Wireshark is a graphical packet capture and analyser open-source software. It can be used for a variety of network communication analysis tasks like protocol development and troubleshooting. It shows packets on the IP level.

learn more… | top users | synonyms

0
votes
2answers
254 views

Monitor traffic that is going through my router

I want to monitor the HTTP traffic of all clients connected via wifi to my wireless router. I want to capture the traffic with my Notebook which is also wirelessly connected to the router. Hardware &...
0
votes
0answers
42 views

ARP spoofing on WLAN: seeing only traffic coming back

I am attempting to capture network traffic of my mobile device connected to switched network via WIFI, utilizing arpspoof. I did all steps tutorials mention. What I see in Wireshark is only a half ...
1
vote
1answer
4k views

How does Wireshark detect online-messenger traffic?

I have been working on how to find use of online messenger (e.g imo.im, ebuddy) using Wireshark. I'm doing, as I need to build SIEM (security information event management) use-cases which detects ...
0
votes
0answers
9 views

Going from an EC Private Key to Decrypting Traffic

At the moment I have an EC private key in my possession and also some traffic that was encrypted using the aforementioned private key. I have been trying to use OpenSSL to turn the private key into ...
-1
votes
0answers
35 views

How to hack a unmanaged switched network [closed]

Given the following scenario You have an unattended unmanaged switch (Netgear FS608) A system with Kali Linux with a USB to LAN adapter (ASIX Electronics Corporation AX88772B) Wireshark capture of ...
1
vote
1answer
56 views

How to capture all traffic from a new device?

I have a new IoT type of device that requires a wifi connection to work. I have no use for the device but I'd like to poke around it and learn more about it. How should I go about intercepting every ...
1
vote
2answers
1k views

How to remove tcp header of packets captured with dumpcap?

The traffic from Wireshark saved into a file with dumpcap. In this file a have for example : € X `þ $À6 @ íëÃNxXÀ¨£ P&E»kKí¨<`PEà; HTTP/1.1 200 OK Cache-Control: private And I ...
20
votes
2answers
23k views

Decrypting TLS in Wireshark when using DHE_RSA ciphersuites

How can I decrypt TLS messages when an ephemeral Diffie-Hellman ciphersuite is used? I am able to expose the premaster secret and master secret from the SSL Client. Using that, how to decrypt the ...
1
vote
1answer
65 views

How can I capture another IP's HTTP traffic with Wireshark network analyzer?

How can I capture another IP's HTTP(S) requests in a local network with Wireshark network analyzer? Is it possible?
1
vote
2answers
43 views

Cannot capture frames other than broadcast or multicast in Wireshark

My problem is that I cannot capture any frames other than broadcast or multicast over Wireshark on my WLAN interface (eg. no ICMP packets, no HTTP packets, etc.) Please follow details below: OS: ...
0
votes
0answers
38 views

How to extract the hash from SMB

I have a running PC which I need to test against.It is running Windows with SMB enabled. When capturing using Wireshark while connecting with an incorrect password I see packets being sent to / from ...
-1
votes
3answers
89 views

How can I extract the certificate from this pcap file?

I have a pcap file of 14 sniffed SSL packets. I uploaded it here: ssl.pcap I opened it with wireshark. I see the 14 packets. The largest of seems to contain a self signed certificate (as it is made ...
0
votes
4answers
107 views

Human readable SSL/TLS packets

If I have a protocol-analyzer/packet-sniffer, such as wireshark installed on a particular device.. (or in this case; tcpdump & tshark etc. on my smartphone..) ..should I be able to read ...
1
vote
1answer
49 views

What is the difference between capture traffic from inside and outside of my network?

I'm thinking to use Wireshark tool to packet capture in my Wireless network. I read something that tells I can capture from inside or outside of my network, just making my wifi board working in "...
1
vote
1answer
162 views

Wireshark SSL stripping

well this question could be asked in Wireshark forums or Stackoverflow forums but, I think the question invloves development and security factors as well so i find the Information Security forum is ...
1
vote
1answer
54 views

Nemesis packets not detected in wireshark/tcpdump

I have been using nemesis for forging fake DHCP request packets on my Ubuntu machine. I get a "packet injected" message each time I inject it. However I was not able to analyze it on wireshark as my ...
1
vote
1answer
47 views

How to modify UDP packets in checksum field?

