Wireshark is a graphical packet capture and analyser open-source software. It can be used for a variety of network communication analysis tasks like protocol development and troubleshooting. It shows packets on the IP level.

learn more… | top users | synonyms

3
votes
3answers
45 views

How to convert a pcap file to a raw file?

I need to convert a pcap-ng/ now a pcap file to a raw file for being able to analyse it with multimon-ng. Any recommendations? It should be possible, but I am not aware how it should be done.
5
votes
1answer
76 views

Is my Windows phone protected from attacks that reveal list of ssids it knows about?

My goal is to see the SSIDs requested by mobile devices in my home. For example, my Windows phone knows about SSIDs called "coffee_shop", "planet_fitness" and "library". I have my phone set to ...
0
votes
5answers
78 views

Monitor websites being visited on network

I need to monitor the websites being visited on my wifi network by the different IPs connected to the network. What is the best way to do this? I spent some time with Wireshark but I feel it is a bit ...
1
vote
0answers
36 views

How to use wireshark to decode SSL stream from remote API server? [migrated]

I'm trying to troubleshoot some issues with what my code is sending to a remote API (over https). I've seen a ton of articles on Wireshark and decoding SSL, but they all make up their own test server ...
1
vote
2answers
53 views

Could anyone technically see my requests with TOR if the person has access to my router?

I was wondering if someone could sniff the packets I send via my computer with something like Wireshark I guess even if I use TOR and the person could access the router like stated.
1
vote
0answers
189 views

Can I collect wireless packets using Wireshark while being connected to the Internet via cable? [migrated]

I am working on a PC which is connected to my router using a LAN cable, and the other computers in my house are connected to my router using WiFi. We are all connected to the same network, so I ...
1
vote
1answer
35 views

Padding of 802.11 packet with 0's in libpcap [closed]

I am trying to send probe request to Access Points.But whenever I send a probe request packet it is padded with 0's i.e I see two packets on wireshark for every packet I send : a non-padded packet and ...
1
vote
1answer
207 views

How to simulate network attacks and use wireshark to detect them?

I am working on a project which involves me to simulate a network attack and to use wireshark to detect the attack. DOS/MIM etc. I have found the following links that provided help but there are still ...
2
votes
0answers
29 views

What features should I look for when buying a external wireless card used for the purpose of pen testing/snooping [duplicate]

I'm currently planning to buy an external wireless card for the purpose of pen testing and snooping my own network in order to learn more about it and try to create more preventive measure against ...
2
votes
2answers
63 views

is it possible to detect zigbee traffice via wireshark? if yes , how?

I have a zigbee access point. I am not able to detect its network. Also, unable to capture its traffic using wireshark like we capture wifi traffic. Can someone tell me what should be done to analyse ...
1
vote
1answer
75 views

Intercept https traffic [duplicate]

Is it possible for a packet sniffer such as wireshark to be able to decrypt the traffic generated by a https connection from a browser ? I do not have control of the server, but I have control of the ...
3
votes
3answers
244 views

Is it possible to obtain the login credentials submitted by users?

It's a question at computer security textbook Assume that user A is about to use some website that requires login credentials. User A starts his web browser, types the website’s URL, and submits the ...
5
votes
2answers
903 views

Facebook POST request capture

I have been trying to test a sniff on facebook POST request forms using wireshark (filtered HTTP). At login form, I would try login, and then check wireshark and see that no packet was captured. ...
-1
votes
1answer
80 views

Slow internet - Worried about spammed packets

got a weird question and I'm not sure if I should even post this on here but I couldn't think of anywhere better to ask. Lately, I've been getting some internet speed issues. I closed literally every ...
0
votes
1answer
88 views

Source port and destination port [closed]

Just fiddling with wireshark and telegram as part of some learning exercise on security. I realised that the source port for the telegram app is 58939 and the destination port would be 443. Why is ...
0
votes
1answer
89 views

What do these Wireshark screenshots demonstrate?

