Questions tagged [wireshark]
Wireshark is a network capture and protocol analyzer tool. If this question isn't directly about programming, consider asking it on Super User or Network Engineering instead of here.
3,030
questions
-1
votes
0
answers
20
views
TCP blocked until the acknowledgment received [closed]
I am currently facing an issue in my application where the TCP messages seem to be blocked until an acknowledgment received. Specifically, the subsequent messages wait for the acknowledgment of the ...
-1
votes
0
answers
52
views
+50
Python code packet window is shown as full by Wireshark
I have a python code with such a structure:
server_info = (server_address, listen_port)
socket = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
socket.setsockopt(socket.SOL_SOCKET, socket....
1
vote
1
answer
51
views
What is MQPUT_REPLY in wireshark traffic capture?
I am analyzing traffic in IBM MQ using Wireshark. I can see that an MQPUT message is sent to MQ, and approximately 118 ms later, an MQPUT_REPLY message appears. I couldn't find anything in the IBM MQ ...
-1
votes
0
answers
15
views
Unable to capture packets from other devices in wireshark [closed]
I have 2 raspberry pis. There are HTTP packets flowing from one to another. All the network is wireless. I am unable to capture those packets on Wireshark. I am on the same network, with the correct ...
0
votes
0
answers
23
views
Ensuring Exclusion of Weak Ciphers in TLS Handshake using WireShark and PktMon
I am currently working on enhancing the security of our application communication, specifically focusing on the TLS handshake process. I want to make sure that weak ciphers are not part of the TLS ...
-1
votes
0
answers
23
views
Packet sniffing tool does not sniff all network traffic passing through a Hyper-V virtual switch on Windows Server 2019
I have a Windows Server 2019 and two machines (let's say they are called A and B) connected to a physical switch configured in mirroring to Windows Server 2019, which allows sniffing via Wireshark on ...
-1
votes
0
answers
19
views
Filter all 5GHz wifi in WireShark
I would like to filter out all 5GHz wifi traffic, leaving all 2.4GHz wifi traffic in a WireShark capture. I'm not seeing any fields in the captured packets that expose PHY layer information as basis ...
0
votes
0
answers
16
views
How to detect the real IP addresses of an hacker in ARP Spoofing using Wireshark?
I have this capture in Wireshark (cap5.pcap - https://drive.google.com/file/d/1pK_AXieem7ctEUzjgVJa8sqdaxsaFQgs/view?usp=sharing). It represents an ARP Spoofing attack, for academic purposes. The goal ...
0
votes
0
answers
19
views
Cannot get resolved hostname from pyshark/tshark output
I have a wireshark pcapng file with some network scan results. I want to the following fields: source ip, destination ip, source hostname, destination hostname and protocol.
When I open the file with ...
0
votes
0
answers
13
views
Wireshark - Export data with holes / missing packets
I have a pcap file, containing a single tcp stream, but I am missing some data in the middle. Might have been lost for various reasons. Do have some retransmits, but still missing data.
Now, I still ...
0
votes
0
answers
116
views
How to know ip/host and port of Google reCAPTCHA v3? (need to whitelist them)
I have to run Google reCAPTCHA v3 on CentOs which has a restrict access to the Internet.
And the network Admin only allows traffics that I specify source, dest, port....
I'm trying to get those info ...
0
votes
0
answers
12
views
Saving a cap sorted by a value
I have multiple .pcap
But when I drag them into wireshark and click on the timestamp in order to sort it by the timestamp (not the regular time of wireshark, but using another protocol layer that ...
0
votes
1
answer
64
views
Why do I have a 200ms request period in Wireshark when I configure it for 100ms in the Modbus task, using ST language in TwinCAT3?
I create a program to obtain data through Modbus-TCP server (192.168.2.16) on TwinCAT3 to obtain data from other PC (slave: 192.168.2.20):
enter image description here
Also I create and configure the ...
0
votes
0
answers
15
views
How to view short log files on windows?
How to view the short log files in windows cmd prompt if possible ?
On linux sudo snort -r snort.logxxxx can be use to view the logs on the terminal .
Is there any way on windows to view similarly?
I ...
0
votes
0
answers
12
views
SSDP and wireshark: sniff user password
is it possible to sniff user and password from SSDP protocol in Wireshark? Can you show an example?
Thanks
0
votes
0
answers
19
views
Scapy's sniff() function does not capture all packets
I have written a Python program that uses Scapy to capture all the traffic from/to a specific port on the local host, i.e., loopback (the purpose being trying to quantify the amount of traffic).
It ...
