Wireshark is a graphical packet capture and analyser open-source software. It can be used for a variety of network communication analysis tasks like protocol development and troubleshooting. It shows packets on the IP level.

learn more… | top users | synonyms

1
vote
1answer
46 views

Sniff LAN SSL requests

When I log in into Facebook, using Wireshark in the same machine, I can read the request data in plain-text. That doesn't happen when I'm sniffing my LAN: I can read the SSL packets but they are ...
9
votes
1answer
70 views

Firefox trying to connect to other lan computers

While running Wireshark trying to troubleshoot some other issues, I noticed several SYN connections to ports 80 and 443 on the workstation I was using. The packets were dropped. These were coming from ...
4
votes
3answers
69 views

How to convert a pcap file to a raw file?

I need to convert a pcap-ng/ now a pcap file to a raw file for being able to analyse it with multimon-ng. Any recommendations? It should be possible, but I am not aware how it should be done.
5
votes
1answer
76 views

Is my Windows phone protected from attacks that reveal list of ssids it knows about?

My goal is to see the SSIDs requested by mobile devices in my home. For example, my Windows phone knows about SSIDs called "coffee_shop", "planet_fitness" and "library". I have my phone set to ...
0
votes
5answers
90 views

Monitor websites being visited on network

I need to monitor the websites being visited on my wifi network by the different IPs connected to the network. What is the best way to do this? I spent some time with Wireshark but I feel it is a bit ...
1
vote
0answers
36 views

How to use wireshark to decode SSL stream from remote API server? [migrated]

I'm trying to troubleshoot some issues with what my code is sending to a remote API (over https). I've seen a ton of articles on Wireshark and decoding SSL, but they all make up their own test server ...
1
vote
2answers
57 views

Could anyone technically see my requests with TOR if the person has access to my router?

I was wondering if someone could sniff the packets I send via my computer with something like Wireshark I guess even if I use TOR and the person could access the router like stated.
1
vote
0answers
189 views

Can I collect wireless packets using Wireshark while being connected to the Internet via cable? [migrated]

I am working on a PC which is connected to my router using a LAN cable, and the other computers in my house are connected to my router using WiFi. We are all connected to the same network, so I ...
1
vote
1answer
41 views

Padding of 802.11 packet with 0's in libpcap [closed]

I am trying to send probe request to Access Points.But whenever I send a probe request packet it is padded with 0's i.e I see two packets on wireshark for every packet I send : a non-padded packet and ...
1
vote
1answer
255 views

How to simulate network attacks and use wireshark to detect them?

I am working on a project which involves me to simulate a network attack and to use wireshark to detect the attack. DOS/MIM etc. I have found the following links that provided help but there are still ...
2
votes
0answers
29 views

What features should I look for when buying a external wireless card used for the purpose of pen testing/snooping [duplicate]

I'm currently planning to buy an external wireless card for the purpose of pen testing and snooping my own network in order to learn more about it and try to create more preventive measure against ...
2
votes
2answers
66 views

is it possible to detect zigbee traffice via wireshark? if yes , how?

I have a zigbee access point. I am not able to detect its network. Also, unable to capture its traffic using wireshark like we capture wifi traffic. Can someone tell me what should be done to analyse ...
1
vote
1answer
76 views

Intercept https traffic [duplicate]

Is it possible for a packet sniffer such as wireshark to be able to decrypt the traffic generated by a https connection from a browser ? I do not have control of the server, but I have control of the ...
3
votes
3answers
253 views

Is it possible to obtain the login credentials submitted by users?

It's a question at computer security textbook Assume that user A is about to use some website that requires login credentials. User A starts his web browser, types the website’s URL, and submits the ...
5
votes
2answers
928 views

Facebook POST request capture

I have been trying to test a sniff on facebook POST request forms using wireshark (filtered HTTP). At login form, I would try login, and then check wireshark and see that no packet was captured. ...
-1
votes
1answer
85 views

Slow internet - Worried about spammed packets

got a weird question and I'm not sure if I should even post this on here but I couldn't think of anywhere better to ask. Lately, I've been getting some internet speed issues. I closed literally every ...
0
votes
1answer
91 views

Source port and destination port [closed]

Just fiddling with wireshark and telegram as part of some learning exercise on security. I realised that the source port for the telegram app is 58939 and the destination port would be 443. Why is ...
0
votes
1answer
91 views

What do these Wireshark screenshots demonstrate?

