Wireshark is a graphical packet capture and analyser open-source software. It can be used for a variety of network communication analysis tasks like protocol development and troubleshooting. It shows packets on the IP level.

learn more… | top users | synonyms

1
vote
0answers
9 views

Monitor Mode doesn't work in Kali 2.0 [migrated]

For the last year or so I have been using this exact setup with Kali 1.0. Everything worked fine with Wireshark. Now, when I am connected to a Wi-Fi access point my card REFUSES to stay in monitor ...
4
votes
1answer
156 views

Why did this attack use 0.0.0.0 as IP address and why did it work?

Working through this exercise in network forensics, the attacker used a buffer overflow exploit to send commands to the victim's command prompt. The commands open an FTP session and download some ...
1
vote
3answers
67 views

Sniffing traffic on a secured wifi connection

Open wifi is a security risk since all the data can potentially be sniffed by anyone. What I want to ask is even on a secured wifi (which requires some kind of password for authentication), the data ...
2
votes
1answer
180 views

ARP poisoning and port forward together

Suppose these assumptions: Router IP address: 192.168.1.1 Router MAC address: 00:00:00:00:00:00 My IP address: 192.168.1.2 My MAC address: 00:00:00:00:00:01 Victim IP address: 192.168.1.3 ...
0
votes
0answers
27 views

How does Wireshark resolve DNS names? [migrated]

Could you explain how wireshark makes a DNS query in order to resolve name of an IP address? My issue is about the mismatch between the DNS resolved by Wireshak against nslookup, moreover nslookup ...
2
votes
1answer
89 views

Sniff LAN SSL requests

When I log in into Facebook, using Wireshark in the same machine, I can read the request data in plain-text. That doesn't happen when I'm sniffing my LAN: I can read the SSL packets but they are ...
10
votes
1answer
135 views

Firefox trying to connect to other computers on the LAN

While running Wireshark trying to troubleshoot some other issues, I noticed several SYN connections to ports 80 and 443 on the workstation I was using. The packets were dropped. These were coming from ...
4
votes
3answers
97 views

How to convert a pcap file to a raw file?

I need to convert a pcap-ng/ now a pcap file to a raw file for being able to analyse it with multimon-ng. Any recommendations? It should be possible, but I am not aware how it should be done.
5
votes
1answer
80 views

Is my Windows phone protected from attacks that reveal list of ssids it knows about?

My goal is to see the SSIDs requested by mobile devices in my home. For example, my Windows phone knows about SSIDs called "coffee_shop", "planet_fitness" and "library". I have my phone set to ...
0
votes
5answers
145 views

Monitor websites being visited on network

I need to monitor the websites being visited on my wifi network by the different IPs connected to the network. What is the best way to do this? I spent some time with Wireshark but I feel it is a bit ...
1
vote
2answers
67 views

Could anyone technically see my requests with TOR if the person has access to my router?

I was wondering if someone could sniff the packets I send via my computer with something like Wireshark I guess even if I use TOR and the person could access the router like stated.
1
vote
1answer
47 views

Padding of 802.11 packet with 0's in libpcap [closed]

I am trying to send probe request to Access Points.But whenever I send a probe request packet it is padded with 0's i.e I see two packets on wireshark for every packet I send : a non-padded packet and ...
1
vote
1answer
393 views

How to simulate network attacks and use wireshark to detect them?

I am working on a project which involves me to simulate a network attack and to use wireshark to detect the attack. DOS/MIM etc. I have found the following links that provided help but there are still ...
2
votes
0answers
29 views

What features should I look for when buying a external wireless card used for the purpose of pen testing/snooping [duplicate]

I'm currently planning to buy an external wireless card for the purpose of pen testing and snooping my own network in order to learn more about it and try to create more preventive measure against ...
2
votes
2answers
104 views

is it possible to detect zigbee traffice via wireshark? if yes , how?

I have a zigbee access point. I am not able to detect its network. Also, unable to capture its traffic using wireshark like we capture wifi traffic. Can someone tell me what should be done to analyse ...
1
vote
1answer
79 views

Intercept https traffic [duplicate]

Is it possible for a packet sniffer such as wireshark to be able to decrypt the traffic generated by a https connection from a browser ? I do not have control of the server, but I have control of the ...
3
votes
3answers
280 views

Is it possible to obtain the login credentials submitted by users?

