Questions tagged [wireshark]

Wireshark is a network capture and protocol analyzer tool. If this question isn't directly about programming, consider asking it on Super User or Network Engineering instead of here.

Filter by
Sorted by
Tagged with
-1 votes
0 answers
20 views

TCP blocked until the acknowledgment received [closed]

I am currently facing an issue in my application where the TCP messages seem to be blocked until an acknowledgment received. Specifically, the subsequent messages wait for the acknowledgment of the ...
myprogramistoobusywitherrors's user avatar
-1 votes
0 answers
52 views
+50

Python code packet window is shown as full by Wireshark

I have a python code with such a structure: server_info = (server_address, listen_port) socket = socket.socket(socket.AF_INET, socket.SOCK_STREAM) socket.setsockopt(socket.SOL_SOCKET, socket....
mercury's user avatar
  • 146
1 vote
1 answer
51 views

What is MQPUT_REPLY in wireshark traffic capture?

I am analyzing traffic in IBM MQ using Wireshark. I can see that an MQPUT message is sent to MQ, and approximately 118 ms later, an MQPUT_REPLY message appears. I couldn't find anything in the IBM MQ ...
user18032014's user avatar
-1 votes
0 answers
15 views

Unable to capture packets from other devices in wireshark [closed]

I have 2 raspberry pis. There are HTTP packets flowing from one to another. All the network is wireless. I am unable to capture those packets on Wireshark. I am on the same network, with the correct ...
Riddhish Lichade's user avatar
0 votes
0 answers
23 views

Ensuring Exclusion of Weak Ciphers in TLS Handshake using WireShark and PktMon

I am currently working on enhancing the security of our application communication, specifically focusing on the TLS handshake process. I want to make sure that weak ciphers are not part of the TLS ...
kudlatiger's user avatar
  • 3,098
-1 votes
0 answers
23 views

Packet sniffing tool does not sniff all network traffic passing through a Hyper-V virtual switch on Windows Server 2019

I have a Windows Server 2019 and two machines (let's say they are called A and B) connected to a physical switch configured in mirroring to Windows Server 2019, which allows sniffing via Wireshark on ...
vtyety's user avatar
  • 1
-1 votes
0 answers
19 views

Filter all 5GHz wifi in WireShark

I would like to filter out all 5GHz wifi traffic, leaving all 2.4GHz wifi traffic in a WireShark capture. I'm not seeing any fields in the captured packets that expose PHY layer information as basis ...
stephen's user avatar
  • 1,039
0 votes
0 answers
16 views

How to detect the real IP addresses of an hacker in ARP Spoofing using Wireshark?

I have this capture in Wireshark (cap5.pcap - https://drive.google.com/file/d/1pK_AXieem7ctEUzjgVJa8sqdaxsaFQgs/view?usp=sharing). It represents an ARP Spoofing attack, for academic purposes. The goal ...
Rafael Seco's user avatar
0 votes
0 answers
19 views

Cannot get resolved hostname from pyshark/tshark output

I have a wireshark pcapng file with some network scan results. I want to the following fields: source ip, destination ip, source hostname, destination hostname and protocol. When I open the file with ...
cornisto's user avatar
  • 129
0 votes
0 answers
13 views

Wireshark - Export data with holes / missing packets

I have a pcap file, containing a single tcp stream, but I am missing some data in the middle. Might have been lost for various reasons. Do have some retransmits, but still missing data. Now, I still ...
povlhp's user avatar
  • 72
0 votes
0 answers
116 views

How to know ip/host and port of Google reCAPTCHA v3? (need to whitelist them)

I have to run Google reCAPTCHA v3 on CentOs which has a restrict access to the Internet. And the network Admin only allows traffics that I specify source, dest, port.... I'm trying to get those info ...
Deckard's user avatar
  • 1,419
0 votes
0 answers
12 views

Saving a cap sorted by a value

I have multiple .pcap But when I drag them into wireshark and click on the timestamp in order to sort it by the timestamp (not the regular time of wireshark, but using another protocol layer that ...
mimente1200's user avatar
0 votes
1 answer
64 views

Why do I have a 200ms request period in Wireshark when I configure it for 100ms in the Modbus task, using ST language in TwinCAT3?

I create a program to obtain data through Modbus-TCP server (192.168.2.16) on TwinCAT3 to obtain data from other PC (slave: 192.168.2.20): enter image description here Also I create and configure the ...
juanda_'s user avatar
0 votes
0 answers
15 views

How to view short log files on windows?