I'm reading an article about the recent Github DDoS with traffic coming from non-Chinese Baidu users here. There are two Wireshark screenshots in the middle of the article with arrows pointing to the ...
0
votes
0answers
20 views

Wireshark TLS Handshake shows version as TLS 1.0 and TLS 1.2 both [duplicate]

As you see below in the image, wireshark screenshot shows TLSv1.2 Record Layer : Handshake Protocol, but version attribute's value is TLS 1.0 Why does wireshark shows version as TLS 1.0 and TLS ...
0
votes
0answers
21 views

upload received ssl data to distributed servers

I am doing the network traffic analysis for a live camera device from a Chinese company which allows to view the real time video from ios6 app. 172.17.200.2 is the IP of the ios device.And the ...
0
votes
0answers
143 views

TLSV1 and TLSV1.2 coexist issue in wireshark

I analysed an live camero's net traffic and found that the client uses both TLS1.0 and TLS1.2 in the handshakings while the server only uses TLS1.0. How can the handshaking uses both TLSV1.0 and ...
-4
votes
3answers
561 views

Can I do hacking using Windows OS? [closed]

I have searched the web a numerous times but haven't found an explicit answer to my question. I've studied (at school and on my own) computer networks for 2 years, doing active programming for 4 years ...
2
votes
0answers
75 views

Decrypt TLS from an IDS

So I am trying to figure out what the packet payload is off of a possible TLS HeartBleed alert from my IDS. I have read that Wireshark is able to do it with some certain keys, but isn't that in real ...
16
votes
4answers
4k views

Can someone using Wireshark obtain the full URL if my program uses HTTPS?

While perusing the contents of pcap files I've noticed some URLs appear to be visible despite being HTTPS. These mainly occur inside payloads that contain cert URLs too, but I also see HTTPS URLs ...
2
votes
3answers
443 views

promiscuous vs monitor mode in 802.11

I've been reading up on promiscuous mode and monitor mode as they relate to 802.11 networks. I understand the difference, which is explained here: What is the difference between Promiscuous and ...
3
votes
2answers
478 views

Extract pre-master keys from an OpenSSL application

Consider an application using OpenSSL which has a bug. A packet capture of the full SSL session is available, as well as a core dump and debugging symbols for the application and libraries. A RSA ...
1
vote
0answers
402 views

How can I find threats/attacks from a PCAP - Wireshark, Snort [closed]

I have a pcap file and I am trying to analyze it using Snort and Wireshark. When I tried the command, which I had showed below, in Ubuntu I was provided with various output such as the date, time, ...
5
votes
2answers
230 views

It is safe to share a wireshark file?

I wanted to share a wireshark of my file, because it may help with some problems i'm having but i need to know if it is safe, or if could reveal sensitive data about me, the only IP's i see are my ...
0
votes
0answers
81 views

Splitting a packet which has the size greater than MTU in PCAP

I have a pcap in which the length of packet is more than the MTU. There is a option in wireshark to export the object but that is for only http and smb. Is there a way to split the packet in MTU size ...
1
vote
3answers
377 views

Doesn't seem to be able to capture the packets I need [ANSWERED]

I've been trying to capture Telegram messaging application's packets (for my class project) but I couldn't get anything out of the punch of captured packets I got. Telegram does AES-256 encryption ...
-4
votes
3answers
215 views

How can I get other person's packets over Wireshark?

First of all, my aim is not to do any illegal things. What does a person need (environment, tools) to catch incoming or outgoing frames from any other person's device which is in the same network? ...
0
votes
1answer
122 views

Firewall with packet capture and inspection?

Is there such thing as a firewall with packet inspection? Most outbound firewalls simply prompt the user with "program.exe is trying to connect to the internet - allow or deny?". I find it impossible ...
2
votes
1answer
467 views

Client Hello message suggests cipher suite which is not in the list specified by setEnabledCipherSuites() method

In my code, I use JSSE6 API to specify a list of enabled cipher suites. I aimed to only allow 168 bits or higher encryption cipher suites, below is a part of my code: /** List of 168 bits encryption ...
1
vote
2answers
123 views

How can I strip sensitive data out of a Wireshark log report?

