Server Fault Stack Exchange
Server Fault Stack Exchange

Questions tagged [wireshark]

Wireshark is an open source Network Protocol Analyzer under GNU License.

507 questions
3
votes
3 answers

How to separate PCAP by unique IP address

I have an hour long PCAP file which has about 60 individual network attacks done on our test network here at work. Each attack comes from a unique IP address which was not used elsewhere during the hour. I'd like to make 60 pcaps out of this one…
Evan
  • 177
  • 2
  • 8
3
votes
3 answers

IP Conflicts from mikrotik router for multiple ip addresses (that it isnt assigned)

I have a point to point wireless connection using two mikrotiks. When I plug the mikrotik into a switch with just my laptop I get an IP address conflict on my machine no matter what IP I am assigned. Using wireshark i see the conflicts are from the…
Jason
  • 317
  • 1
  • 6
  • 17
3
votes
2 answers

How can I monitor HTTPS traffic with Wireshark?

Possible Duplicate: How can I filter https when monitoring traffic with Wireshark? I want to verify that the analytics package I've added to my iOS app is attempting to talk to the analytics servers (which I don't control). I think the analytics…
MrDatabase
  • 133
  • 1
  • 1
  • 4
3
votes
1 answer

WireShark - Capturing Packets on Multiple IP Address (FIlter)

I'm looking for the syntax to do a capture filter on WireShark, by capturing the traffic on several (specific) IP addresses. I understand how to capture a range, and an individual IP address. However, the application I am capturing on is spread of a…
Derek
  • 183
  • 1
  • 2
  • 5
3
votes
4 answers

Wireshark - Graphic analysis tool. anyone knows?

Does anyone knows a graphical tool to analyse wireshark captures? Like something that can agregate traffic by ip's and by protocol and show's it graphicly. Anyone knows a freeware/opensource utility? Thanks
Flip
  • 109
  • 1
  • 3
  • 11
3
votes
3 answers

How do I find out what all this traffic is?

I have seen a consistent spike in traffic over my network since Monday morning and I don't know where it's coming from! I don't have netflow routers (like I would like), I have IPCop firewalls. Is there any way that's built in to Linux that I…
blsub6
  • 1,131
  • 6
  • 25
  • 45
3
votes
3 answers

wireshark http POST

I would like to have a http POST request method CAPTURE filter. I know it is easy to do it by display filter http.request.method==POST but I need tcpdump compatible. I wrote tcp dst port 80 and (tcp[13] = 0x18) But it is not perfect... tcp dst port…
user39051
3
votes
2 answers

With wireshark how can I filter by packet size?

I can filter for packet lengths using a display filter containing data.len >= XXX, but I'd really like to use a capture filter for this for efficiency... is there a way to do it?
oz10
  • 370
  • 1
  • 4
  • 12
3
votes
1 answer

Wireshark arp packets

In wireshark, after capturing some arp packets, what is the significance of all 1's in the destination field. of an Ethernet II frame?
thehollow89
  • 61
  • 1
  • 1
  • 4
3
votes
2 answers

Googlecast SSDP and MDNS queries on network despite not having any chromecast applications installed in main computer

As title states, Ive detected some MDNS queries from a googlecast address, which is strange since i don't have any googlecast apps or similar installed. Additionally My PC is sending SSDP packets to 239.255.255.250 (subnet?) regarding 'M-Search:…
N S
  • 33
  • 1
  • 1
  • 3
2
votes
0 answers

Microsoft CA Problem for Windows 10 Clients with Wireshark Installed

This is a most bizarre scenario, but hoping someone else has ran into this at some point to shed some light. We are in the process of migrating to a new host Microsoft CA service. There are CA proxies that point to the actual CA's that are hosted…
Justin Andrusk
  • 121
  • 3
2
votes
2 answers

Get network data transfer rate / throughput for use in Wireshark

I'm trying to get the ethernet NIC throughput rate / data transfer rate on a VPS in order to start a capture on Wireshark during DOS/DDOS attacks so I can analyze the nature of the packets. I'm aware that I can use something called a ring buffer…
I'm Root James
  • 212
  • 3
  • 13
2
votes
0 answers

Fatal error TLS client credential

I have disabled SSLv3, TLS1.0 and 1.1 on a Windows 10 domain joined laptop, I also disabled triple DES 168 and MD5 to comply with our PCI scans and since then the system logs are full of the same error: A fatal error occurred while creating a TLS…
ThomasC.
  • 21
  • 1
  • 3
2
votes
1 answer

Why is my computer making unreachable ICMP requests to the gateway?

After playing around with the ICMP filter on wireshark, I noticed that my machine is making ICMP requests to the router regularly, which consistently fails: I noticed that the subsequent ICMP requests which fail are using UDP on port 53. Could…
Daniel Minnaar
  • 75
  • 1
  • 8
2
votes
0 answers

Why TCP Out-Of-Order packet is seen after SYN?

I am trying to troubleshoot a performance issue between a client and a file server. When I look at the capture from the client, I see a weird behavior. I am trying to understand this weird behavior. I know Out-Of-Order packet is received from the…
Vignesh Ramanan
  • 21
  • 1
  • 3
1 2 3
…
33 34