Wireshark is a graphical packet capture and analyser open-source software. It can be used for a variety of network communication analysis tasks like protocol development and troubleshooting. It shows packets on the IP level.

learn more… | top users | synonyms

0
votes
0answers
30 views

Can't identify the attack ? [on hold]

I've checked the attack type from this packet (721619.pcap) and now I'm impossible to identify this attack. Cloudshark link ( https://www.cloudshark.org/captures/50e23e13bb31 ). ip.src == ...
18
votes
1answer
309 views

How to demo Skype-decryption using FOSS tools?

I'm preparing a presentation on Skype networking. And I'd like to demo decryption. I found a good approach to decrypting the TLS packets captured with WireShark in this blog post: Rob Andrews, ...
0
votes
2answers
50 views

Monitor traffic that is going through my router

I want to monitor the HTTP traffic of all clients connected via wifi to my wireless router. I want to capture the traffic with my Notebook which is also wirelessly connected to the router. Hardware ...
1
vote
1answer
36 views

How do I associate an SSID to a device?

In other words I am referring to the wlan.fc.type_subtype==0x04 filter in Wireshark while using a WiFi adapter in monitor mode. How can I associate an SSID to an Android device (for example) if that ...
0
votes
0answers
27 views

Difference between WPA, WPA2 and mixed mode on packets level

What is the difference between wpa, wpa2 and mixed mode, particulary how 4-way handshake packets look-like for every type? Is there any good lecture about it with packets examples? Above question ...
1
vote
2answers
57 views

sniffing with wireshark on wireless network

In a wireless network, does wireshark sniffs all the packets that are in move, or only packets whom we are the destination/source ? If it sniffs all the packets in the air, can someone explain or ...
1
vote
1answer
77 views

TLSv1 HandShake but SSLv2 client hello

I found this question: SSLv3 HandShake but TLSv1 client hello However, my situation is opposite: SSLv2 client hello then TLSv1 handshake. Can you please explain this for me? I use Wireshark to ...
0
votes
1answer
57 views

HTTP Basic Authentication - password missing

I am trying to retrieve a username and password send over the network. I was able to capture the following using Wireshark: GET /rcp_tunnel HTTP/1.0 Host: ***.***.***.*** Authorization: Basic ...
-5
votes
3answers
2k views

Can I do hacking using Windows OS? [closed]

I have searched the web a numerous times but haven't found an explicit answer to my question. I've studied (at school and on my own) computer networks for 2 years, doing active programming for 4 years ...
18
votes
2answers
18k views

Decrypting TLS in Wireshark when using DHE_RSA ciphersuites

How can I decrypt TLS messages when an ephemeral Diffie-Hellman ciphersuite is used? I am able to expose the premaster secret and master secret from the SSL Client. Using that, how to decrypt the ...
0
votes
0answers
18 views

Current Decryption Support for TLS [duplicate]

I've been locking things at clients down recently and ran into a side effect I hadn't really thought about were TLS traffic using DHE based ciphers can't be decrypted with SSLDump or Wireshark. I ...
0
votes
1answer
61 views

What is the difference between Wireshark and Ettercap for man in the middle attacks!

I know of the two programs, one is Wireshark (a packet sniffing program) and the other is Ettercap (a man in the middle attack program). I tried doing a MITM attack before, legally on my own home ...
0
votes
1answer
39 views

Capture & Decrypt packets captured by monitoring mode

I am working on capturing packets using monitoring mode on my laptop. The problem is that I cannot get the source/destination IP's since the packets are encrypted. I added a key and it didn't work (I ...
2
votes
2answers
282 views

How to capture WhatsApp API requests using Fiddler?

I am trying to capture WhatsApp network requests and not able to do it using Fiddler. This is what I did: Installed Fiddler. Exported Root certificate and installed on my Android device. I modified ...
4
votes
1answer
59 views

Are there any statistics about packet filtering to prevent IP spoofing on the internet?