Stephen Northcutt, SANS Director, make a pcap contest (see here) where the .pcap file had a hidden information in checksum field. I solved it using wireshark and it was an interesting activity. So, I ...
0
votes
1answer
30 views

TShark Cli question

I am looking over a CTF writeup and I have a problem in reproducing a single command: tshark -r challenge.pcapng usb.bDescriptorType and usb.urb_type==67 -T fields -e usb.bus_id -e usb....
0
votes
0answers
36 views

Wireshark TLS v1 Xmpp

i'm trying to sniff on XMPP communication of League of Legends game. So far I found out that it's using port 5223 and SSL encryption. Is there any way to decrypt the data sent to see actual XML data ...
0
votes
1answer
39 views

Unsecure FTP with Encrypted file and Wireshark leakage

Hi i was wandering if it is possible to have a password leaked to an encrypted file on an anon ftp server with r-x-w permissions. So for example i have a file encrypted using gpg and when opened on ...
0
votes
2answers
802 views

Sniffing WhatsApp chat using Wireshark

Suppose two persons are using WhatsApp on Android. How can I see the communication between them if I have Wireshark running on a PC listening on network interface card? I know the communication ...
5
votes
2answers
373 views

Decrypting SSL using Wireshark on Linux vs Windows

I'm working on decrypting my own traffic that gets sent through Wireshark and I've been following this guide for reference. I have been using the SSLKEYLOGFILE environment variable and I can get the ...
3
votes
2answers
71 views

Is there any chance of PC getting infected when you analyse PCAP malware file?

Currently, there are lots of pcap files of malware analysis carried by other researchers available on Internet. Such files show the traffic pattern and communication of the malware with it's C&C ...
3
votes
1answer
92 views

Wireshark tcp filter: tcp[((tcp[12:1] & 0xf0) >> 2):4]

While readinf this doc https://wiki.wireshark.org/CaptureFilters I found this line tcp[((tcp[12:1] & 0xf0) >> 2):4] which figure out the TCP Header Length, but i can't find out how it really ...
1
vote
2answers
83 views

Wireshark as a network scanner [closed]

I have been playing with nmap lately, trying out arp-ping scanning and using idle hosts, etc... Looking at Wireshark, there is always some suspicious activity when performing scans. The thing is, I ...
2
votes
4answers
12k views

How Can I Capture Packets of LAN device in Wireshark?

EDIT: Seeing how this question is so popular, I'll rephrase and improve it to allow for an answer. It's almost unanswerable in its old form. Setup PC running Wireshark, connected to the network ...
1
vote
2answers
114 views

MITM my own SSL connections with e.g. wireshark - no proxy

I'd like to investigate some SSL (https?) traffic coming from one of my computers. The problem is that I don't know for sure which program it comes from, and I most likely can't make it use a proxy (...
2
votes
0answers
105 views

Sniff wireless (Wi-Fi) trafic with Wireshark

I have a wireless card (AWUS036H) in monitor mode (with airmon-ng start wlan0) on my Debian machine. In Wireshark, in "capture options", all my interfaces are in promiscuous mode. The test network is ...
12
votes
5answers
34k views

How to get private key used to decrypt HTTPS traffic sent and received from my own browser with wireshark

I am working with a website that sends API requests. I would like to write a client to make the requests myself, but in order to do so I would need to first see the request payloads. However, the ...
0
votes
2answers
111 views

How to capture Wifi 802.11 traffic?

I want to capture the wifi traffic from my wireless card, so what i have to do and are there tools for that? I know that there is aircrack-ng and airodump, but these tools need a extra wireless ...
2
votes
3answers
214 views

How to decrypt SSL traffic with a packet sniffer when I have the private key?

How you do you decrypt ssl packets (traffic) with the private key? I tried to do this with ssldump and openssl but nothing worked.
3
votes
1answer
95 views

What is required to decrypt other device's WPA2 packets?

As the title specifies, I'm trying to understand the minimum requirements for a utility like Wireshark to decrypt the packets from another device on a simple home network using WPA2 personal (AES). ...
0
votes
2answers
136 views

What is really wireless sniffing, and how can this attack damage someone

I guess that this is a dumb question, but i really thought for a longtime that the wireless sniffing attack consists of listening to all the packets that get over the air, but apparently it isn't that,...
0
votes
1answer
94 views

how to catch a packets from wifi that I am connected to ( or not connected to )? [closed]

I have wifi connection, and I want to use something like wireshark to catch all the packages that my wifi router is listening to. How can I do it? If i want to catch packets from the router that I ...
18
votes
1answer
393 views

How to demo Skype-decryption using FOSS tools?

