Wireshark is a graphical packet capture and analyser open-source software. It can be used for a variety of network communication analysis tasks like protocol development and troubleshooting. It shows packets on the IP level.

learn more… | top users | synonyms

0
votes
0answers
12 views

Wireshark TLS v1 Xmpp

i'm trying to sniff on XMPP communication of League of Legends game. So far I found out that it's using port 5223 and SSL encryption. Is there any way to decrypt the data sent to see actual XML data ...
0
votes
1answer
30 views

Unsecure FTP with Encrypted file and Wireshark leakage

Hi i was wandering if it is possible to have a password leaked to an encrypted file on an anon ftp server with r-x-w permissions. So for example i have a file encrypted using gpg and when opened on ...
0
votes
2answers
143 views

Sniffing WhatsApp chat using Wireshark

Suppose two persons are using WhatsApp on Android. How can I see the communication between them if I have Wireshark running on a PC listening on network interface card? I know the communication ...
5
votes
2answers
307 views

Decrypting SSL using Wireshark on Linux vs Windows

I'm working on decrypting my own traffic that gets sent through Wireshark and I've been following this guide for reference. I have been using the SSLKEYLOGFILE environment variable and I can get the ...
0
votes
2answers
182 views

Monitor traffic that is going through my router

I want to monitor the HTTP traffic of all clients connected via wifi to my wireless router. I want to capture the traffic with my Notebook which is also wirelessly connected to the router. Hardware ...
3
votes
2answers
43 views

Is there any chance of PC getting infected when you analyse PCAP malware file?

Currently, there are lots of pcap files of malware analysis carried by other researchers available on Internet. Such files show the traffic pattern and communication of the malware with it's C&C ...
3
votes
1answer
78 views

Wireshark tcp filter: tcp[((tcp[12:1] & 0xf0) >> 2):4]

While readinf this doc https://wiki.wireshark.org/CaptureFilters I found this line tcp[((tcp[12:1] & 0xf0) >> 2):4] which figure out the TCP Header Length, but i can't find out how it really ...
1
vote
2answers
44 views

Wireshark as a network scanner [closed]

I have been playing with nmap lately, trying out arp-ping scanning and using idle hosts, etc... Looking at Wireshark, there is always some suspicious activity when performing scans. The thing is, I ...
2
votes
4answers
12k views

How Can I Capture Packets of LAN device in Wireshark?

EDIT: Seeing how this question is so popular, I'll rephrase and improve it to allow for an answer. It's almost unanswerable in its old form. Setup PC running Wireshark, connected to the network ...
1
vote
2answers
55 views

MITM my own SSL connections with e.g. wireshark - no proxy

I'd like to investigate some SSL (https?) traffic coming from one of my computers. The problem is that I don't know for sure which program it comes from, and I most likely can't make it use a proxy ...
1
vote
0answers
82 views

Sniff wireless (Wi-Fi) trafic with Wireshark

I have a wireless card (AWUS036H) in monitor mode (with airmon-ng start wlan0) on my Debian machine. In Wireshark, in "capture options", all my interfaces are in promiscuous mode. The test network is ...
11
votes
5answers
31k views

How to get private key used to decrypt HTTPS traffic sent and received from my own browser with wireshark

I am working with a website that sends API requests. I would like to write a client to make the requests myself, but in order to do so I would need to first see the request payloads. However, the ...
0
votes
2answers
102 views

How to capture Wifi 802.11 traffic?

I want to capture the wifi traffic from my wireless card, so what i have to do and are there tools for that? I know that there is aircrack-ng and airodump, but these tools need a extra wireless ...
2
votes
3answers
137 views

How to decrypt SSL traffic with a packet sniffer when I have the private key?

How you do you decrypt ssl packets (traffic) with the private key? I tried to do this with ssldump and openssl but nothing worked.
3
votes
1answer
69 views

What is required to decrypt other device's WPA2 packets?

As the title specifies, I'm trying to understand the minimum requirements for a utility like Wireshark to decrypt the packets from another device on a simple home network using WPA2 personal (AES). ...
0
votes
2answers
109 views

What is really wireless sniffing, and how can this attack damage someone

I guess that this is a dumb question, but i really thought for a longtime that the wireless sniffing attack consists of listening to all the packets that get over the air, but apparently it isn't ...
0
votes
1answer
85 views

how to catch a packets from wifi that I am connected to ( or not connected to )? [closed]

I have wifi connection, and I want to use something like wireshark to catch all the packages that my wifi router is listening to. How can I do it? If i want to catch packets from the router that I ...
18
votes
1answer
367 views

How to demo Skype-decryption using FOSS tools?