It's a question at computer security textbook Assume that user A is about to use some website that requires login credentials. User A starts his web browser, types the website’s URL, and submits the ...
5
votes
2answers
1k views

Facebook POST request capture

I have been trying to test a sniff on facebook POST request forms using wireshark (filtered HTTP). At login form, I would try login, and then check wireshark and see that no packet was captured. ...
-1
votes
1answer
97 views

Slow internet - Worried about spammed packets

got a weird question and I'm not sure if I should even post this on here but I couldn't think of anywhere better to ask. Lately, I've been getting some internet speed issues. I closed literally every ...
0
votes
1answer
110 views

Source port and destination port [closed]

Just fiddling with wireshark and telegram as part of some learning exercise on security. I realised that the source port for the telegram app is 58939 and the destination port would be 443. Why is ...
0
votes
1answer
104 views

What do these Wireshark screenshots demonstrate?

I'm reading an article about the recent Github DDoS with traffic coming from non-Chinese Baidu users here. There are two Wireshark screenshots in the middle of the article with arrows pointing to the ...
0
votes
0answers
20 views

Wireshark TLS Handshake shows version as TLS 1.0 and TLS 1.2 both [duplicate]

As you see below in the image, wireshark screenshot shows TLSv1.2 Record Layer : Handshake Protocol, but version attribute's value is TLS 1.0 Why does wireshark shows version as TLS 1.0 and TLS ...
0
votes
0answers
21 views

upload received ssl data to distributed servers

I am doing the network traffic analysis for a live camera device from a Chinese company which allows to view the real time video from ios6 app. 172.17.200.2 is the IP of the ios device.And the ...
0
votes
0answers
168 views

TLSV1 and TLSV1.2 coexist issue in wireshark

I analysed an live camero's net traffic and found that the client uses both TLS1.0 and TLS1.2 in the handshakings while the server only uses TLS1.0. How can the handshaking uses both TLSV1.0 and ...
-4
votes
3answers
898 views

Can I do hacking using Windows OS? [closed]

I have searched the web a numerous times but haven't found an explicit answer to my question. I've studied (at school and on my own) computer networks for 2 years, doing active programming for 4 years ...
2
votes
0answers
75 views

Decrypt TLS from an IDS

So I am trying to figure out what the packet payload is off of a possible TLS HeartBleed alert from my IDS. I have read that Wireshark is able to do it with some certain keys, but isn't that in real ...
16
votes
4answers
4k views

Can someone using Wireshark obtain the full URL if my program uses HTTPS?

While perusing the contents of pcap files I've noticed some URLs appear to be visible despite being HTTPS. These mainly occur inside payloads that contain cert URLs too, but I also see HTTPS URLs ...
2
votes
3answers
566 views

promiscuous vs monitor mode in 802.11

I've been reading up on promiscuous mode and monitor mode as they relate to 802.11 networks. I understand the difference, which is explained here: What is the difference between Promiscuous and ...
3
votes
2answers
554 views

Extract pre-master keys from an OpenSSL application

Consider an application using OpenSSL which has a bug. A packet capture of the full SSL session is available, as well as a core dump and debugging symbols for the application and libraries. A RSA ...
1
vote
0answers
431 views

How can I find threats/attacks from a PCAP - Wireshark, Snort [closed]

I have a pcap file and I am trying to analyze it using Snort and Wireshark. When I tried the command, which I had showed below, in Ubuntu I was provided with various output such as the date, time, ...
5
votes
2answers
256 views

It is safe to share a wireshark file?

I wanted to share a wireshark of my file, because it may help with some problems i'm having but i need to know if it is safe, or if could reveal sensitive data about me, the only IP's i see are my ...
0
votes
0answers
84 views

Splitting a packet which has the size greater than MTU in PCAP

I have a pcap in which the length of packet is more than the MTU. There is a option in wireshark to export the object but that is for only http and smb. Is there a way to split the packet in MTU size ...
1
vote
3answers
473 views

Doesn't seem to be able to capture the packets I need [ANSWERED]

I've been trying to capture Telegram messaging application's packets (for my class project) but I couldn't get anything out of the punch of captured packets I got. Telegram does AES-256 encryption ...
-5
votes
3answers
223 views

How can I get other person's packets over Wireshark?