DDoS attacks via spoofed DNS(sec) are daily news for the last few years, but packet filtering should prevent IP spoofing on the internet. I tried (as an exercise) to spoof a packet on my VPS and on ...
-3
votes
1answer
137 views

Wireshark decode base64 [closed]

Can Wireshark decode base64 in multiple packets? The base64 is not dealing with auth but is in a DNS packet in the text field. As of now I'm decoding them by hand, one at a time.
2
votes
0answers
85 views

Linux machine continuously transferring data over the network to random servers in china and across the globe [duplicate]

I have been using Linux for about 5 years now but I am not very skilled with the commands to monitor and figure out internal issues. I recently was having trouble with the Internet. My roommates were ...
2
votes
1answer
73 views

Hiding packets, requests, traffic from my PC through Ethernet connected to workplace network

Before everyone jumps on the bandwagon, as I so often see, of saying you shouldn't do anything on a workplace network that is to be done annonymously on your own home network, I want to know an actual ...
4
votes
2answers
204 views

Decrypting SSL using Wireshark Linux vs Windows

I'm working on decrypting my own traffic that gets sent through Wireshark and I've been following this guide for reference. I have been using the SSLKEYLOGFILE environment variable and I can get the ...
10
votes
2answers
129 views

Is my Windows phone protected from attacks that reveal list of ssids it knows about?

My goal is to see the SSIDs requested by mobile devices in my home. For example, my Windows phone knows about SSIDs called "coffee_shop", "planet_fitness" and "library". I have my phone set to ...
3
votes
1answer
102 views

Log all crypto keys used for outgoing SSL / TLS connections on Linux server

Is there some environment variable that works how SSLKEYLOGFILE works for NSS-reliant programs but which would apply to all outgoing TLS / SSL connections on a Linux server and not just ones that use ...
3
votes
1answer
528 views

Decrypt SSH traffic in pcap file given private key

I have a Pcap file that contains some SSH encrypted packets. I have the server public and private key. How do I decrypt these private keys? Is it possible to get the session key using Wireshark or ...
2
votes
1answer
181 views

Can't decrypt captured HTTP connection from WPA Network

Hi I am attempting to sniff HTTP packet traffic using Wireshark on Kali Linux. I have added my wpa-pwd correctly to the IEEE 802.11 protocol and enabled "decryption". Currently I can only view the ...
5
votes
2answers
356 views

Private key to PEM

I'm new to security and I'm trying to decode some SSL encrypted communication between my machine and server. I managed to obtain private and public keys as far as I understand private key is this ...
2
votes
2answers
1k views

Decoding tunnel bytes in EAP-TLS or EAP-TTLS using Wireshark

I have a few pcaps of traffic for EAP-TTLS conversation, carried by RADIUS. I also have some being carried by EAPoL, but I think the answer to that case might be even less straightforward (though ...
1
vote
2answers
1k views

How do we determine the SSL/TLS version of an HTTP request?

We are wanting to configure our Windows client to use only TLS 1.1 and greater. We've learned that we can do this by editing the registry. Now we want to make several HTTPS requests from different ...
4
votes
1answer
356 views

Why did this attack use 0.0.0.0 as IP address and why did it work?

Working through this exercise in network forensics, the attacker used a buffer overflow exploit to send commands to the victim's command prompt. The commands open an FTP session and download some ...
1
vote
3answers
154 views

Sniffing traffic on a secured wifi connection

Open wifi is a security risk since all the data can potentially be sniffed by anyone. What I want to ask is even on a secured wifi (which requires some kind of password for authentication), the data ...
3
votes
1answer
481 views

ARP poisoning and port forward together

Suppose these assumptions: Router IP address: 192.168.1.1 Router MAC address: 00:00:00:00:00:00 My IP address: 192.168.1.2 My MAC address: 00:00:00:00:00:01 Victim IP address: 192.168.1.3 ...
10
votes
1answer
179 views

Firefox trying to connect to other computers on the LAN

While running Wireshark trying to troubleshoot some other issues, I noticed several SYN connections to ports 80 and 443 on the workstation I was using. The packets were dropped. These were coming from ...
2
votes
1answer
177 views

Sniff LAN SSL requests

When I log in into Facebook, using Wireshark in the same machine, I can read the request data in plain-text. That doesn't happen when I'm sniffing my LAN: I can read the SSL packets but they are ...
4
votes
3answers
514 views

How to convert a pcap file to a raw file?

