Questions tagged [wireshark]

Wireshark is a network capture and protocol analyzer tool. If this question isn't directly about programming, consider asking it on Super User or Network Engineering instead of here.

wireshark
Filter by
Sorted by
Tagged with
0 votes
1 answer
582 views

Why is GStreamer using dynamic RTP Type 96 instead of the static payload types PCMU or PCMA and how to change that?

I am trying to send audio data with a GStremer pipe trough my network. I wan´t to do it with UDP using the RTP protokoll using the payload number 0 or 1. If i set my pipe with those parameters (clock=...
1 vote
0 answers
29 views

Decrypted radius access-request packet has appended characters to password

I am configuring radius for various pieces of equipment on my network. A certain subset of equipment is getting access-reject packets even though I have everything set up correctly from what I can ...
0 votes
0 answers
100 views

sometimes Wireshark does not capture ongoing tcp traffic

I have a TCP socket client and a server on different hosts within local networks. They engage in a simple P2P request and response data exchange. Occasionally, I encounter sudden disconnections and ...
-2 votes
1 answer
54 views

Wireshark's time column only displays zeroes. What can I do to fix this?

Im using wireshark and the time column doesn't show captured time, only zeroes. Any ideas? What can I do to make time column shows correct value? Thanks! I tried to change some settings in view-time ...
0 votes
1 answer
432 views

WireShark filtering just first part of the IP address

I want to filter only addresses whose first half looks like this 239.145.x.x How can I create a filter that will detect all IP addresses starting with 239.145?
0 votes
0 answers
96 views

How do I use gstreamer to listen to AVTP packets and decode H264 data?

I am trying to use gstreamer to listen to AVTP packets from an interface and decode H264 data from it. I have packets coming through an interface eno1, I ran this command0 gst-launch-1.0 avtpsrc ...
4 votes
3 answers
4k views

Cant find wireshark's init.lua on my CentOS machine

So I'm trying to get a script working with tshark on my CentOS 7 server, but I'm having problems. The script works fine on my Windows laptop, I just put it in the plugins folder in appdata, but I can'...
0 votes
2 answers
843 views

Second Simulcrypt layer field value with same name is not accessible

(This issue is similar to Alex Wang's question, but the answer there was protocol-specific) I like that Wireshark has support for Simulcrypt but there are limitations: display filters are applied at ...
0 votes
1 answer
414 views

WireShark Log - On a TCP/IP connection between two hosts, multiple [FIN, ACK] and [ACK] responses, then eventual [RST, ACK] flags in response. Why?

Communications between two hosts are established using a socket connection, and 10.12.10.1 is able to send data to 10.10.12.217 every second. For some unknown reason, .217 starts sending [FIN, ACK] ...
0 votes
0 answers
37 views

spring boot websocket handshake takes too long

I am using websocket spring boot to establish websocket. But it takes too long to handshake the websocket. Could you please help to point me out? websocket connect quickly, but it takes more than 6 ...
0 votes
2 answers
3k views

Is it possible detect all multicast ip through Wireshark?

I was streaming an audio file using multicast, UDP protocol, and 224.0.0.1 IP. And easily can detect the network stream through Wireshark. But if I change IP 224.0.0.1 to 224.0.0.149, then streaming ...
12 votes
1 answer
10k views

How do I format tshark time to ISO format (yyyy-dd-mm)?

I'm trying to print out various fields from a PCAP containing HTTP traffic. One of the columns should be the timestamp in the ISO 8601 format (YYYY-MM-DD hhmmss). Also, if anyone has a full list of ...
0 votes
2 answers
1k views

802.11 Sniffer Capture Analysis deauth packets with wireshark

I'm trying to analyse my Sniffer Capture and to get information about the STA, who sends deauth packets. Actually I'm doing it with my laptop and my AP to test my WLAN security aireplay-ng [...
0 votes
0 answers
591 views

How to filter out TCP retransmission packets using tcpdump

I have a pcap file which I am analyzing. Basically in this file there are some TCP Retransmission packets which I want to filter out and leave the others. I know how to do it in wireshark using: not ...
0 votes
0 answers
666 views

Extract SNI from QUIC Initial packet Pyshark

I am using trying to use pyshark to extract the SNI information from TLS handshake frame in the quic packets captured and stored in pcap format using wireshark. In Wireshark, I am able to see the ...
0 votes
0 answers
320 views

How to extract TLS pre-master secret in .NET?

