Server Fault Stack Exchange
Server Fault Stack Exchange

Questions tagged [wireshark]

Wireshark is an open source Network Protocol Analyzer under GNU License.

507 questions
0
votes
1 answer

In WireShark, what exactly is X-FCCKV2?

When I filtered HTTP traffic in Wireshark I bumped into a X-FCCKV2 HTTP header in the collected info under the Hypertext Transfer Protocol. I've researched it on Google but found nothing. What does it stand for? Is it some kind of encryption?
platypus
  • 281
  • 1
  • 4
  • 11
0
votes
2 answers

Capturing local traffic on Windows Server 2008 R2

I've got three different applications running on the same Windows Server 2008 R2 machine that communicate with eachother over TCP/IP. All three applications use the actual IP address of the server (vs using the loopback interface), which is…
Bryan
  • 205
  • 1
  • 5
  • 13
0
votes
2 answers

Problem with WireShark (MySQL sniffing)

How can I snif MySQL data using WireShark? Also I used «mysqlsniffer» and have no results. There are no any packets from MySQL. I've filtered by «MySQL.isPresent» in WireShark but nothing happened. MySQL installed on Ubuntu 10.10 from…
Clark
  • 347
  • 2
  • 5
  • 13
0
votes
2 answers

Getting wireshark to see network (uplink) traffic?

I have wireshark on a win 7 toshiba laptop plugged in to a hp procurve switch. I set the port the laptop is plugged in to as a 'monitor' port, monitoring all the other ports. I have 1 other computer plugged in to the switch and then an uplink line…
Scott Szretter
  • 1,882
  • 11
  • 43
  • 66
0
votes
3 answers

How to tell which interface was used for capturing data in a wireshark capture file

I have an old capture file that needs analysis, and I need to know which interface was chosen to capture the traffic, is there a way to find out?
Mr Shoubs
  • 363
  • 2
  • 9
  • 32
0
votes
1 answer

What is nicetec-mgmt on port 2557?

I've been looking at wireshark, and have a lot of UDP traffic to port 2557 (from 25322), the port is reportedly used for nicetec-mgmt, does anyone know what this is?
Mr Shoubs
  • 363
  • 2
  • 9
  • 32
0
votes
2 answers

Allow connections to only a specific URL via HTTPS with iptables, -m recent (potentially) and -m string (definitely)

Let's say that, for example, I want to allow connections only to subdomain.mydomain.com; I have it partially working, but it sometimes gets in a freaky loop with the client key exchange once the Client Hello is allowed. Ah, to make it even more…
The Consumer
  • 1
  • 1
  • 3
0
votes
2 answers

unable to sniff traffic despite network interface being in monitor or promiscuous mode

I'm trying to sniff out my network's wireless traffic but am having issues. I'm able to put the card in monitor mode, but am unable to see any traffic except broadcasts, multicasts and probe/beacon frames. I have two network interfaces on this…
sybind
  • 327
  • 1
  • 4
  • 14
0
votes
1 answer

Network Monitoring from one port on switch

Monitoring the all network traffic from one port on the switch and captured the all traffic by using wireshark. Here i found all packet captured in the summary result and it has dropped packet information also. This is some thing lost packets in the…
chirug
  • 1
  • 1
0
votes
2 answers

Cisco switch sending out excessive STP packets

I have a Catalyst 2900 that's sending out an STP packet about once ever 1-2 seconds. Is that excessive?
blsub6
  • 1,131
  • 6
  • 25
  • 45
0
votes
1 answer

Convert .txt file to .cap to open it by Wireshark

I have packet in a text file how I can convert it to .cap file? I need to analyze this packet by Wireshark. Thanks
user56693
0
votes
1 answer

wireshark extract w3c log file

Does anyone know how I would go about extracting urls in w3c extended log format from a wireshark pcap capture file?
Mike
  • 196
  • 1
  • 2
  • 13
0
votes
2 answers

When analyzing packets with Wireshark, is there a way to know which program is sending which packet?

is there an easy way to know from where the packets come from? Which program? My pc which is on 192.168.0.100 is continuously sending packets (TCP and SMB) to an unknown host (192.168.1.99) and I can't figure out which program is doing that.
Keyne Viana
  • 215
  • 1
  • 4
  • 9
0
votes
1 answer

RST ACK over SSL in FireFox POST request

The original question is here. In short, for few users several POST requests hangs and are aborted after couple of minutes, when working over SSL (http is OK). What I'm asking here is an explanation of the WireShark log: No. Time Source …
queen3
  • 101
  • 2
0
votes
1 answer

Is it possible to export Wireshark syslogs to another device?

My company is trying to export the live captured packet syslogs to a device within the network. We were just wondering if it is actually possible to do it with the Wireshark acting as a syslog relay server? Thanks.
VMNoob
1 2 3
…
33 34