How to view the short log files in windows cmd prompt if possible ? On linux sudo snort -r snort.logxxxx can be use to view the logs on the terminal . Is there any way on windows to view similarly? I ...
Salman Faris's user avatar
0 votes
0 answers
12 views

SSDP and wireshark: sniff user password

is it possible to sniff user and password from SSDP protocol in Wireshark? Can you show an example? Thanks
Luis Andrés García's user avatar
0 votes
0 answers
19 views

Scapy's sniff() function does not capture all packets

I have written a Python program that uses Scapy to capture all the traffic from/to a specific port on the local host, i.e., loopback (the purpose being trying to quantify the amount of traffic). It ...
EP1's user avatar
  • 41
0 votes
0 answers
48 views

Lua sub-dissector for rtcp inside a proprietary protocol

I am new to lua script. I am working on dissecting a proprietary protocol. Inside the protocol bytes there are 8 bytes related to rtcp, like, rtcp version, padding, reception report count, packet ...
Roni Samara's user avatar
0 votes
0 answers
21 views

I have traffic captured from Wireshark and need copy only their Hex + ASCII dump

I have traffic captured from Wireshark where http requests are tagged. There are about 12 thousand of them and I need to copy only their Hex + ASCII dump. How to do this automatically? My capture I ...
Leamistrik's user avatar
0 votes
0 answers
14 views

Include libxml2 in Wireshark plugin (Windows)

I would like to write my own C-dissector-plugin for Wireshark. I've already downloaded and build Wireshark on my Windows machine and have also added the plugin files (according to https://www....
Shounbourgh's user avatar
-2 votes
1 answer
22 views

Wireshark capture filter - shorter ways to define drop lists of ip6 addresses?

Is there some shorter way to define a long list of ip6 addresses to drop as Wireshark capture (not display) filter? Shorter than capture filters like these, I mean: host <wanted-ip6-addr> and ...
Jürgen Thelen's user avatar
0 votes
0 answers
65 views

How to use filter on a range of hostname in wireshark?

I am new to wireshark and spend some time but couldn't find the filter for my use-case. I have lot of hosts which start with 12.xyz.com 13.xyz.com 18.xyz.com 23.xyz.com 11.abc.com 12.abc.com 19.abc....
VIPIN KUMAR's user avatar
  • 3,049
0 votes
0 answers
45 views

How to replay the traffic recorded by Wireshark using scapy in Windows 10?

I played some traffic from PC a (192.168.0.212) to PC b (192.168.0.234), both are windows 10. When I played the traffic, the Wireshark is opened, and there is what I saw: enter image description here ...
Chien-Shuan Ho's user avatar
0 votes
1 answer
33 views

How to find the host / IP address an application is trying to reach and fails?

I am trying to enroll a Windows 11 system in a Workspace One environment by using some Powershell script. Everything is successful, the system gets enrolled fine. However when I open the Intelligent ...
florian's user avatar
  • 35
1 vote
0 answers
213 views

ssl tls 1.2 error ACCEPT_SR_KEY_EXCH ssl handshake failure

There is a client and a server which are using the SSL/TLS protocol v1.2 to communicate. The server has a valid certificate issued by the zerossl trusted authority. The client is verified that it can ...
Semen Shekhovtsov's user avatar
0 votes
0 answers
17 views

Is there an easy way to parse all sent over one stream traffic via the tcp protocol in wireshark?

I have a pcap file. In one moment one computer started sending an elf file to another using tcp protocol. I want to download this file, but I don't know understand how to unite all separated packages ...
Pro_Noob_228's user avatar
0 votes
1 answer
47 views

What are the meanings of the TShark tcp.flags.str labels?

I am working with tshark and I've extracted a field called: tcp.flags.str. I'm having a hard time understanding the meaning of these field values. For example, a few strings might look like: ·······A··...
CopyOfA's user avatar
  • 779
0 votes
0 answers
66 views

Wireshark can't decrypt TLS from a specific python library

I have a problem. I'm using Wireshark 4.0.8. I created my ssl file to store my "(pre)-master-secrets". I can thus decrypt TLS from my browser or from different python libraries without ...
Big BG's user avatar
  • 1
0 votes
0 answers
22 views

Is there any way to parse a packet in a dictionary format with PyShark?

In PyShark, packet information is displayed in a flat list, making it difficult to discern the hierarchical structure of fields, unlike Wireshark which provide a clear hierarchy. I attached the ...
Mohamed Chaaben's user avatar
0 votes
0 answers
58 views

btsnooz_hci.log truncated packet?

How to capture full BLE packet on HCI sniffing / wireshark. The packet size and capture size are different, no idea why. How to capture the full packet. Please find the packet capture screenshot below ...
Karthik Singaram's user avatar
0 votes
1 answer
32 views

UDP broadcast cannot work after network changed?

[Precodition] PC1(Windows): LAN Address: 10.0.1.11 WiFi Address: 10.0.1.10 PC2(Windows): WiFi Address: 10.0.1.4 [Step by step what I did and what the result I got] Start PC1 with WiFi disabled and ...
chaingun's user avatar
0 votes
0 answers
25 views

Unable to put RAR message in default section for Seagull Network Generator tool

I am using Seagull Tool, to test Functionality of RAR,RAA in between PCRF and PCEF system, If i put RAR portion in traffic section, i can see PCRF is generating RAR and RAA is also being populated, ...
Rajdip Bose's user avatar
1 vote
1 answer
42 views

Lua Script Ends TCP Connection?