I'm preparing a presentation on Skype networking. And I'd like to demo decryption. I found a good approach to decrypting the TLS packets captured with WireShark in this blog post: Rob Andrews, ...
1
vote
1answer
51 views

How do I associate an SSID to a device?

In other words I am referring to the wlan.fc.type_subtype==0x04 filter in Wireshark while using a WiFi adapter in monitor mode. How can I associate an SSID to an Android device (for example) if that ...
0
votes
0answers
44 views

Difference between WPA, WPA2 and mixed mode on packets level

What is the difference between wpa, wpa2 and mixed mode, particulary how 4-way handshake packets look-like for every type? Is there any good lecture about it with packets examples? Above question ...
1
vote
2answers
71 views

sniffing with wireshark on wireless network

In a wireless network, does wireshark sniffs all the packets that are in move, or only packets whom we are the destination/source ? If it sniffs all the packets in the air, can someone explain or ...
1
vote
1answer
427 views

TLSv1 HandShake but SSLv2 client hello

I found this question: SSLv3 HandShake but TLSv1 client hello However, my situation is opposite: SSLv2 client hello then TLSv1 handshake. Can you please explain this for me? I use Wireshark to ...
0
votes
1answer
133 views

HTTP Basic Authentication - password missing

I am trying to retrieve a username and password send over the network. I was able to capture the following using Wireshark: GET /rcp_tunnel HTTP/1.0 Host: ***.***.***.*** Authorization: Basic ...
-5
votes
3answers
3k views

Can I do hacking using Windows OS? [closed]

I have searched the web a numerous times but haven't found an explicit answer to my question. I've studied (at school and on my own) computer networks for 2 years, doing active programming for 4 years ...
19
votes
2answers
21k views

Decrypting TLS in Wireshark when using DHE_RSA ciphersuites

How can I decrypt TLS messages when an ephemeral Diffie-Hellman ciphersuite is used? I am able to expose the premaster secret and master secret from the SSL Client. Using that, how to decrypt the ...
0
votes
0answers
18 views

Current Decryption Support for TLS [duplicate]

I've been locking things at clients down recently and ran into a side effect I hadn't really thought about were TLS traffic using DHE based ciphers can't be decrypted with SSLDump or Wireshark. I ...
0
votes
1answer
98 views

What is the difference between Wireshark and Ettercap for man in the middle attacks!

I know of the two programs, one is Wireshark (a packet sniffing program) and the other is Ettercap (a man in the middle attack program). I tried doing a MITM attack before, legally on my own home ...
0
votes
1answer
73 views

Capture & Decrypt packets captured by monitoring mode

I am working on capturing packets using monitoring mode on my laptop. The problem is that I cannot get the source/destination IP's since the packets are encrypted. I added a key and it didn't work (I ...
2
votes
2answers
633 views

How to capture WhatsApp API requests using Fiddler?

I am trying to capture WhatsApp network requests and not able to do it using Fiddler. This is what I did: Installed Fiddler. Exported Root certificate and installed on my Android device. I modified ...
4
votes
1answer
86 views

Are there any statistics about packet filtering to prevent IP spoofing on the internet?

DDoS attacks via spoofed DNS(sec) are daily news for the last few years, but packet filtering should prevent IP spoofing on the internet. I tried (as an exercise) to spoof a packet on my VPS and on ...
-3
votes
1answer
301 views

Wireshark decode base64 [closed]

Can Wireshark decode base64 in multiple packets? The base64 is not dealing with auth but is in a DNS packet in the text field. As of now I'm decoding them by hand, one at a time.
2
votes
0answers
87 views

Linux machine continuously transferring data over the network to random servers in china and across the globe [duplicate]

I have been using Linux for about 5 years now but I am not very skilled with the commands to monitor and figure out internal issues. I recently was having trouble with the Internet. My roommates were ...
2
votes
1answer
87 views

Hiding packets, requests, traffic from my PC through Ethernet connected to workplace network

Before everyone jumps on the bandwagon, as I so often see, of saying you shouldn't do anything on a workplace network that is to be done annonymously on your own home network, I want to know an actual ...
11
votes
2answers
132 views

Is my Windows phone protected from attacks that reveal list of ssids it knows about?

