My command is given below: I tried ...
user avatar
  • 1
0 votes
1 answer
47 views

unable to start wireshark

I have a system that runs ARCO linux (Arch based). I've used it to run wireshark just fine previously. I then wanted to use an older version of wireshark, and went and got the sources for wireshark-2....
user avatar
  • 1,937
1 vote
1 answer
154 views

How to use a network interface as read-only?

I have a switch in my home lab that I want to run some experiments with, especially with regards to VLANs and some other protocols that I want to better understand. Now, this switch (a TP-Link 5-port ...
user avatar
  • 111
0 votes
0 answers
217 views

tcpdump to perform wireless capture with advanced filters

I’m trying to use tcpdump to perform realtime wireless captures (without the option to save the file) on a MAC. My wireless interface is en0. I want to use similar filters as I would in Wireshark. My ...
user avatar
  • 47
0 votes
0 answers
18 views

scan specific udp port for local network

So I have a Prometheus server which I use to capture input from port 512 UDP, I have it open, but now I have a problem checking which 512 UDP port on my network is the sender. I tried reading the nmap ...
user avatar
3 votes
1 answer
483 views

How to change color of options in Wireshark in Kali linux?

I am using wireshark in kali linux and all the options are coming out in white. I am not able to read a single thing, Is there any way to change this? I have tried and search the internet for past ...
user avatar
  • 157
1 vote
1 answer
443 views

missing TLS protocol in wireshark preferences

I've installed wireshark on Centos 7.9.2009 however I don't find TLS on the protocols list in preferences settings. Is it something missing to be installed yet or the wireshark version available on ...
user avatar
  • 2,537
1 vote
1 answer
1k views

Why is HAProxy forwarding HTTP2 requests as HTTP 1.1?

I'm trying to configure a load balancer between 2 servers with HAPoxy, this is my configuration: frontend haproxynode bind *:443 ssl crt /etc/ssl/private/isel.pem alpn h2,http/1.1 mode tcp ...
user avatar
0 votes
1 answer
2k views

Determine the PID of a process that is calling out to an IP

My wifi card is tryign to make a connection to a seemingly random IP address on the local network. I want to find which process on the client is trying to make this connection to determine why. This ...
user avatar
0 votes
1 answer
196 views

CORE and Wireshark

I use the CORE network emulator. I try to run Wireshark on one of the nodes via the terminal, but I get this error: QStandardPaths: XDG_RUNTIME_DIR not set, defaulting to '/tmp/runtime-root' qt.qpa....
user avatar
  • 101
0 votes
1 answer
414 views

Macos with Virtualbox and Wireshark on LAN network

I have a virtual machine on a macos, within that virtual machine I have a Debian distribution and I want to use Wireshark to capture all the traffic from the lan network, from virtualbox. I have ...
user avatar
0 votes
1 answer
326 views

Wireshark can't see the dropped packets by iptables

I'm running wireshark(2.6.8) and iptables(v1.8.2 nf_tables) instances on my computer. I saw that others can see the dropped packets with wireshark: How can Wireshark see packets dropped by iptables? ...
user avatar
4 votes
0 answers
103 views

Is there a command like `time` that monitors the network traffic of commands?

I can use the time command to measure the time some command takes: time node -e "" node -e "" 0.06s user 0.01s system 92% cpu 0.076 total Is there a similar way to measure a ...
user avatar
  • 1,287
1 vote
1 answer
336 views

Using tcpdump to trace IP of strangers(predators) on omegle

I am using tcpdump to capture packets while being on omegle. However, I have been fairly unsuccessful to get strangers IP. All the IP I see are traced back to either 172...* which is for google 104....
user avatar
  • 244
0 votes
0 answers
56 views

Why do I get an error when setting monitor mode if the interface is monitor mode capable?

I have these features on my system: iw list Wiphy phy4 max # scan SSIDs: 10 max scan IEs length: 255 bytes max # sched scan SSIDs: 0 max # match sets: 0 max # scan plans: 1 ...
user avatar
  • 101
0 votes
1 answer
106 views

How to find min, max data rate of pcap file

I have pcap file and I want to find min and max data rate. I use Capinfos, it shows only average data rate. I would ask how to do that?
user avatar
0 votes
1 answer
90 views

CLI Utility to see the http requests that'll be made by a command

I have a script which invokes some library code that makes some HTTP and HTTPS requests, let's call it script.sh Is there a command which would look like some-wireshark-type-utility ./script.sh and ...
user avatar
1 vote
1 answer
974 views

No such file or directory: /sys/kernel/debug/usb/usbmon/

I am trying to install wiresahrk on my linux mint 19.2 machine. When executing as root it says: The capture session could not be initiated on interface 'usbmon1' (Can't open USB bus file /sys/kernel/...
user avatar
  • 23
0 votes
1 answer
862 views

Why is a packet is not sent until ACK is received when window size is sufficient

The considered application (server) has a number of clients connected. It processes each message from the client and sends two output messages. The output messages are generated sequencially and ...
user avatar
  • 111
1 vote
0 answers
76 views

I need to install Wireshark on my CentOS VM

I used the following commands to install the tool: $ yum install gcc gcc-c++ bison flex libpcap-devel qt-devel gtk3-devel rpm-build libtool c-ares-devel qt5-qtbase-devel qt5-qtmultimedia-devel qt5-...
user avatar
0 votes
1 answer
36 views

Repeat Tshark command when first done

I have this command that i need to repeat for ever till i stop it. I have to send a capture to my supplier for VOIP support for a intermitent trouble. But 10mb is taking like five minutes to complete....
user avatar
5 votes
2 answers
1k views

Tc qdisc delay not seen in tcpdump recording

I have two linux containers connected with a veth-pair. At veth-interface of one container I set up tc qdisc netem delay and send traffic from it to the other container. If I watch traffic on both ...
user avatar
  • 264
2 votes
0 answers
73 views

Ctrl, Alt, and Super behave like Left Shift and I fixed it in a strange way

I use Arch Linux. I have Qumo Axe keyboard which as it turned out works only on Windows. On Linux, the bottom row keys (Ctrl, Alt, Super) behave like Left Shift, I tried to install drivers which I ...
user avatar
1 vote
1 answer
3k views

How to disable network-connectivity-check on linux mint?