I've wrote the following script in Lua to be used with nmap: action = function() local target = "46.121.76.117" local sock = nmap.new_socket("tcp") sock:set_timeout(10)...
Dan's user avatar
  • 17
0 votes
0 answers
33 views

PyShark+Django : Unable to make async call when pyshark is used in a Django view

I am using pyshark module in a Django view to get the ports breakdown from an uploaded PCAP file. views.py class ProtocolAnalysisView(APIView): parser_classes = (MultiPartParser,) def ...
user22180181's user avatar
0 votes
0 answers
106 views

what is the reason of tcp reset

I am running two pods in Kubernetes, pod A sends a connection request to pod B, however second pod response with tcp RST. Is there a way to guess from the Wireshark capture to see why reset happened ? ...
myquest9 sh's user avatar
0 votes
1 answer
109 views

duplicate packets in wireshark during playback

I'm writing and testing a script that digs into UDP network traffic and looks for certain data values in each packet. To do all this development while I'm at my desk--not connected to the physical ...
Vcrewchief's user avatar
0 votes
0 answers
31 views

Tls 1.3 - I don't understand servers ApplicationData

I am analyzing connection between my client and remote server in TLS 1.3. I send all handshake finished messages and my application data with GET request in it. I always get the same response, I cant ...
Piotr_Kowalski's user avatar
0 votes
0 answers
45 views

Wireshark showed/captured http get image packet but socket won't receive it [duplicate]

I have a simple webserver and 1 simple index.html webpage with only 1 image element in it to send to the web client. I have a Chrome web browser run on an Android Phone to get that webpage from that ...
The Mr. Totardo's user avatar
0 votes
0 answers
39 views

sshdump' is not recognized as an internal or external command

I am using wireshark version 4.0.7 with "Sshdump, Ciscodump, Wifidump" tool installed. However when i run the sshdump command it gives the error "'sshdump' is not recognized as an ...
Himanshu Gupta's user avatar
0 votes
0 answers
22 views

Want to run below tcpreplay using python code on Linux

Want to run below tcpreplay command using python code on Linux instance can you please give a working sample tcpreplay-edit -i ens7 -I ens8 --loop=20000 --enet-smac srcmac,dstmac --enet-dmac dstmac,...
Arun K's user avatar
  • 1
0 votes
0 answers
28 views

problem in sending and receiving data over mobile data hotspot

I have made a programming game which can be played online using C++, underlying protocol is UDP, the game was running smooth on my home wi-fi. When I am using my mobile hotspot, somehow the client and ...
oppenheimer's user avatar
0 votes
0 answers
30 views

Error loading wrapper for shared library in lua plugin

I’m attempting to write a C wrapper for a shared library that would expose it to lua so that it can be called by a lua plugin. I recreated the error with minimal code, using the following four files: /...
jerome's user avatar
  • 1
0 votes
2 answers
287 views

Docker bind() to 0.0.0.0:3000 failed

Okay so I am fairly new to the whole Docker and Networks thing, so sorry in advance. For the last week I experimented with Docker compose and got AdGuard and Jellyfin running and got Homer setup as a ...
bennyyy999's user avatar
0 votes
1 answer
581 views

Enable monitor mode on Linux for Wireshark

I need to enable monitor mode on my Lenovo Legion computer running Ubuntu 22.04.2 LTS to start sniffing wifi traffic through Wireshark. I've correctly installed Wireshark through apt-get install but ...
ohhConti's user avatar
0 votes
0 answers
16 views

Testing: disconnect TLS connection

I have a mobile application which connects via TLS to a back end. I would like to test if the connection is re-established timely by the mobile application if the existing TLS connection is ...
René Heuven's user avatar
0 votes
1 answer
73 views

Lua script does not print results to wireshark console

So, I have written the following Lua script for my work but it does not show any output in the WireShark console for TCP at 443. local plugin = {} function plugin.init() --I have initialized the ...
Dark Vedar's user avatar
0 votes
1 answer
50 views

CMake Error: Unknown Language comes while try to build

I am trying to compile an really old piece of code- wireshark version 1.9.2, on Ubuntu. when i run the command cmake .. on it the following error shows up. CMake Error at /usr/share/cmake-3.16/Modules/...
Dying Falcon's user avatar
0 votes
0 answers
29 views

Dumping RRC packets

I am trying to capture RRC messages sending in/out of a container using tcpdump. I cannot find the proper filter for that. I tried to run tcpdump inside the container by tcpdump -i any rrc. However,I ...
azLe's user avatar
  • 19
0 votes
0 answers
35 views

Dissector table doesn't exist while registering subdissector for ZMTP

I'm trying to create an "out-of-tree" dissector plugin for my protocol: My protocol messages are encapsulated into ZMTP frames, so I'm using this Lua dissector. Regarding subdissectors, we ...
Unda's user avatar
  • 1,827
1 vote
0 answers
36 views

How Can Call Sub Dissector in Wireshark on Lua

In wireshark there is message payload which is actually IEEE 802.11 association request. And i want to show this message as association request format. Normally association request frame parsed in ...
Abdurrahman Uslu's user avatar
2 votes
0 answers
150 views

Why is my uninstall / reinstall failing for the Wireshark cask on Homebrew?

Something must have gotten borked when I was trying to install the Wireshark Cask using Homebrew, and now it will not uninstall or reinstall the program to try and fix it. I am using a Mac running ...
PraderaNoire's user avatar

1
2 3 4 5
61