What are /r/wireshark's favorite Products & Services?

From 3.5 billion Reddit comments

The Wireshark User Guide describes this feature in the section on "Filtering while capturing". It looks like the filter expression you want is "gateway 10.0.2.245". There's more detail about this feature in the PCAP-FILTER man page. That second link says there are some name resolution requirements for this feature that the Wireshark User Guide doesn't mention, so you may have to play around with this a bit to get it to work. The PCAP-FILTER page also shows an equivalent expression that uses the "ether" and "host" filters, so you might find it useful to try that if the "gateway" filter doesn't seem to do what you want. I just now tried using the "gateway" capture filter and couldn't get it to work, so the alternate syntax (e.g. "ether host ehost and not host host") may be the better option. In this case, "ehost" would be the Ethernet MAC address of the gateway and the final "host" is the IP address of the gateway, which you already know. When I tried this syntax just now it worked as expected.

Hope this helps - Good luck!

Sadly, nope. It's only for IPv4 according to the documentation on this feature:

Where to go from here? A couple ideas:

1. Write it yourself! Wireshark is open source, and can accept features from the community. Of course, this only works if you're a programmer.
2. Submit a feature request. You have to register for their Bugzilla system, but it's easy and free. Be sure to select enhancement as the severity

It's similar, but the Capture Info Dialog that's now missing was a live display that updated counts of the number and percentages of packets for a bunch of protocols, whereas the Protocol Hierarchy is a static display of what's currently in the capture. This section of the Wireshark online docs shows an image of it:

https://www.wireshark.org/docs/wsug_html_chunked/ChCapRunningSection.html

From reading the article I get the impression the author is not very well informed about the project he's reporting on, but does go on to show off his own product. That's okay, as long as the article is read in that context, a product showcase.

Some critiques on statements made.

>The projects authors definitely haven't done their best in fixing bugs before the release.

That in itself is a presumptuous statement, the fact that bugs remain does not mean that developers tried their best given their constraints (most notably: spare time).

> It is typical for the projects, which generally don't use static analysis tools, even free ones.

Here the author has missed the use of Coverity to analyse the project for over a decade.

>Such inserts also don't give a boost to code quality:
#line 1 "./asn1/acse/packet-acse-template.c"

The author seems to have missed that a lot of source code is actually generated from specification, in this case ASN.1. It does not produce readable/maintainable code, and that was never the intention. The specification and configuration files need to be maintained, where the code generation tooling is vetted for correctness.

​

The article then goes on to show a series of more or less severe issues, which range from unclean code, unclean exception handling to logic errors in dissecting protocol fields and possible mishandling of memory. These issues do exist and should be addressed. Preferably the most pressing first.

​

The conclusion is right, in that there are numerous defects to be addressed. The latest figures (as per April 1st, no joke) show 5,192 defects in 3,748,761 lines of code, giving a .22 defect density, which is less than half the average of the 6000 OSS projects scanned by Coverity. Maybe it's not as bad as the author, being a self proclaimed perfectionist, seems to portray.

I understand what is sent over https in NordVPN, message of the day / update version, etc... It made me realize that it's way safer for an application using 3rd party open-source libs like openssl/tls to static link instead of using dlls... It's a long shot, but if someone as privilege access to a computer, just replacing a dll can compromise all future 'secure' https sessions that a user will have. You have the keys and just need to listen on the lan for his web sessions. A little script to parse those https session outputs and voila. This is not possible when linking staticly (?sorry for my english).

Cheers mate!

Hi, thank you very much for your reply. Just a little follow up: (im a programmer) The app’s (NordVPN) is using 3rd party dlls (libcrypto, libpks, ) that I can recompile with more functionalities. After tinkering, I made it work… I needed to extract some info on other libs but got it to dump the tls keys for wireshark view.

Cheers

Capturing wireless traffic can be quite a challenge, but this Wireshark Wiki page gives a pretty good overview of what's involved for various platforms, including Windows. Even so, you may still have to acquire a different wireless adapter capable of operating in the appropriate monitor mode to capture wireless traffic, since not all wireless adapters support that.