I'm reading an article about the recent Github DDoS with traffic coming from non-Chinese Baidu users here. There are two Wireshark screenshots in the middle of the article with arrows pointing to the ...
0
votes
0answers
20 views

Wireshark TLS Handshake shows version as TLS 1.0 and TLS 1.2 both [duplicate]

As you see below in the image, wireshark screenshot shows TLSv1.2 Record Layer : Handshake Protocol, but version attribute's value is TLS 1.0 Why does wireshark shows version as TLS 1.0 and TLS ...
0
votes
0answers
21 views

upload received ssl data to distributed servers

I am doing the network traffic analysis for a live camera device from a Chinese company which allows to view the real time video from ios6 app. 172.17.200.2 is the IP of the ios device.And the ...
0
votes
0answers
133 views

TLSV1 and TLSV1.2 coexist issue in wireshark

I analysed an live camero's net traffic and found that the client uses both TLS1.0 and TLS1.2 in the handshakings while the server only uses TLS1.0. How can the handshaking uses both TLSV1.0 and ...
-4
votes
3answers
512 views

Can I do hacking using Windows OS? [closed]

I have searched the web a numerous times but haven't found an explicit answer to my question. I've studied (at school and on my own) computer networks for 2 years, doing active programming for 4 years ...
2
votes
0answers
74 views

Decrypt TLS from an IDS

So I am trying to figure out what the packet payload is off of a possible TLS HeartBleed alert from my IDS. I have read that Wireshark is able to do it with some certain keys, but isn't that in real ...
16
votes
4answers
4k views

Can someone using Wireshark obtain the full URL if my program uses HTTPS?

While perusing the contents of pcap files I've noticed some URLs appear to be visible despite being HTTPS. These mainly occur inside payloads that contain cert URLs too, but I also see HTTPS URLs ...
2
votes
3answers
408 views

promiscuous vs monitor mode in 802.11

I've been reading up on promiscuous mode and monitor mode as they relate to 802.11 networks. I understand the difference, which is explained here: What is the difference between Promiscuous and ...
3
votes
2answers
456 views

Extract pre-master keys from an OpenSSL application

Consider an application using OpenSSL which has a bug. A packet capture of the full SSL session is available, as well as a core dump and debugging symbols for the application and libraries. A RSA ...
1
vote
0answers
377 views

How can I find threats/attacks from a PCAP - Wireshark, Snort [closed]

I have a pcap file and I am trying to analyze it using Snort and Wireshark. When I tried the command, which I had showed below, in Ubuntu I was provided with various output such as the date, time, ...
5
votes
2answers
224 views

It is safe to share a wireshark file?

I wanted to share a wireshark of my file, because it may help with some problems i'm having but i need to know if it is safe, or if could reveal sensitive data about me, the only IP's i see are my ...
0
votes
0answers
78 views

Splitting a packet which has the size greater than MTU in PCAP

I have a pcap in which the length of packet is more than the MTU. There is a option in wireshark to export the object but that is for only http and smb. Is there a way to split the packet in MTU size ...
1
vote
3answers
357 views

Doesn't seem to be able to capture the packets I need [ANSWERED]

I've been trying to capture Telegram messaging application's packets (for my class project) but I couldn't get anything out of the punch of captured packets I got. Telegram does AES-256 encryption ...
-4
votes
3answers
211 views

How can I get other person's packets over Wireshark?

First of all, my aim is not to do any illegal things. What does a person need (environment, tools) to catch incoming or outgoing frames from any other person's device which is in the same network? ...
0
votes
1answer
112 views

Firewall with packet capture and inspection?

Is there such thing as a firewall with packet inspection? Most outbound firewalls simply prompt the user with "program.exe is trying to connect to the internet - allow or deny?". I find it impossible ...
2
votes
1answer
460 views

Client Hello message suggests cipher suite which is not in the list specified by setEnabledCipherSuites() method

In my code, I use JSSE6 API to specify a list of enabled cipher suites. I aimed to only allow 168 bits or higher encryption cipher suites, below is a part of my code: /** List of 168 bits encryption ...
1
vote
2answers
120 views

How can I strip sensitive data out of a Wireshark log report?