(Virtualbox OS: Linux Mint 19.1 Tessa) I am trying to disable the network-connectivity-check on Linux Mint. This website shows how to disable it in the GUI for Ubuntu 17.10. Unfortunately in Mint ...
user avatar
0 votes
1 answer
2k views

Cannot disable network time control (NTP)

I want to analyze some protocols (ARP, NDP, etc.) inside virtualbox (OS: Linux Mint 19.1 Tessa) using wireshark and tried to disable the "network time control"-synchronization. yuza@VirtualBox:~$ ...
user avatar
3 votes
2 answers
7k views

How to capture WOL packets?

I used sudo tcpdump -v -i eth0 ether proto 0x0842 or udp port 9 but didn't see anything when WakeMeOnLan from NirSoft wakes the computer. The same with Wireshark
user avatar
  • 2,517
0 votes
1 answer
1k views

Wireshark not showing HTTP queries

I am trying to using Wireshark, but when I set filter into http Wireshark not displaying any data. Unfortunately, I can see only tcp/dhcp/arp protocols, but not http: My Wireshark preferences: I ...
user avatar
1 vote
1 answer
1k views

How to filter wireshark output data to only view ttyUSB0 data?

I'm Using Wireshark on Ubuntu 18.04 to monitor my ttyUSB0 USB port output as I'm developing something that requires that. On the website, I found how to get it to sniff USB ports but the output is ...
user avatar
  • 131
0 votes
1 answer
160 views

possible packet loss

I have a program running on my local machine that prints data to port 50000. In a terminal on my local machine I run nc to connect to and print the data on the port. However, when using nc in terminal ...
user avatar
  • 1
2 votes
1 answer
665 views

How to inspect decrypted TLS/SSL traffic in Wireshark from program not supporting SSLKEYLOGFILE?

TL;DR: I feel I'm pretty close to doing so by using sslsplit's interface mirroring, but I ran into an issue where the kernel is not replying to ARP requests that sslsplit is sending out on the ...
user avatar
  • 4,072
0 votes
1 answer
269 views

Freshly installed Wireshark with enabled non-root listen users is not able to listen

I have Linux Mint 19 64-bit Cinnamon. I have just installed wireshark-gtk with: sudo apt-get install wireshark-gtk while installing I was asked this: Answering Yes as you can see, as I am the sole ...
user avatar
1 vote
0 answers
85 views

GUI for application with and without sudo

I was running wireshark when I realized that executing it using sudo and without sudo gave me a different user interface. When running using sudo, it gives me nice sized icon and text. But running it ...
user avatar
  • 113
0 votes
1 answer
1k views

How to trace snmp trap sent by client process?

We have a process(should be a client program) on RHEL 7.4 that send snmp traps to a Solaris server that has trap receiver process(should be a server program listening on 162/1691) on other machine(...
user avatar
  • 1,256
4 votes
2 answers
3k views

How keyboard's drivers work on linux

I recently bought a new keyboard, it was cheap and of an unknown brand but i wasn't particularly worried. I found out that on linux pressing shift, super, left-ctrl or left-alt with this keyboard made ...
user avatar
  • 49
1 vote
2 answers
1k views

Kali Linux Can't Log in as non-root user and wireshark complaining about root

When I opened wireshark (fresh install of live usb kali with persistence) for the first time it complained about me being root. This is what I found in googling it: Yes it's recommended and ...
user avatar
  • 1,725
0 votes
1 answer
292 views

"-qt=5 -version returned non-zero exit status" error when installing Wireshark

When I wanted to install Wireshark software from Source Code on Debian 8 Linux distro, I saw the following error messages: ... ... checking for uic... /usr/bin/uic checking for qtchooser... (cached) /...
user avatar
2 votes
2 answers
6k views

Incoming and outgoing traffic when NOTHING is running

In a system with nothing running (at least nothing I know of). Listening of incoming and outgoing traffic prints this output: 192.168.1.1 => all-systems.mcast.net 0b ...
user avatar
  • 323
0 votes
1 answer
1k views

tshark filters in Centos 7

I am working on some tshark filters , need to split a pcap on timebasis for particular SIP and DIP, I have tried editcap but it can go with time basis only I cannot pass IPADDRESS to editcap, I saw ...
user avatar
  • 191
0 votes
0 answers
23 views

Wireshark mute..why?

I have two host+one router 192.168.0.1 router 192.168.0.2 pc 192.168.0.5 macos On pc i want to capture all packets of macos with wireshark Interface on pc is bridged,br0 I put br0 in promisc mode ...
user avatar
  • 10.9k
1 vote
1 answer
583 views

can I configure SSH so it does not use encryption?

I have an ssh client connecting to an ssh server. I want to investigate what's going on between them, so I would like to dump the traffic with tcpdump and then analyze it with Wireshark. However, I ...
user avatar
0 votes
2 answers
942 views

See graph of text tcpdump

I saved some dump from tcpdump using tcpdump -n -i eth0 -tttt -Q in > "dump01.dump" so i got output like this: 20:39:12.808672 IP 94.xx.xxx.202.49183 > 151.xx.xx.xx.61479: UDP, length 104 20:...
user avatar