I have a sync app that doesn't work and the developer asked me to try and perform a sync with Wireshark capturing the data and send the Wireshark log to him. I noticed that Wireshark saves sensitive ...
1
vote
1answer
528 views

Decoding tunnel bytes in EAP-TLS or EAP-TTLS using Wireshark

I have a few pcaps of traffic for EAP-TTLS conversation, carried by RADIUS. I also have some being carried by EAPoL, but I think the answer to that case might be even less straightforward (though ...
0
votes
6answers
163 views

Wireshark Packet Capture

I need to capture/analyse the packets of another system connected to same network, is it possible with Wireshark? I have Wireshark installed on my system; what options do I need to capture packets of ...
1
vote
2answers
189 views

Force connected devices to use http rather than https

I am very new to MITM attacks and have been faffing around on my home network today.. When sniffing my iPhone trying to connect to some mail accounts I have noticed that it shows a message stating ...
1
vote
0answers
524 views

Bash shell exploit using SIP

I have a SIP proxy server, that would like to test Shellshock on. I have used this https://github.com/zaf/sipshock to try and test. but this is what I get. So I just want to know generally what is ...
0
votes
1answer
1k views

WireShark only showing broadcast packets [closed]

So here is my setup Desktop booting a live version of Kali from a USB drive The standard distro of wireshark that comes with Kali A Ralink RT-3070L High gain antenna My home network as a sandbox. ...
2
votes
1answer
285 views

Search for user credentials within a packet capture of a gmail session over SPDY

I was reading this paper on SSL/TLS from the SANS Reading Room on how to capture and decrypt your own SSL traffic with Wireshark. I wanted to capture the credentials used to login to gmail. When the ...
14
votes
5answers
6k views

Why can't I decrypt SSL traffic with the client's private key only?

I have found that I can decrypt SSL traffic in Wireshark with the server's private key. Why isn't the client's private key enough to decrypt SSL traffic?
1
vote
0answers
252 views

Extremely suspicious UDP network traffic when idle [closed]

My computer has been using about 7Mbps when idle, it does the same thing even I am playing games and such. This is the Wireshark capture ...
2
votes
1answer
630 views

Capturing iTunes traffic with Wireshark - SSL decryption question

I'm fooling around with Wireshark to capture the activation packets for an iPhone and some other stuff, however the traffic is encrypted. There should be a private SSL key somewhere on my computer to ...
0
votes
2answers
193 views

Wireshark displays sql calls - Prevention

So I was analysing a new application that is being written. I noticed that on the app server level there are sql calls that are being made from C# code. These calls can be seen in wireshark by ...
0
votes
1answer
455 views

tcpdump filter expression POST packets

I'm trying to save only POST packets using tcpdump filter expressions. I started with 'tcp port 80' and I found on the web a specific expression to achieve that. tcpdump -i wlan0 -s 0 -A -vv ...
2
votes
0answers
214 views

Some http requests are not send encrypted by vpn! Why?

I subscribed to a VPN service recently, and installed wireshark to take a look at the traffic sent from my computer. Practically all of it goes through UDP protocol, encrypted. But there are two HTTP ...
7
votes
5answers
16k views

How to get private key used to decrypt HTTPS traffic sent and received from my own browser with wireshark

I am working with a website that sends API requests. I would like to write a client to make the requests myself, but in order to do so I would need to first see the request payloads. However, the ...
2
votes
1answer
281 views

DNS packets during ARP poisoning

I carried out an arp poisoning attack from my virtual machine to real machine with cain and able and collected data with wireshark from real machine. While I was investigating data with wireshark I ...
2
votes
1answer
208 views

How to further analyze suspicious traffic

I've been monitoring my network traffic with Little Snitch, and today, when launching Chrome, just the default Chrome tab (shows most frequent sites), it alerted me Chrome was trying to connect over ...
2
votes
4answers
7k views

How Can I Capture Packets of LAN device in Wireshark?

I want to use my computer to capture packets sent by my Android phone in applications: e.g. YouTube. I captured http requests coming from the machine where Wireshark is installed already, now I want ...