If your existing AP happens to be connected to a managed switch then you'd probably have better luck using the "port mirroring" (or "port spanning") option in that switch to send a copy of all traffic to and from the AP to whichever physical Ethernet port your PC was connected to. Small, 5-port managed switches like this one are quite affordable these days.

Finally, some home firewalls also support capturing network traffic, so that's another possible option, but that's less common with the more main-stream wireless routers.

Good luck!

The PCAP file format is universal. You can generate a PCAP through any method and then use Wireshark(or any other PCAP-aware tool) to analyze it.

Here is a page on enabling this with Virtualbox. This is absolutely the way to go when trying to capture from a Virtualbox VM.

https://www.amazon.com/Wireshark-Network-Analysis-Second-Certified/dp/1893939944/ref=mp_s_a_1_7?crid=1U1LOJFPX879T&keywords=wireshark&qid=1668824060&sprefix=wireshark%2Caps%2C308&sr=8-7 and there’s a practice test book that goes with it that should be easy enough to find, the questions on the exam are very similar to many of the ones in this practice book

For comparison, I just ran the same test on NordVPN over WireGuard. The stream is almost entirely WireGuard with a few TCP packets that are highlighted in black (for retransmission), and only two TLSv1.2 packets, which are encrypted.

>Hmm, They don't really make sense though. The way they a

Hmm, The comments don't line up with what the OP's screenshot shows. I am running the latest version of Wireshark and captured the entire handshake.

It seems like the link you posted is exactly the information I'm looking for but it doesn't line up. I want to know what all the versions in the packet indicate, https://www.screencast.com/t/Zgpg5Yyhu.

Can you provide the capture file? I don't think there is any personal data in this communication, so it should be safe to share. I'm not familiar with this application, but the Wireshark website has this filter reference: https://www.wireshark.org/docs/dfref/s/synphasor.html

There may be a way to display the data in the packets if you right click on the "Configuration Frame" packet and click Follow > TCP stream, then in the new window try changing the "Show and save data as" option from ASCII to some of the other choices (e.g. EBCDIC). See if plain text appears.

Get an understanding of wireshark.

My response might seem rude, but for questions like this in a technical forum, you should to at least show that you've tried, and you will get better help if you ask very specific questions.

PingPlotter (https://www.pingplotter.com/) is a good tool to start with. Full feature trial. Loads of tutorials to get you started. Learning curve isn't too bad. I've used it as a first step in identifying connectivity issues.

The user root (sudo) and your login is not the same. They have different profiles and home directories. I don't have Linux mint myslf, but you should be able to copy your config (or link it) from $HOME/.wireshark to /root/.wirehark

https://www.wireshark.org/docs/wsug\_html\_chunked/ChAppFilesConfigurationSection.html

I've never used that tool (I don't have an Android device), but according to the documentation page it looks like it only has two requirements. Have you verified that you've met those?

The Wireshark docs for the Capture Options don't have a lot to say abut Monitor Mode, but what they do say make it sound pretty specific to being able to capture the full 802.11 wireless packet headers, that it's a hardware dependent feature, and that it might also disconnect you from your wireless network. Given all this, I suspect you're seeing a bug/quirk with Monitor Mode. Unless you know you want to see those wireless packet headers (there's not much useful for typical mortals in them) I'd suggest not using Monitor Mode at all. If you do need to see those headers, then it may be a good idea to either post your query on the Wireshark forums or even opening a bug with them.

Good luck!

I do not know if there is something new, but with windows in the past used with success the dumpcap

https://www.wireshark.org/docs/wsug_html_chunked/AppToolsdumpcap.html

If I remember it could run on the background also as a schedule with system account and capture the traffic before the user logon.

It is a bit more difficult on filtering but it can do the job.

Some example commands that I found:

.\dumpcap.exe" -i 2 -w C:\Logs\LogFile.pcap -b filesize:102400 -b files:200 -f "not tcp port 3389"

And with the .\dumpcap -D you could find the number of the nic.