0
votes
0
answers
48
views
Lua sub-dissector for rtcp inside a proprietary protocol
I am new to lua script. I am working on dissecting a proprietary protocol. Inside the protocol bytes there are 8 bytes related to rtcp, like, rtcp version, padding, reception report count, packet ...
0
votes
0
answers
21
views
I have traffic captured from Wireshark and need copy only their Hex + ASCII dump
I have traffic captured from Wireshark where http requests are tagged. There are about 12 thousand of them and I need to copy only their Hex + ASCII dump. How to do this automatically?
My capture
I ...
0
votes
0
answers
14
views
Include libxml2 in Wireshark plugin (Windows)
I would like to write my own C-dissector-plugin for Wireshark. I've already downloaded and build Wireshark on my Windows machine and have also added the plugin files (according to https://www....
-2
votes
1
answer
22
views
Wireshark capture filter - shorter ways to define drop lists of ip6 addresses?
Is there some shorter way to define a long list of ip6 addresses to drop as Wireshark capture (not display) filter?
Shorter than capture filters like these, I mean:
host <wanted-ip6-addr> and ...
0
votes
0
answers
65
views
How to use filter on a range of hostname in wireshark?
I am new to wireshark and spend some time but couldn't find the filter for my use-case.
I have lot of hosts which start with
12.xyz.com
13.xyz.com
18.xyz.com
23.xyz.com
11.abc.com
12.abc.com
19.abc....
0
votes
0
answers
45
views
How to replay the traffic recorded by Wireshark using scapy in Windows 10?
I played some traffic from PC a (192.168.0.212) to PC b (192.168.0.234), both are windows 10.
When I played the traffic, the Wireshark is opened, and there is what I saw:
enter image description here
...
0
votes
1
answer
33
views
How to find the host / IP address an application is trying to reach and fails?
I am trying to enroll a Windows 11 system in a Workspace One environment by using some Powershell script.
Everything is successful, the system gets enrolled fine.
However when I open the Intelligent ...
1
vote
0
answers
213
views
ssl tls 1.2 error ACCEPT_SR_KEY_EXCH ssl handshake failure
There is a client and a server which are using the SSL/TLS protocol v1.2 to communicate. The server has a valid certificate issued by the zerossl trusted authority. The client is verified that it can ...
0
votes
0
answers
17
views
Is there an easy way to parse all sent over one stream traffic via the tcp protocol in wireshark?
I have a pcap file. In one moment one computer started sending an elf file to another using tcp protocol. I want to download this file, but I don't know understand how to unite all separated packages ...
0
votes
1
answer
47
views
What are the meanings of the TShark tcp.flags.str labels?
I am working with tshark and I've extracted a field called: tcp.flags.str. I'm having a hard time understanding the meaning of these field values. For example, a few strings might look like:
·······A··...
0
votes
0
answers
66
views
Wireshark can't decrypt TLS from a specific python library
I have a problem. I'm using Wireshark 4.0.8. I created my ssl file to store my "(pre)-master-secrets". I can thus decrypt TLS from my browser or from different python libraries without ...
0
votes
0
answers
22
views
Is there any way to parse a packet in a dictionary format with PyShark?
In PyShark, packet information is displayed in a flat list, making it difficult to discern the hierarchical structure of fields, unlike Wireshark which provide a clear hierarchy.
I attached the ...
0
votes
0
answers
58
views
btsnooz_hci.log truncated packet?
How to capture full BLE packet on HCI sniffing / wireshark. The packet size and capture size are different, no idea why. How to capture the full packet.
Please find the packet capture screenshot below
...
0
votes
1
answer
32
views
UDP broadcast cannot work after network changed?
[Precodition]
PC1(Windows):
LAN Address: 10.0.1.11
WiFi Address: 10.0.1.10
PC2(Windows):
WiFi Address: 10.0.1.4
[Step by step what I did and what the result I got]
Start PC1 with WiFi disabled and ...
0
votes
0
answers
25
views
Unable to put RAR message in default section for Seagull Network Generator tool
I am using Seagull Tool, to test Functionality of RAR,RAA in between PCRF and PCEF system, If i put RAR portion in traffic section, i can see PCRF is generating RAR and RAA is also being populated, ...
1
vote
1
answer
42
views
Lua Script Ends TCP Connection?
I've wrote the following script in Lua to be used with nmap:
action = function()
local target = "46.121.76.117"
local sock = nmap.new_socket("tcp")
sock:set_timeout(10)...