I have a sync app that doesn't work and the developer asked me to try and perform a sync with Wireshark capturing the data and send the Wireshark log to him. I noticed that Wireshark saves sensitive ...
1
vote
1answer
514 views

Decoding tunnel bytes in EAP-TLS or EAP-TTLS using Wireshark

I have a few pcaps of traffic for EAP-TTLS conversation, carried by RADIUS. I also have some being carried by EAPoL, but I think the answer to that case might be even less straightforward (though ...
0
votes
6answers
162 views

Wireshark Packet Capture

I need to capture/analyse the packets of another system connected to same network, is it possible with Wireshark? I have Wireshark installed on my system; what options do I need to capture packets of ...
1
vote
2answers
185 views

Force connected devices to use http rather than https

I am very new to MITM attacks and have been faffing around on my home network today.. When sniffing my iPhone trying to connect to some mail accounts I have noticed that it shows a message stating ...
1
vote
0answers
519 views

Bash shell exploit using SIP

I have a SIP proxy server, that would like to test Shellshock on. I have used this https://github.com/zaf/sipshock to try and test. but this is what I get. So I just want to know generally what is ...
0
votes
1answer
1k views

WireShark only showing broadcast packets [closed]

So here is my setup Desktop booting a live version of Kali from a USB drive The standard distro of wireshark that comes with Kali A Ralink RT-3070L High gain antenna My home network as a sandbox. ...
2
votes
1answer
281 views

Search for user credentials within a packet capture of a gmail session over SPDY

I was reading this paper on SSL/TLS from the SANS Reading Room on how to capture and decrypt your own SSL traffic with Wireshark. I wanted to capture the credentials used to login to gmail. When the ...
14
votes
5answers
6k views

Why can't I decrypt SSL traffic with the client's private key only?

I have found that I can decrypt SSL traffic in Wireshark with the server's private key. Why isn't the client's private key enough to decrypt SSL traffic?
1
vote
0answers
250 views

Extremely suspicious UDP network traffic when idle [closed]

My computer has been using about 7Mbps when idle, it does the same thing even I am playing games and such. This is the Wireshark capture ...
2
votes
1answer
617 views

Capturing iTunes traffic with Wireshark - SSL decryption question

I'm fooling around with Wireshark to capture the activation packets for an iPhone and some other stuff, however the traffic is encrypted. There should be a private SSL key somewhere on my computer to ...
0
votes
2answers
185 views

Wireshark displays sql calls - Prevention

So I was analysing a new application that is being written. I noticed that on the app server level there are sql calls that are being made from C# code. These calls can be seen in wireshark by ...
0
votes
1answer
426 views

tcpdump filter expression POST packets

I'm trying to save only POST packets using tcpdump filter expressions. I started with 'tcp port 80' and I found on the web a specific expression to achieve that. tcpdump -i wlan0 -s 0 -A -vv ...
2
votes
0answers
213 views

Some http requests are not send encrypted by vpn! Why?

I subscribed to a VPN service recently, and installed wireshark to take a look at the traffic sent from my computer. Practically all of it goes through UDP protocol, encrypted. But there are two HTTP ...
7
votes
5answers
15k views

How to get private key used to decrypt HTTPS traffic sent and received from my own browser with wireshark

I am working with a website that sends API requests. I would like to write a client to make the requests myself, but in order to do so I would need to first see the request payloads. However, the ...
2
votes
1answer
276 views

DNS packets during ARP poisoning

I carried out an arp poisoning attack from my virtual machine to real machine with cain and able and collected data with wireshark from real machine. While I was investigating data with wireshark I ...
2
votes
1answer
203 views

How to further analyze suspicious traffic

I've been monitoring my network traffic with Little Snitch, and today, when launching Chrome, just the default Chrome tab (shows most frequent sites), it alerted me Chrome was trying to connect over ...
2
votes
4answers
7k views

How Can I Capture Packets of LAN device in Wireshark?

I want to use my computer to capture packets sent by my Android phone in applications: e.g. YouTube. I captured http requests coming from the machine where Wireshark is installed already, now I want ...
1
vote
2answers
659 views

How to remove tcp header of packets captured with dumpcap?

The traffic from Wireshark saved into a file with dumpcap. In this file a have for example : € X `þ $À6 @ íëÃNxXÀ¨£ P&E»kKí¨<`PEà; HTTP/1.1 200 OK Cache-Control: private And I ...
2
votes
2answers
915 views

How to sniff email with https on Windows? [closed]

I am working now on Windows 7 and I want to see if I can sniff an email content on it with Wireshark. So all right with http but with https I can't at this moment and I don't understand how. You ...