Wireshark is a graphical packet capture and analyser open-source software. It can be used for a variety of network communication analysis tasks like protocol development and troubleshooting. It shows packets on the IP level.

learn more… | top users | synonyms

-1
votes
0answers
30 views

How to hack a unmanaged switched network [on hold]

Given the following scenario You have an unattended unmanaged switch (Netgear FS608) A system with Kali Linux with a USB to LAN adapter (ASIX Electronics Corporation AX88772B) Wireshark capture of ...
1
vote
1answer
52 views

How to capture all traffic from a new device?

I have a new IoT type of device that requires a wifi connection to work. I have no use for the device but I'd like to poke around it and learn more about it. How should I go about intercepting every ...
1
vote
1answer
65 views

How can I capture another IP's HTTP traffic with Wireshark network analyzer?

How can I capture another IP's HTTP(S) requests in a local network with Wireshark network analyzer? Is it possible?
1
vote
2answers
40 views

Cannot capture frames other than broadcast or multicast in Wireshark

My problem is that I cannot capture any frames other than broadcast or multicast over Wireshark on my WLAN interface (eg. no ICMP packets, no HTTP packets, etc.) Please follow details below: OS: ...
0
votes
0answers
36 views

How to extract the hash from SMB

I have a running PC which I need to test against.It is running Windows with SMB enabled. When capturing using Wireshark while connecting with an incorrect password I see packets being sent to / from ...
-1
votes
3answers
80 views

How can I extract the certificate from this pcap file?

I have a pcap file of 14 sniffed SSL packets. I uploaded it here: ssl.pcap I opened it with wireshark. I see the 14 packets. The largest of seems to contain a self signed certificate (as it is made ...
0
votes
4answers
105 views

Human readable SSL/TLS packets

If I have a protocol-analyzer/packet-sniffer, such as wireshark installed on a particular device.. (or in this case; tcpdump & tshark etc. on my smartphone..) ..should I be able to read ...
1
vote
1answer
47 views

What is the difference between capture traffic from inside and outside of my network?

I'm thinking to use Wireshark tool to packet capture in my Wireless network. I read something that tells I can capture from inside or outside of my network, just making my wifi board working in "...
1
vote
1answer
152 views

Wireshark SSL stripping

well this question could be asked in Wireshark forums or Stackoverflow forums but, I think the question invloves development and security factors as well so i find the Information Security forum is ...
1
vote
1answer
54 views

Nemesis packets not detected in wireshark/tcpdump

I have been using nemesis for forging fake DHCP request packets on my Ubuntu machine. I get a "packet injected" message each time I inject it. However I was not able to analyze it on wireshark as my ...
1
vote
1answer
45 views

How to modify UDP packets in checksum field?

Stephen Northcutt, SANS Director, make a pcap contest (see here) where the .pcap file had a hidden information in checksum field. I solved it using wireshark and it was an interesting activity. So, I ...
0
votes
1answer
30 views

TShark Cli question

I am looking over a CTF writeup and I have a problem in reproducing a single command: tshark -r challenge.pcapng usb.bDescriptorType and usb.urb_type==67 -T fields -e usb.bus_id -e usb....
0
votes
0answers
33 views

Wireshark TLS v1 Xmpp

i'm trying to sniff on XMPP communication of League of Legends game. So far I found out that it's using port 5223 and SSL encryption. Is there any way to decrypt the data sent to see actual XML data ...
0
votes
1answer
39 views

Unsecure FTP with Encrypted file and Wireshark leakage

Hi i was wandering if it is possible to have a password leaked to an encrypted file on an anon ftp server with r-x-w permissions. So for example i have a file encrypted using gpg and when opened on ...
0
votes
2answers
685 views

Sniffing WhatsApp chat using Wireshark

Suppose two persons are using WhatsApp on Android. How can I see the communication between them if I have Wireshark running on a PC listening on network interface card? I know the communication ...
3
votes
2answers
69 views

Is there any chance of PC getting infected when you analyse PCAP malware file?