0
votes
0
answers
33
views
PyShark+Django : Unable to make async call when pyshark is used in a Django view
I am using pyshark module in a Django view to get the ports breakdown from an uploaded PCAP file.
views.py
class ProtocolAnalysisView(APIView):
parser_classes = (MultiPartParser,)
def ...
0
votes
0
answers
106
views
what is the reason of tcp reset
I am running two pods in Kubernetes, pod A sends a connection request to pod B, however second pod response with tcp RST. Is there a way to guess from the Wireshark capture to see why reset happened ? ...
0
votes
1
answer
109
views
duplicate packets in wireshark during playback
I'm writing and testing a script that digs into UDP network traffic and looks for certain data values in each packet. To do all this development while I'm at my desk--not connected to the physical ...
0
votes
0
answers
31
views
Tls 1.3 - I don't understand servers ApplicationData
I am analyzing connection between my client and remote server in TLS 1.3. I send all handshake finished messages and my application data with GET request in it. I always get the same response, I cant ...
0
votes
0
answers
45
views
Wireshark showed/captured http get image packet but socket won't receive it [duplicate]
I have a simple webserver and 1 simple index.html webpage with only 1 image element in it to send to the web client.
I have a Chrome web browser run on an Android Phone to get that webpage from that ...
0
votes
0
answers
39
views
sshdump' is not recognized as an internal or external command
I am using wireshark version 4.0.7 with "Sshdump, Ciscodump, Wifidump" tool installed. However when i run the sshdump command it gives the error "'sshdump' is not recognized as an ...
0
votes
0
answers
22
views
Want to run below tcpreplay using python code on Linux
Want to run below tcpreplay command using python code on Linux instance can you please give a working sample
tcpreplay-edit -i ens7 -I ens8 --loop=20000 --enet-smac srcmac,dstmac --enet-dmac dstmac,...
0
votes
0
answers
28
views
problem in sending and receiving data over mobile data hotspot
I have made a programming game which can be played online using C++, underlying protocol is UDP, the game was running smooth on my home wi-fi. When I am using my mobile hotspot, somehow the client and ...
0
votes
0
answers
30
views
Error loading wrapper for shared library in lua plugin
I’m attempting to write a C wrapper for a shared library that would expose it to lua so that it can be called by a lua plugin.
I recreated the error with minimal code, using the following four files:
/...
0
votes
2
answers
287
views
Docker bind() to 0.0.0.0:3000 failed
Okay so I am fairly new to the whole Docker and Networks thing, so sorry in advance.
For the last week I experimented with Docker compose and got AdGuard and Jellyfin running and got Homer setup as a ...
0
votes
1
answer
581
views
Enable monitor mode on Linux for Wireshark
I need to enable monitor mode on my Lenovo Legion computer running Ubuntu 22.04.2 LTS to start sniffing wifi traffic through Wireshark.
I've correctly installed Wireshark through apt-get install but ...
0
votes
0
answers
16
views
Testing: disconnect TLS connection
I have a mobile application which connects via TLS to a back end. I would like to test if the connection is re-established timely by the mobile application if the existing TLS connection is ...
0
votes
1
answer
73
views
Lua script does not print results to wireshark console
So, I have written the following Lua script for my work but it does not show any output in the WireShark console for TCP at 443.
local plugin = {}
function plugin.init() --I have initialized the ...
0
votes
1
answer
50
views
CMake Error: Unknown Language comes while try to build
I am trying to compile an really old piece of code- wireshark version 1.9.2, on Ubuntu.
when i run the command cmake .. on it the following error shows up.
CMake Error at /usr/share/cmake-3.16/Modules/...
0
votes
0
answers
29
views
Dumping RRC packets
I am trying to capture RRC messages sending in/out of a container using tcpdump. I cannot find the proper filter for that. I tried to run tcpdump inside the container by tcpdump -i any rrc. However,I ...
0
votes
0
answers
35
views
Dissector table doesn't exist while registering subdissector for ZMTP
I'm trying to create an "out-of-tree" dissector plugin for my protocol:
My protocol messages are encapsulated into ZMTP frames, so I'm using this Lua dissector.
Regarding subdissectors, we ...
1
vote
0
answers
36
views
How Can Call Sub Dissector in Wireshark on Lua
In wireshark there is message payload which is actually IEEE 802.11 association request. And i want to show this message as association request format. Normally association request frame parsed in ...
2
votes
0
answers
150
views
Why is my uninstall / reinstall failing for the Wireshark cask on Homebrew?
Something must have gotten borked when I was trying to install the Wireshark Cask using Homebrew, and now it will not uninstall or reinstall the program to try and fix it. I am using a Mac running ...