Stack Exchange Network

Stack Exchange network consists of 174 Q&A communities including Stack Overflow, the largest, most trusted online community for developers to learn, share their knowledge, and build their careers.

Visit Stack Exchange

Questions tagged [wireshark]

Wireshark is a graphical packet capture and analyser open-source software. It can be used for a variety of network communication analysis tasks like protocol development and troubleshooting. It shows packets on the IP level.

0
votes
0answers
25 views

ARP requests from router to phone, captured on laptop network interface [closed]

I was using Wireshark to capture network traffic on my laptop's wireless network adapter. I suddenly noticed that my router is sending ARP requests to my phone. I am wondering why this would be ...
0
votes
1answer
21 views

DNS query with netcat (convert DNS queries into hex ASCII)? [closed]

This article is interesting. He created this string using the tshark DNS query: "\x13\x37\x01\x00\x00\x01\x00\x00\x00\x00\x00\x00\x13google-public-dns-a\x06google\x03com\x00\x00\x01\x00\x01" But I ...
0
votes
1answer
90 views

Can I detect malware download using Wireshark?

I have been working on Wireshark lately. I am learning about malware behavior, but I am curious to know whether methods exist to detect malware download (via drive-by download) on systems. Anti-...
25
votes
2answers
7k views

Why is my computer making requests to my Roku about spotify?

I'm new to inspecting packets with Wireshark so this might be something very stupid on my part. That said, I don't really understand the transaction between my computer and my Roku. 17 1.129097 ...
0
votes
1answer
66 views

How can I see the data content (HTML, JS, etc) in HTTPS responses in Wireshark?

I'm learning packet sniffing and analysis with Wireshark. At first, I could only see DNS, TCP, and ARP packets. I learned I couldn't see any HTTP packets because it was all encrypted in the transport ...
-1
votes
1answer
38 views

Would sniffing all network traffic from android device to check for spyware be a viable solution

I suspect that my Google pixel (Android 9) phone has some sort of a spyware installed. There are no obvious symptoms like overheating, extreme data usage, or battery draining at an unusual rate. But I ...
0
votes
0answers
28 views

Identify SSL invalid handshake using Wireshark

I am doing a research on "Network flow anomaly detection" and use Wireshark for my work. I have a problem of identifying the packets with invalid SSL/TLS handshakes. Is there a way/algorithm to detect ...
0
votes
0answers
30 views

ICMP Packet collection fails with airodump-ng

I have 3 machines (A,B, and C) connected to the same wireless network. I can ping A to B and vice versa. Machine C is set to monitor mode using airmon-ng and airodump-ng commands. When I try to ...
2
votes
0answers
35 views

Wireshark DNS sniffing : too much junk -> Are there hostname “blacklists” for wireshark?

So I'm sniffing my DNS on wireshark. There's way too much junk because the websites include many advertising tools, web tracking, etc. Is there some blacklist that contains all those pesky hostnames, ...
3
votes
1answer
78 views

How do I know that the request and response is using encryption protocols in burp suite?

I know these things can easily be done on wireshark, tshark, etc but is it possible to know that the request I forwarded and the response I received is using protocols such as TLS, TLSv1.2, TCP, HTTP, ...
2
votes
0answers
53 views

How to identify the communication protocol used in a wireless device?

I really hope that this is the right place to ask. I need to analyze a baby monitor for any security or privacy weaknesses. The spec sheet of the baby monitor says, that it uses the ISM 2400~2483.5 ...
0
votes
1answer
113 views

Analyze / Sniff all packets from all devices connected to a router

First of all, before explaining what I'm trying to do, let me clarify that my intentions are not steal any information, as it's only for study purposes, not even for my own entertainment. I'm trying ...
0
votes
0answers
31 views

How to extract a hash (VNC, SSH2 or SMB) from a WireShark capture file

Until now I have only tested WPA hashes, and they have been extracted from a airodump-ng's capture file using tshark or aircrack-ng (-J option). I wanna go one step beyond, and in an effort to ...
0
votes
0answers
55 views

How can I found a source of HTTP request in Wireshark?