I need to convert a pcap-ng/ now a pcap file to a raw file for being able to analyse it with multimon-ng. Any recommendations? It should be possible, but I am not aware how it should be done.
5
votes
2answers
1k views

Extract pre-master keys from an OpenSSL application

Consider an application using OpenSSL which has a bug. A packet capture of the full SSL session is available, as well as a core dump and debugging symbols for the application and libraries. A RSA ...
0
votes
5answers
670 views

Monitor websites being visited on network

I need to monitor the websites being visited on my wifi network by the different IPs connected to the network. What is the best way to do this? I spent some time with Wireshark but I feel it is a bit ...
2
votes
2answers
94 views

Could anyone technically see my requests with TOR if the person has access to my router?

I was wondering if someone could sniff the packets I send via my computer with something like Wireshark I guess even if I use TOR and the person could access the router like stated.
1
vote
1answer
67 views

Padding of 802.11 packet with 0's in libpcap [closed]

I am trying to send probe request to Access Points.But whenever I send a probe request packet it is padded with 0's i.e I see two packets on wireshark for every packet I send : a non-padded packet and ...
1
vote
1answer
2k views

How to simulate network attacks and use wireshark to detect them?

I am working on a project which involves me to simulate a network attack and to use wireshark to detect the attack. DOS/MIM etc. I have found the following links that provided help but there are still ...
2
votes
0answers
30 views

What features should I look for when buying a external wireless card used for the purpose of pen testing/snooping [duplicate]

I'm currently planning to buy an external wireless card for the purpose of pen testing and snooping my own network in order to learn more about it and try to create more preventive measure against ...
2
votes
2answers
545 views

is it possible to detect zigbee traffice via wireshark? if yes , how?

I have a zigbee access point. I am not able to detect its network. Also, unable to capture its traffic using wireshark like we capture wifi traffic. Can someone tell me what should be done to analyse ...
9
votes
5answers
27k views

How to get private key used to decrypt HTTPS traffic sent and received from my own browser with wireshark

I am working with a website that sends API requests. I would like to write a client to make the requests myself, but in order to do so I would need to first see the request payloads. However, the ...
1
vote
1answer
93 views

Intercept https traffic [duplicate]

Is it possible for a packet sniffer such as wireshark to be able to decrypt the traffic generated by a https connection from a browser ? I do not have control of the server, but I have control of the ...
12
votes
1answer
2k views

How to study the packets sent by a keylogger

One of my friends runescape account got hacked through key-logger. He downloaded a runescape gold generator from a file sharing site and tried to use it. I have a strong doubt that it is a key-logger. ...
3
votes
3answers
361 views

Is it possible to obtain the login credentials submitted by users?

It's a question at computer security textbook Assume that user A is about to use some website that requires login credentials. User A starts his web browser, types the website’s URL, and submits the ...
5
votes
2answers
3k views

Facebook POST request capture

I have been trying to test a sniff on facebook POST request forms using wireshark (filtered HTTP). At login form, I would try login, and then check wireshark and see that no packet was captured. ...
-1
votes
1answer
125 views

Slow internet - Worried about spammed packets

got a weird question and I'm not sure if I should even post this on here but I couldn't think of anywhere better to ask. Lately, I've been getting some internet speed issues. I closed literally every ...
0
votes
1answer
129 views

What do these Wireshark screenshots demonstrate?

I'm reading an article about the recent Github DDoS with traffic coming from non-Chinese Baidu users here. There are two Wireshark screenshots in the middle of the article with arrows pointing to the ...
0
votes
1answer
246 views

Source port and destination port [closed]

Just fiddling with wireshark and telegram as part of some learning exercise on security. I realised that the source port for the telegram app is 58939 and the destination port would be 443. Why is ...
0
votes
0answers
24 views

Wireshark TLS Handshake shows version as TLS 1.0 and TLS 1.2 both [duplicate]

As you see below in the image, wireshark screenshot shows TLSv1.2 Record Layer : Handshake Protocol, but version attribute's value is TLS 1.0 Why does wireshark shows version as TLS 1.0 and TLS ...
0
votes
0answers
22 views

upload received ssl data to distributed servers

I am doing the network traffic analysis for a live camera device from a Chinese company which allows to view the real time video from ios6 app. 172.17.200.2 is the IP of the ios device.And the ...
0
votes
0answers
297 views

TLSV1 and TLSV1.2 coexist issue in wireshark

I analysed an live camero's net traffic and found that the client uses both TLS1.0 and TLS1.2 in the handshakings while the server only uses TLS1.0. How can the handshaking uses both TLSV1.0 and ...