Good place to start in understanding how Wireshark resolves addresses

https://www.wireshark.org/docs/wsug_html_chunked/ChAdvNameResolutionSection.html

https://www.wireshark.org/faq.html#_when_i_capture_with_wireshark_why_cant_i_see_any_tcp_packets_other_than_packets_to_and_from_my_machine_even_though_another_analyzer_on_the_network_sees_those_packets

u/Gabrieldaboss65 how about tcpdump? or adb shell with netstat -ln ? This is i found from SO:

It is now possible to use Wireshark directly to capture Android emulator traffic. There is an <em>extcap</em> plugin called <em>androiddump</em> which makes it possible. You need to have a tcpdump
executable in the system image running on the emulator (most current images have it, tested with API 24 and API 27 images) and adbd
running as root on the host (just run adb root
). In the list of the available interfaces in Wireshark (Qt version only, the deprecated GTK+ doesn't have it) or the list shown with tshark -D
there should be several Android interfaces allowing to sniff Bluetooth, Logcat, or Wifi traffic, e.g.:

android-wifi-tcpdump-emulator-5554 (Android WiFi Android_SDK_built_for_x86 emulator-5554)

Just run a ring buffer. You'll need to stop it before your buffer rolls over the problem, but it's really easy to set up with pretty much any options you want.

https://www.wireshark.org/docs/wsug_html_chunked/ChCapCaptureFiles.html

You might be able to do this setting up a wireless range extender that has an ethernet port you can connect the ethernet to.

Or if you downstairs system is accessible remote wireshark capture might be cheaper.

https://www.wireshark.org/docs/wsug_html_chunked/ChCapInterfaceRemoteSection.html

If you're using TShark it looks like you can set individual preferences via the "-o" option (that's a lower case letter "oh", by the way). From the TShark man page, the argument for this option is the preference name (which appears to be "ssh.tcp.port" in this case), the ":" character as a separator, followed by the setting you want, which for this preference appears to be a list of numeric ports. So I'd expect something like the following to set SSH port decodes to ports 2222, 22222, and 12345:

tshark -o "ssh.tcp.port:2222,22222,12345" ...

You may have to play a bit with quoting parts of this command, but in my experience it usually works to quote the entire argument for unix-like command line options.

Good luck!

Wireshark has supported that feature in the Capture Options for quite some time, but it has changed a little in the newer versions (I have 2.2.6 on my Ubuntu 16 VM). This page of the Wireshark online user manual describes the basics of the various capture options and should get you going.

It indicates that the packet that's currently selected (i.e. highlighted) is an acknowledgement for the packet with the check mark in front of it. There are other little markers as well, and they're documented at this page of the Wireshark user docs.

Hello!

Sorry for not replying. I was busy with university.

Thank you for taking your time to analyse the capture and your input - I really apprectiate this.

u/redsedit i will install TCPView today and see what it tells me.

u/karyhead I have had this problem for like a year but it startet to get worse the last few weeks and i have not been able to finish one single round without any disconnects. I have no problems with any other applications.

Maybe it is important to add that since I installed NordVPN I sometimes need to reset my network-adapter because it won't get a connection.

I also have scheduled a meeting with my ISP. I will get back to you when i have news.

Have a nice day!

Thanks for the reply, i ended up buying this lets hope it gets soon to test it out

&#x200B;

https://www.amazon.com/gp/product/B003PCHAC6/ref=od_aui_detailpages00?ie=UTF8&amp;psc=1

&#x200B;

Thanks again

Are the packets malformed or do they appear to be valid? Do they have anything other than the QoS data header?

I half suspect it's interference, and could be something as simple as a microwave running. Those are very common culprits, especially in the 2.4ghz range.

If you have an Android device, you may find some luck in getting a spectrum analyzer app. I just found and installed one (https://play.google.com/store/apps/details?id=com.raspw.SpectrumAnalyze) but don't know anything about it. iOS devices have apps, but I can't find any free apps offhand.

https://www.amazon.com/gp/product/B00HGLVZLY/ref=oh_aui_search_detailpage?ie=UTF8&amp;psc=1

This switch will let you tap 1000mb ethernet. You will get other players IPs (at least in some games) but it may be difficult to determine who's is who's.