There are weird requests to/from the AWS: and another one to/from 177.143.198.104.bc.googleusercontent.com: ( http://whois.domaintools.com/177.143.198.104 ) I use Ubuntu 18.04 Desktop, web browsers ...
0
votes
1answer
40 views

Understanding OPENVAS Wireshark Capture

I was looking at a sample capture from a tutorial I was looking at and below is a snippet of a wireshark packet capture: OpenVAS:() { _; OpenVAS; } >_[$($())] { echo Content-Type: text/plain; ...
0
votes
1answer
39 views

Tls certificate correspondence

I am not really good in tls details, just know some basics. So there are couple of questions about it: Is there a way to decipher tls in wireshark if the cipher method is diffie hellman? I know that ...
3
votes
2answers
616 views

How wireshark capture packets in LAN without arpspoof?

I created a lab environment which has Windows 7 and Kali Linux in VMware. In Kali Linux, I opened Wireshark and started to listen to traffic on eth0. After that, in my Windows 7 machine, I opened an ...
0
votes
1answer
101 views

How to identify a Ping of Death attack by analyzing its packet in Wireshark? [closed]

I've tried researching it for a long while, but came out dry.
4
votes
1answer
101 views

GSM - Implementing Cipher Mode Command on YateBTS

I've been studying on Yate & YateBTS source code for a while, and I was wondering why there is no ciphering mode implementation in the source!? I use the combination of BladeRF x40 FPGA and ...
2
votes
2answers
63 views

My AP is probing other device?

I just installed kismet 2018 Beta update on my kali and test run it on my host but i came across something that i dont understand and i would appreciate if someone would explain to me. When i check ...
11
votes
4answers
3k views

Eavesdropping vs. sniffing

I'm taking a coursera course, and they take pains when talking about network security to distinguish between eavesdropping and sniffing. According to their definitions, sniffing involves reading or ...
0
votes
1answer
37 views

Wireshark unable to capture layer 3 [closed]

I'm new to Wireshark. I'm trying to visit google.com and capture the packets. However, Wireshark is only showing me layer 2 packets as shown below: Hence, filters like ip and ip addr == x.x.x.x are ...
1
vote
1answer
354 views

How can i sniff Telegram packets before they get encrypted?

So how can I sniff packets that are being sent from my computer to their server and from their servers to me using a sniffing app like Wireshark? right now when i use Wireshark, they are all ...
1
vote
1answer
193 views

Save decrypted pcap or decrypt on reading with rdpcap

I created a small program with runs command: tshark -i2 -o wlan.enable_decryption:TRUE -o "uat:80211_keys:\"wpa-pwd\",\" Passphrase:SSID\"" -w test.pcapng This creates the file test.pcapng, but it ...
0
votes
0answers
31 views

How would I inspect a vpn connection in the interest of mimicking a mobile via a more generic tool?

I use a mobile app that forces all device traffic through a VPN. I’d like to mimic the app’s connection by setting up the VPN on a router and forcing all traffic through the VPN connection at the ...
1
vote
0answers
72 views

Hide data from wireshark on localhost

Assuming you're working with an old network protocol, or insecure/unencrypted protocol (HTTP for example), is there a way to make it difficult for network sniffers from capturing the packets? An MITM ...
3
votes
2answers
1k views

How to understand “Encrypted Data” in TLS message type?

In this Wireshark screenshot, there is a message type "Encrypted Data". Does anyone know what this is and in which situations this message type will be sent?
3
votes
1answer
706 views

Optimal way to capture HTTP(S) traffic on proxy-unaware iOS applications

I am trying to capture HTTP(S) traffic from a proxy-unaware Xamarin iOS application. The current tools I have available is a Mac with a Linux Mint VM, Xcode and iOS developer tools, Burp Suite ...
0
votes
0answers
65 views

Wireshark showing all ports being probed from my tablet

The first two pictures: Wireshark shows a tablet device as the source and my computer as the destination and vice versa. This tablet has never been connected via USB, FTP, BT, nothing to the computer. ...
0
votes
1answer
2k views

Filter TLS in Wireshark or other monitoring tool

As part of the new best practices in hardening server communications I need to deny TLS 1.0 on the web server, before doing so I wish to identify the amount of clients whom connect with this level of ...
-1
votes
0answers
133 views

Reverse engineering MQTT commands of an Alarm App

I have this alarm called Chuango H4 that uses WIFI and GSM to be controlled via a Chuango app called "Smart Home". I want to be able to controll the alarm by my own means. Using the Wireshark packet ...
0
votes
0answers
138 views

Grabbing WA Web chat partner IP with wireshark - any ideas?