First of all, my aim is not to do any illegal things. What does a person need (environment, tools) to catch incoming or outgoing frames from any other person's device which is in the same network? ...
0
votes
1answer
134 views

Firewall with packet capture and inspection?

Is there such thing as a firewall with packet inspection? Most outbound firewalls simply prompt the user with "program.exe is trying to connect to the internet - allow or deny?". I find it impossible ...
2
votes
1answer
526 views

Client Hello message suggests cipher suite which is not in the list specified by setEnabledCipherSuites() method

In my code, I use JSSE6 API to specify a list of enabled cipher suites. I aimed to only allow 168 bits or higher encryption cipher suites, below is a part of my code: /** List of 168 bits encryption ...
1
vote
2answers
131 views

How can I strip sensitive data out of a Wireshark log report?

I have a sync app that doesn't work and the developer asked me to try and perform a sync with Wireshark capturing the data and send the Wireshark log to him. I noticed that Wireshark saves sensitive ...
1
vote
1answer
597 views

Decoding tunnel bytes in EAP-TLS or EAP-TTLS using Wireshark

I have a few pcaps of traffic for EAP-TTLS conversation, carried by RADIUS. I also have some being carried by EAPoL, but I think the answer to that case might be even less straightforward (though ...
0
votes
6answers
168 views

Wireshark Packet Capture

I need to capture/analyse the packets of another system connected to same network, is it possible with Wireshark? I have Wireshark installed on my system; what options do I need to capture packets of ...
1
vote
2answers
209 views

Force connected devices to use http rather than https

I am very new to MITM attacks and have been faffing around on my home network today.. When sniffing my iPhone trying to connect to some mail accounts I have noticed that it shows a message stating ...
1
vote
0answers
537 views

Bash shell exploit using SIP

I have a SIP proxy server, that would like to test Shellshock on. I have used this https://github.com/zaf/sipshock to try and test. but this is what I get. So I just want to know generally what is ...
0
votes
1answer
1k views

WireShark only showing broadcast packets [closed]

So here is my setup Desktop booting a live version of Kali from a USB drive The standard distro of wireshark that comes with Kali A Ralink RT-3070L High gain antenna My home network as a sandbox. ...
2
votes
1answer
298 views

Search for user credentials within a packet capture of a gmail session over SPDY

I was reading this paper on SSL/TLS from the SANS Reading Room on how to capture and decrypt your own SSL traffic with Wireshark. I wanted to capture the credentials used to login to gmail. When the ...
14
votes
5answers
6k views

Why can't I decrypt SSL traffic with the client's private key only?

I have found that I can decrypt SSL traffic in Wireshark with the server's private key. Why isn't the client's private key enough to decrypt SSL traffic?
1
vote
0answers
269 views

Extremely suspicious UDP network traffic when idle [closed]

My computer has been using about 7Mbps when idle, it does the same thing even I am playing games and such. This is the Wireshark capture ...
2
votes
1answer
668 views

Capturing iTunes traffic with Wireshark - SSL decryption question

I'm fooling around with Wireshark to capture the activation packets for an iPhone and some other stuff, however the traffic is encrypted. There should be a private SSL key somewhere on my computer to ...
0
votes
2answers
207 views

Wireshark displays sql calls - Prevention

So I was analysing a new application that is being written. I noticed that on the app server level there are sql calls that are being made from C# code. These calls can be seen in wireshark by ...
0
votes
1answer
537 views

tcpdump filter expression POST packets

I'm trying to save only POST packets using tcpdump filter expressions. I started with 'tcp port 80' and I found on the web a specific expression to achieve that. tcpdump -i wlan0 -s 0 -A -vv ...
2
votes
0answers
226 views

Some http requests are not send encrypted by vpn! Why?

I subscribed to a VPN service recently, and installed wireshark to take a look at the traffic sent from my computer. Practically all of it goes through UDP protocol, encrypted. But there are two HTTP ...
7
votes
5answers
18k views

How to get private key used to decrypt HTTPS traffic sent and received from my own browser with wireshark

I am working with a website that sends API requests. I would like to write a client to make the requests myself, but in order to do so I would need to first see the request payloads. However, the ...