Wireshark is a graphical packet capture and analyser open-source software. It can be used for a variety of network communication analysis tasks like protocol development and troubleshooting. It shows packets on the IP level.

learn more… | top users | synonyms

1
vote
1answer
88 views

How do I verify versions of Adobe?

I ran a vulnerability scan against a server and it is pulling back a lot of Adobe vulnerabilities. I ran a Wireshark capture on the scan but I can't seem to write up a Wireshark filter on the packets. ...
-1
votes
1answer
326 views

Wireshark Decode HTTPS Root Certificate

I'm currently dealing with a "Sniffy" java application. Well I can see it connecting to some kind of server using HTTPS. I would like to see what its sending or getting over HTTPS. i have read some ...
10
votes
2answers
6k views

Decrypting TLS in Wireshark when using DHE_RSA ciphersuites

How can I decrypt TLS messages when an ephemeral Diffie-Hellman ciphersuite is used? I am able to expose the premaster secret and master secret from the SSL Client. Using that, how to decrypt the ...
3
votes
2answers
2k views

how to monitor a Wifi (802.11) network?

How to capture a sequential stream of data between two machines, making no assumptions about network layer protocols? On wired network, one can do it by ARP spoofing and then sniff the network. One ...
1
vote
1answer
262 views

Configure Wireshark to capture preformatted data from pseudo-device

So, for a research project, I'm trying to use the HONE project on github, which creates during its module installation two pseudo-devices in the /dev folder. These are called hone and honet, the ...
4
votes
2answers
1k views

Extract cookies from pcap

Is there any tool to extract cookies from network sniffs generated by tcpdump (.pcap files). I know I can open it in wireshark but it will take a while until I find the domain I am interested into ...
9
votes
1answer
1k views

How to study the packets sent by a keylogger

One of my friends runescape account got hacked through key-logger. He downloaded a runescape gold generator from a file sharing site and tried to use it. I have a strong doubt that it is a key-logger. ...
1
vote
1answer
1k views

How does wireshark detects online-messenger traffic?

I have been working on how to find use of online messenger (e.g imo.im, ebuddy) using wireshark. I'm doing , as i need to build SIEM (security information event management) use-cases which detects ...
1
vote
1answer
346 views

Is suspicious network activity likely to be caused by a rootkit?

Netstat has been one of my favorite tools to check out possible malicious connections, but then I heard about the dangers of rootkits and their high complexity, allowing them to be able to bypass ...
0
votes
2answers
109 views

Display all packets but not these TCP packets? [closed]

I'm trying to filter packets with wireshark, I would like to display all packets but terminal service communications, but if I do: tcp.dstport != 3389 && tcp.srcport != 3389 It would ...
1
vote
1answer
2k views

wireshark only showing inbound traffic

I am using a dynex DX-EHB4 ethernet hub with two systems connected to it, the target desktop and another desktop running wireshark in promiscuous mode. I have a filter in place "host x.x.x.x" so I ...
3
votes
1answer
809 views

Does anyone know how to “tcpdump” traffic decrypted by Mallory MITM?

I'm looking for some help in capturing network traffic that I can analyze in Wireshare (or other tools). The tool I'm using is mallory. If anyone is familiar with mallory, I could use some help. ...
1
vote
1answer
184 views

Will packet sniffing still work if all connections go through a local proxy?

Will packet sniffing work if all connections use a local proxy? You are forced to use this proxy to get a connection to the internet at all.
1
vote
0answers
100 views

Turn Binary Data into Airborne Packets? [closed]

Are there any software libraries and/or wireless drivers that make it possible to turn a sequence of binary data into a wireless packet in the air? For example, if someone used Airpcap/Wireshark to ...
1
vote
2answers
674 views

Why wireshark source ip tab lists other ip as well

I was trying to capture some packets using Wireshark. I could find a lots of ip in the source address tab. Which ip do they represent. Which all packets are visible to wireshark when I run it in my ...
4
votes
2answers
456 views

When do Ps Tools send cleartext passwords, and how can I demonstrate this?

The Ps Tools from Mark Russinovich are very handy remote administration utilities. However, they all come with one big caveat. Note that the password is transmitted in clear text to the remote ...