Currently, there are lots of pcap files of malware analysis carried by other researchers available on Internet. Such files show the traffic pattern and communication of the malware with it's C&C ...
3
votes
1answer
91 views

Wireshark tcp filter: tcp[((tcp[12:1] & 0xf0) >> 2):4]

While readinf this doc https://wiki.wireshark.org/CaptureFilters I found this line tcp[((tcp[12:1] & 0xf0) >> 2):4] which figure out the TCP Header Length, but i can't find out how it really ...
1
vote
2answers
80 views

Wireshark as a network scanner [closed]

I have been playing with nmap lately, trying out arp-ping scanning and using idle hosts, etc... Looking at Wireshark, there is always some suspicious activity when performing scans. The thing is, I ...
1
vote
2answers
103 views

MITM my own SSL connections with e.g. wireshark - no proxy

I'd like to investigate some SSL (https?) traffic coming from one of my computers. The problem is that I don't know for sure which program it comes from, and I most likely can't make it use a proxy (...
2
votes
0answers
103 views

Sniff wireless (Wi-Fi) trafic with Wireshark

I have a wireless card (AWUS036H) in monitor mode (with airmon-ng start wlan0) on my Debian machine. In Wireshark, in "capture options", all my interfaces are in promiscuous mode. The test network is ...
0
votes
2answers
111 views

How to capture Wifi 802.11 traffic?

I want to capture the wifi traffic from my wireless card, so what i have to do and are there tools for that? I know that there is aircrack-ng and airodump, but these tools need a extra wireless ...
2
votes
3answers
204 views

How to decrypt SSL traffic with a packet sniffer when I have the private key?

How you do you decrypt ssl packets (traffic) with the private key? I tried to do this with ssldump and openssl but nothing worked.
3
votes
1answer
93 views

What is required to decrypt other device's WPA2 packets?

As the title specifies, I'm trying to understand the minimum requirements for a utility like Wireshark to decrypt the packets from another device on a simple home network using WPA2 personal (AES). ...
0
votes
2answers
132 views

What is really wireless sniffing, and how can this attack damage someone

I guess that this is a dumb question, but i really thought for a longtime that the wireless sniffing attack consists of listening to all the packets that get over the air, but apparently it isn't that,...
0
votes
1answer
92 views

how to catch a packets from wifi that I am connected to ( or not connected to )? [closed]

I have wifi connection, and I want to use something like wireshark to catch all the packages that my wifi router is listening to. How can I do it? If i want to catch packets from the router that I ...
0
votes
2answers
242 views

Monitor traffic that is going through my router

I want to monitor the HTTP traffic of all clients connected via wifi to my wireless router. I want to capture the traffic with my Notebook which is also wirelessly connected to the router. Hardware &...
1
vote
1answer
64 views

How do I associate an SSID to a device?

In other words I am referring to the wlan.fc.type_subtype==0x04 filter in Wireshark while using a WiFi adapter in monitor mode. How can I associate an SSID to an Android device (for example) if that ...
0
votes
0answers
51 views

Difference between WPA, WPA2 and mixed mode on packets level

What is the difference between wpa, wpa2 and mixed mode, particulary how 4-way handshake packets look-like for every type? Is there any good lecture about it with packets examples? Above question ...
1
vote
2answers
76 views

sniffing with wireshark on wireless network

In a wireless network, does wireshark sniffs all the packets that are in move, or only packets whom we are the destination/source ? If it sniffs all the packets in the air, can someone explain or ...
0
votes
1answer
184 views

HTTP Basic Authentication - password missing

I am trying to retrieve a username and password send over the network. I was able to capture the following using Wireshark: GET /rcp_tunnel HTTP/1.0 Host: ***.***.***.*** Authorization: Basic dXNlcjo=...
1
vote
1answer
679 views

TLSv1 HandShake but SSLv2 client hello

I found this question: SSLv3 HandShake but TLSv1 client hello However, my situation is opposite: SSLv2 client hello then TLSv1 handshake. Can you please explain this for me? I use Wireshark to ...
0
votes
0answers
18 views

Current Decryption Support for TLS [duplicate]

I've been locking things at clients down recently and ran into a side effect I hadn't really thought about were TLS traffic using DHE based ciphers can't be decrypted with SSLDump or Wireshark. I ...
0
votes
1answer
125 views

What is the difference between Wireshark and Ettercap for man in the middle attacks!

I know of the two programs, one is Wireshark (a packet sniffing program) and the other is Ettercap (a man in the middle attack program). I tried doing a MITM attack before, legally on my own home ...
0
votes
1answer
95 views

Capture & Decrypt packets captured by monitoring mode

I am working on capturing packets using monitoring mode on my laptop. The problem is that I cannot get the source/destination IP's since the packets are encrypted. I added a key and it didn't work (I ...
2
votes
2answers
858 views

How to capture WhatsApp API requests using Fiddler?