I am debugging a TLS HTTP/2 connection, and want to inspect the traffic for a simple .NET Core application in Wireshark, but without the TLS pre-master secret I'm unable to view the HTTP/2-messages. ...
1 vote
1 answer
466 views

PROFINET gsdml to gsd file conversion

Is there a way of conversion from GSDML (GSD*.xml) file to a plain GSD file? I have an GSDML file and the Wireshark that I use to decode messages is only accepting GSD files. Or maybe without ...
0 votes
0 answers
194 views

NPM ERR - npm install cap/pcap

I have an error when I try to npm install cap/pcap or any other nodejs library of the same style. However I have visual studio, python, npcap installed on my pc I'm on windows 11, does anyone know ...
1 vote
0 answers
47 views

Mocking BLE controller, inferring destination characteristic problem

I am trying to mock an Android-application based, BLE controller of some device (a Tennis Launcher). In order to do that, I sniffed the packets transferred within the connection, and loaded them into ...
0 votes
1 answer
41 views

Is it possible to apply Wireshark filter using mask?

What I am trying to achieve if to define a mask that could select frames with corresponding type_subtype: wlan.fc.type_subtype &= 0xc02f Is there some kind of functionality in Wireshark to get ...
1 vote
1 answer
412 views

piping tcpdump from a docker container to local macOS Wireshark instance

I've attached a tcpdump sidecar to one of my containers and I'm trying feed the capture into a local instance of Wireshark on macOS. This kicks back pretty much as soon as it starts, with the Frame 1 ...
0 votes
0 answers
34 views

generating traffic for HTTP1 and HTTP2

I need to generate traffic for let say http(s)://abc.com for both HTTP1 and HTTP2 for which I am using fidller and with some twist wireshark(for HTTP2 decrypted) respectively. But I have to visit the ...
0 votes
0 answers
21 views

How are time durations calculated and presented in Web Browser Network Consoles?

Say that I am accessing a web site, and technically, different HTTP(S) GET requests are usually sent to different servers to download the resources (scripts, css, markup files, images, etc). By using ...
1 vote
1 answer
1k views

SIP protocol do not display in wireshark when doing phone call by using linphone

I am using linphone to do a voice all between two computers. And I tried to analyze the SIP packet through wireshark but it did not displayed any. I filtred by using the address ip of the other PC. I ...
0 votes
1 answer
399 views

Some fields are empty when using tshark convert to csv

I am trying to capture traffic from an ethernet using tshark, then convert it to txt for analysis, I am using the following command: tshark -N n -T fields -i ethernet -e "frame.number" -e &...
1 vote
4 answers
4k views

wireshark protocol filter not working

i have this Wireshark snapshot and im trying to filter for the mdns protocol by just typing: mdns but it's not working. however filtering for http is working fine. whats am i doing wrong? Thanks ![...
5 votes
1 answer
4k views

Wireshark: how to display packet comments?

I'd like to change my Wireshark display to show packet comments I've added as a new column. I added a new "custom" column and set the field to "pkt_comment". Which does indeed add ...
-1 votes
1 answer
328 views

Is there a way to set promiscuous mode on mac through code?

In wireshark, you can set the promiscuous mode to capture all packets. What is the underlying principle of the mac computer? I want to set mac's promiscuous mode through code
1 vote
2 answers
1k views

Convert log file to PCAP

I have some log file that I want to convert to PCAP file format to be opened in Wireshark. The log file is UDS (Unified Diagnostic Services) log of a car firmware update. What is the best practice to ...
-2 votes
1 answer
2k views

How to analyse CANopen with Wireshark?

I've got wireshark 2.2.6 running under ubuntu 16.04. I want to analyse canOpen traffic on vcan0. Following this tutorial wireshark wiki I have tried entering 'canopen' into the filter bar, but ...
-1 votes
1 answer
143 views

Construct a pcap record from a csv record using C# .Net libraries

I have a CSV record as shown below. "1","0.000000","2.1.1.2","2.1.1.1","IPv4","1010","Fragmented IP protocol (proto=ICMP 1, off=0, ID=...
0 votes
1 answer
541 views

Getting an Error opening pcap file in wireshark

While trying to open a pcap file, I am getting below error. pcap: network type 512 unknown or unsupported Can anyone explain me what the 512 refers to ?
1 vote
2 answers
434 views

Python parsing JSON count Blocks

I have a .json file exported from Wireshark which has the following example: "_source": { "layers": { "frame": { "frame.encap_type": "1", ...
3 votes
2 answers
4k views