Is there any way to grab the IP of the respective other counterparty ones invovlved in an P2P chat over WAWeb (on the side that can be sniffed) by putting wireshark on the line and monitor - for what ...
0
votes
1answer
245 views

Finding wpa2 key length

Is it possible to determine WPA key length through a successful handshake? Below is a screen capture showing the packet capture session of interest as displayed in Wireshark: My question came from ...
-3
votes
1answer
273 views

Suspicious network activity detected in Wireshark [closed]

I have never noticed something like this in my network before: My IP: 192.168.1.46 It keeps repeating randomly and constantly. At first, I thought I was infected by some type of malware. I ...
0
votes
2answers
703 views

What is the Session ID parameter indicate in Client Hello and Server Hello messages

I was trying to understand the TLS handshake in depth. I set up Wireshark and captured the github.com traffic. While inspecting the Client Hello and Server Hello, I found a parameter Session ID. ...
3
votes
2answers
253 views

Installing own certificate for HTTPS sniffing?

This is something I heard before but cannot remember how to do, I am looking for a tutorial or alike. I have an Android application I need to audit. I need to check if any cookies are being ...
1
vote
0answers
24 views

Decrypting 802.11 packets captured through wireshark [duplicate]

I created my own network with security of WPA2-PSK, so I know the SSID, and password. I then connected 2 devices (A and B) to this network and started capturing B's traffic from A using wireshark in ...
1
vote
2answers
69 views

What is this address I received from wireshark?

______source____________destination___ 41:9c:7f:78:b1:0c | 08:00:d0:58:59:4c I am trying to identify those addresses, the source and the destination, I thought it was IPv6 but then I realized it'...
-1
votes
1answer
53 views

Why would the amount of packets received be greater than the amount of packets sent? [closed]

I am new to wifi, and as I was looking at .pcap files, I noticed that one connection took an absurdly large amount of time. Another thing that stood out is that the amount of packets received was so ...
0
votes
1answer
225 views

Does nmap mtu scan really send crafted mtu size?

Since nmap is a well-known security tools, I guess this is the right section. I've been reading about nmap techniques here as part of my network security syllabus ... I've performed 2 scans ... one ...
-3
votes
1answer
133 views

Wireshark showing HTTP on top of TLS

I am seeing an HTTP request on top of SSL in Wireshark. Can anyone explain why?
-1
votes
1answer
872 views

TLS, Wireshark “this session reuses previously negotiated keys”

I made a Wireshark tap for 2 request: a HTTP GET to a login authentication page then a HTTP POST when I send credentials to the server As you can see, I get a warning message from Wireshark because ...
3
votes
1answer
1k views

Setup Wireshark to decrypt TLS_DHE

I have a passively sniffed traffic dump of client/server were packets are encrypted with cipher suite Cipher Suite: TLS_DHE_RSA_WITH_AES_128_GCM_SHA256 (0x009e) With a Logjam attack I managed to ...
2
votes
1answer
3k views

AirPcap is end-of-availability. What alternatives do you recommend? [closed]

I've been using Riverbed AirPcap dongles for Wi-Fi analysis for quite some time. But when I am trying to order more, I noticed all their AirPcap devices are end of life by Dec 31, 2017, for reason I ...
5
votes
1answer
154 views

Is it safe to share a TLS Master Secret?

I am debugging a client/server TLS communication issue with a 3rd party server vendor. For the client-side, I've captured a pcapng dump along with saved via a SSLKEYLOGFILE-like utility. Can I share ...
1
vote
1answer
86 views

DTLS Record with weird cipher text

I am using mbed TLS to deploy each a DTLS Server and a DTLS Client application. After the DTLS Handshake, the Client sends "Hi, Server" and then the Server answers "Hi Client". The connection is ...
1
vote
1answer
318 views

Packet analysis of IRC traffic

I've been going through this malware traffic analysis exercises and part of the malicious traffic detected is IRC traffic over non-standard port 443. This is picked up by ET Snort rule sid:2000348; ...
2
votes
0answers
111 views

Duplicate packets in packet injection

I've been trying to develop a few scripts that can forge custom 802.11 frames and inject them through a monitor mode interface. I have gone through the development documentation of radiotap headers ...
1
vote
1answer
173 views

Wireshark trafic from router [closed]

I have a very old router and in my routers admin page there is no option to write any commands or view traffic in any way, i tried using Putty to get inside it with port 22 and I get a connection with ...
1
vote
1answer
388 views

Can't see ARP poisoning packets on Wireshark and Scapy

I'm trying to create a python script to detect ARP poisoning on WiFi networks. I'm using scapy and wireshark to check scapy's output. I'm stuck trying to see all ARP traffic on the network, I can only ...