I am trying to capture WhatsApp network requests and not able to do it using Fiddler. This is what I did: Installed Fiddler. Exported Root certificate and installed on my Android device. I modified ...
-3
votes
1answer
392 views

Wireshark decode base64 [closed]

Can Wireshark decode base64 in multiple packets? The base64 is not dealing with auth but is in a DNS packet in the text field. As of now I'm decoding them by hand, one at a time.
2
votes
0answers
87 views

Linux machine continuously transferring data over the network to random servers in china and across the globe [duplicate]

I have been using Linux for about 5 years now but I am not very skilled with the commands to monitor and figure out internal issues. I recently was having trouble with the Internet. My roommates were ...
4
votes
1answer
95 views

Are there any statistics about packet filtering to prevent IP spoofing on the internet?

DDoS attacks via spoofed DNS(sec) are daily news for the last few years, but packet filtering should prevent IP spoofing on the internet. I tried (as an exercise) to spoof a packet on my VPS and on ...
18
votes
1answer
390 views

How to demo Skype-decryption using FOSS tools?

I'm preparing a presentation on Skype networking. And I'd like to demo decryption. I found a good approach to decrypting the TLS packets captured with WireShark in this blog post: Rob Andrews, ...
2
votes
1answer
95 views

Hiding packets, requests, traffic from my PC through Ethernet connected to workplace network

Before everyone jumps on the bandwagon, as I so often see, of saying you shouldn't do anything on a workplace network that is to be done annonymously on your own home network, I want to know an actual ...
5
votes
2answers
371 views

Decrypting SSL using Wireshark on Linux vs Windows

I'm working on decrypting my own traffic that gets sent through Wireshark and I've been following this guide for reference. I have been using the SSLKEYLOGFILE environment variable and I can get the ...
3
votes
1answer
252 views

Log all crypto keys used for outgoing SSL / TLS connections on Linux server

Is there some environment variable that works how SSLKEYLOGFILE works for NSS-reliant programs but which would apply to all outgoing TLS / SSL connections on a Linux server and not just ones that use ...
3
votes
1answer
1k views

Decrypt SSH traffic in pcap file given private key

I have a Pcap file that contains some SSH encrypted packets. I have the server public and private key. How do I decrypt these private keys? Is it possible to get the session key using Wireshark or ...
2
votes
1answer
259 views

Can't decrypt captured HTTP connection from WPA Network

Hi I am attempting to sniff HTTP packet traffic using Wireshark on Kali Linux. I have added my wpa-pwd correctly to the IEEE 802.11 protocol and enabled "decryption". Currently I can only view the ...
5
votes
2answers
1k views

Private key to PEM

I'm new to security and I'm trying to decode some SSL encrypted communication between my machine and server. I managed to obtain private and public keys as far as I understand private key is this one:...
1
vote
2answers
7k views

How do we determine the SSL/TLS version of an HTTP request?

We are wanting to configure our Windows client to use only TLS 1.1 and greater. We've learned that we can do this by editing the registry. Now we want to make several HTTPS requests from different ...
4
votes
1answer
544 views

Why did this attack use 0.0.0.0 as IP address and why did it work?

Working through this exercise in network forensics, the attacker used a buffer overflow exploit to send commands to the victim's command prompt. The commands open an FTP session and download some ...
1
vote
3answers
217 views

Sniffing traffic on a secured wifi connection

Open wifi is a security risk since all the data can potentially be sniffed by anyone. What I want to ask is even on a secured wifi (which requires some kind of password for authentication), the data ...
3
votes
1answer
787 views

ARP poisoning and port forward together

Suppose these assumptions: Router IP address: 192.168.1.1 Router MAC address: 00:00:00:00:00:00 My IP address: 192.168.1.2 My MAC address: 00:00:00:00:00:01 Victim IP address: 192.168.1.3 ...
2
votes
1answer
200 views

Sniff LAN SSL requests

When I log in into Facebook, using Wireshark in the same machine, I can read the request data in plain-text. That doesn't happen when I'm sniffing my LAN: I can read the SSL packets but they are ...