My goal is to see the SSIDs requested by mobile devices in my home. For example, my Windows phone knows about SSIDs called "coffee_shop", "planet_fitness" and "library". I have my phone set to ...
3
votes
1answer
177 views

Log all crypto keys used for outgoing SSL / TLS connections on Linux server

Is there some environment variable that works how SSLKEYLOGFILE works for NSS-reliant programs but which would apply to all outgoing TLS / SSL connections on a Linux server and not just ones that use ...
3
votes
1answer
1k views

Decrypt SSH traffic in pcap file given private key

I have a Pcap file that contains some SSH encrypted packets. I have the server public and private key. How do I decrypt these private keys? Is it possible to get the session key using Wireshark or ...
2
votes
1answer
235 views

Can't decrypt captured HTTP connection from WPA Network

Hi I am attempting to sniff HTTP packet traffic using Wireshark on Kali Linux. I have added my wpa-pwd correctly to the IEEE 802.11 protocol and enabled "decryption". Currently I can only view the ...
5
votes
2answers
882 views

Private key to PEM

I'm new to security and I'm trying to decode some SSL encrypted communication between my machine and server. I managed to obtain private and public keys as far as I understand private key is this ...
2
votes
2answers
1k views

Decoding tunnel bytes in EAP-TLS or EAP-TTLS using Wireshark

I have a few pcaps of traffic for EAP-TTLS conversation, carried by RADIUS. I also have some being carried by EAPoL, but I think the answer to that case might be even less straightforward (though ...
1
vote
2answers
4k views

How do we determine the SSL/TLS version of an HTTP request?

We are wanting to configure our Windows client to use only TLS 1.1 and greater. We've learned that we can do this by editing the registry. Now we want to make several HTTPS requests from different ...
4
votes
1answer
479 views

Why did this attack use 0.0.0.0 as IP address and why did it work?

Working through this exercise in network forensics, the attacker used a buffer overflow exploit to send commands to the victim's command prompt. The commands open an FTP session and download some ...
1
vote
3answers
190 views

Sniffing traffic on a secured wifi connection

Open wifi is a security risk since all the data can potentially be sniffed by anyone. What I want to ask is even on a secured wifi (which requires some kind of password for authentication), the data ...
3
votes
1answer
629 views

ARP poisoning and port forward together

Suppose these assumptions: Router IP address: 192.168.1.1 Router MAC address: 00:00:00:00:00:00 My IP address: 192.168.1.2 My MAC address: 00:00:00:00:00:01 Victim IP address: 192.168.1.3 ...
10
votes
1answer
208 views

Firefox trying to connect to other computers on the LAN

While running Wireshark trying to troubleshoot some other issues, I noticed several SYN connections to ports 80 and 443 on the workstation I was using. The packets were dropped. These were coming from ...
2
votes
1answer
194 views

Sniff LAN SSL requests

When I log in into Facebook, using Wireshark in the same machine, I can read the request data in plain-text. That doesn't happen when I'm sniffing my LAN: I can read the SSL packets but they are ...
3
votes
3answers
928 views

How to convert a pcap file to a raw file?

I need to convert a pcap-ng/ now a pcap file to a raw file for being able to analyse it with multimon-ng. Any recommendations? It should be possible, but I am not aware how it should be done.
5
votes
2answers
2k views

Extract pre-master keys from an OpenSSL application

Consider an application using OpenSSL which has a bug. A packet capture of the full SSL session is available, as well as a core dump and debugging symbols for the application and libraries. A RSA ...
0
votes
5answers
1k views

Monitor websites being visited on network

I need to monitor the websites being visited on my wifi network by the different IPs connected to the network. What is the best way to do this? I spent some time with Wireshark but I feel it is a bit ...
1
vote
2answers
109 views

Could anyone technically see my requests with TOR if the person has access to my router?

I was wondering if someone could sniff the packets I send via my computer with something like Wireshark I guess even if I use TOR and the person could access the router like stated.
1
vote
1answer
83 views

Padding of 802.11 packet with 0's in libpcap [closed]

I am trying to send probe request to Access Points.But whenever I send a probe request packet it is padded with 0's i.e I see two packets on wireshark for every packet I send : a non-padded packet and ...