Alternative to Wireshark for raw Ethernet capture over USB-Ethernet adapter

(Apologies: I uninstalled and reinstalled WinPcap and now I can see the extra interface! Suggestion found in Wireshark FAQ. I leave the original question below.) I use WireShark to examine ethernet ...
1 vote
1 answer
569 views

Wireshark decoding of BLE data

I'm trying to decode the data received from a Bluetooth beacon : I'm using Wireshark with an nRF BLE Sniffer. I'm able to receive the data from my beacon : Data from the beacon Now I'd like to decode ...
-1 votes
2 answers
685 views

Wireshark not showing SNMP

I am having an issue with wireshark capture. The wireshark doesn't show SNMP protocol but as UDP and complaints as malformed packet.1: https://i.stack.imgur.com/EXcfN.jpg May I know the reason and ...
0 votes
1 answer
621 views

How to simulate the usb keyboard to send commend to PC?

I've used wireshark and get the usb data packets about the "w" key press and on ,then I wanna send the same data packet to my computer usb, making the computer think that my keyboard really ...
1 vote
1 answer
631 views

How can I get raw hex data from .pcap

I need to get raw hex data from file.pcap just like in the programm 010Editor (screenshot 1) Especially i need to extract timestamp from packets. Now i use this Python code: ##import pyshark from ...
0 votes
1 answer
639 views

How to setup CICFlowmeter in Ubuntu?

I am trying to use CICFlowmeter (https://pypi.org/project/cicflowmeter/) which is a tool that extracts feature from pcap file and converts them into a csv file. I have tried on windows 10,11 but for ...
0 votes
1 answer
384 views

How to access MAC addresses/ETH Layrer in pyshark?

I am trying to find a way to access the MAC address of a packet, or at the very least how to access the ethernet layer(or if it is possible in the first place??). I know that pyshark has the ethernet ...
2 votes
1 answer
6k views

Postman gives right response but restassured returns wrong response

I have been working with rest assured since few months. While getting data from an open source API observed that when GET call is made via Postman API returns 200 and valid/expected data is received. ...
0 votes
1 answer
2k views

how to use Wireshark between k8s pods

I want to use Wireshark to sniff packets between two k8s pods. I want to run Wireshark on my host laptop where k8s is installed. Basically, I need to run Wireshark from the node and capture inter pod ...
0 votes
1 answer
193 views

Pcap data to .ts file script

I want to get the UDP stream of a pcap file, get the raw data and save to a .ts file. I now i can do that in Wireshark doing: analyze->follow->UDP stream->show and save data as raw->save ...
0 votes
0 answers
114 views

Python UDP receiver raises timeout error with high package rate while wireshark receives data

I'm trying to make a simple UDP receiver, using python, to read a continuous data stream from a data aquisition device. This device can be configured to send data using UDP protocol to a certain IP ...
0 votes
0 answers
56 views

wireshark can catch tcp package,but my socket can not recieve data

Recently,I code a simple demo of socket to connect my server,which support sftp service. Socket soc = new Socket("172.16.195.250",22); // ip:172.16.195.250 port:22 boolean isConnect = soc.isConnect();...
-2 votes
1 answer
5k views

how to capture wifi router mac address without connecting to the netwotk [closed]

i got d-link wifi repeater, at setup it displays all SSIDs in the area with their mac address without connecting.. so i was looking for command or utility for any OS that can capture mac address like ...
1 vote
1 answer
70 views

what is ``differentiated service : congestion experienced``?

I was trying to send packets and capture them using wireshark to see how they look like using scapy sr1(IP(src='192.168.1.35', dst='192.168.1.1', tos=3)/'my packet') when i sent the packet and ...
0 votes
0 answers
734 views

how to make ethernet and ieee802.3 frames in scapy python3

import scapy.all as scapy #Here i define some arguments i want to modify at layer 2 payload = "hello, here is my first message!" destinationMAC = "ff:ff:ff:ff:ff:ff" sourceMAC = &...
1 vote
1 answer
662 views

TCP Connection Reset on ESXI 6.7

I am running windows and ubuntu clients on ESXi 6.7 on internet root server. When entering some websites (“bbc.co.uk”,”web.de”) the webserver reset my TCP connection, the server send ...
2 votes
0 answers
3k views

Exception A connection attempt failed because the connected party did not properly respond after a period of time

We get this Exception "A connection attempt failed because the connected party did not properly respond after a period of time, or established connection failed because connected host has failed ...

1
3 4
5
6 7
61