I'm preparing a presentation on Skype networking. And I'd like to demo decryption. I found a good approach to decrypting the TLS packets captured with WireShark in this blog post: Rob Andrews, ...
1
vote
1answer
65 views

How do I associate an SSID to a device?

In other words I am referring to the wlan.fc.type_subtype==0x04 filter in Wireshark while using a WiFi adapter in monitor mode. How can I associate an SSID to an Android device (for example) if that ...
0
votes
0answers
53 views

Difference between WPA, WPA2 and mixed mode on packets level

What is the difference between wpa, wpa2 and mixed mode, particulary how 4-way handshake packets look-like for every type? Is there any good lecture about it with packets examples? Above question ...
1
vote
2answers
78 views

sniffing with wireshark on wireless network

In a wireless network, does wireshark sniffs all the packets that are in move, or only packets whom we are the destination/source ? If it sniffs all the packets in the air, can someone explain or ...
1
vote
1answer
708 views

TLSv1 HandShake but SSLv2 client hello

I found this question: SSLv3 HandShake but TLSv1 client hello However, my situation is opposite: SSLv2 client hello then TLSv1 handshake. Can you please explain this for me? I use Wireshark to ...
0
votes
1answer
188 views

HTTP Basic Authentication - password missing

I am trying to retrieve a username and password send over the network. I was able to capture the following using Wireshark: GET /rcp_tunnel HTTP/1.0 Host: ***.***.***.*** Authorization: Basic dXNlcjo=...
-5
votes
3answers
4k views

Can I do hacking using Windows OS? [closed]

I have searched the web a numerous times but haven't found an explicit answer to my question. I've studied (at school and on my own) computer networks for 2 years, doing active programming for 4 years ...
0
votes
0answers
18 views

Current Decryption Support for TLS [duplicate]

I've been locking things at clients down recently and ran into a side effect I hadn't really thought about were TLS traffic using DHE based ciphers can't be decrypted with SSLDump or Wireshark. I ...
0
votes
1answer
129 views

What is the difference between Wireshark and Ettercap for man in the middle attacks!

I know of the two programs, one is Wireshark (a packet sniffing program) and the other is Ettercap (a man in the middle attack program). I tried doing a MITM attack before, legally on my own home ...
0
votes
1answer
96 views

Capture & Decrypt packets captured by monitoring mode

I am working on capturing packets using monitoring mode on my laptop. The problem is that I cannot get the source/destination IP's since the packets are encrypted. I added a key and it didn't work (I ...
2
votes
2answers
888 views

How to capture WhatsApp API requests using Fiddler?

I am trying to capture WhatsApp network requests and not able to do it using Fiddler. This is what I did: Installed Fiddler. Exported Root certificate and installed on my Android device. I modified ...
4
votes
1answer
96 views

Are there any statistics about packet filtering to prevent IP spoofing on the internet?

DDoS attacks via spoofed DNS(sec) are daily news for the last few years, but packet filtering should prevent IP spoofing on the internet. I tried (as an exercise) to spoof a packet on my VPS and on ...
-3
votes
1answer
404 views

Wireshark decode base64 [closed]

Can Wireshark decode base64 in multiple packets? The base64 is not dealing with auth but is in a DNS packet in the text field. As of now I'm decoding them by hand, one at a time.
2
votes
0answers
87 views

Linux machine continuously transferring data over the network to random servers in china and across the globe [duplicate]

I have been using Linux for about 5 years now but I am not very skilled with the commands to monitor and figure out internal issues. I recently was having trouble with the Internet. My roommates were ...
2
votes
1answer
95 views

Hiding packets, requests, traffic from my PC through Ethernet connected to workplace network

Before everyone jumps on the bandwagon, as I so often see, of saying you shouldn't do anything on a workplace network that is to be done annonymously on your own home network, I want to know an actual ...
12
votes
2answers
146 views

Is my Windows phone protected from attacks that reveal list of ssids it knows about?

My goal is to see the SSIDs requested by mobile devices in my home. For example, my Windows phone knows about SSIDs called "coffee_shop", "planet_fitness" and "library". I have my phone set to "...