Server Fault Stack Exchange
Server Fault Stack Exchange

Questions tagged [wireshark]

Wireshark is an open source Network Protocol Analyzer under GNU License.

495 questions
98
votes
4 answers

How to filter http traffic in Wireshark?

I suspect my server has a huge load of http requests from its clients. I want to measure the volume of http traffic. How can I do it with Wireshark? Or probably there is an alternative solution using another tool? This is how a single http…
par
  • 1,233
  • 2
  • 12
  • 15
76
votes
4 answers

How to make wireshark filter POST-requests only?

How to make wireshark filter POST-requests only?
Ilya Smagin
  • 863
  • 1
  • 6
  • 6
51
votes
8 answers

How can I sniff the traffic of remote machine with wireshark?

I can sniff the traffic of my local pc but I would like to know how to I sniff the traffic of a remote machine by wireshark? When in capture option I select remote interface and enter my remote ip show me error.code(10061). What should I do?
aboutstudy
  • 957
  • 3
  • 10
  • 10
47
votes
7 answers

How can I filter https when monitoring traffic with Wireshark?

I want to observe the HTTPs protocol. How can I use a Wireshark filter to do that?
Amirreza
  • 664
  • 1
  • 7
  • 12
33
votes
3 answers

ISP broadcasting all IP-packets, so I can see traffic of other clients from ISP

Recently I wondered why my router shows a constant downstream of 5 MBit/s, while I am downloading almost no data. I discovered the "packet logging" function of my router, with which I was able to log all the traffic in the wireshark format. And I…
user3297416
  • 443
  • 4
  • 5
24
votes
6 answers

isolate application and check what packets it is sending over the internet

I am not sure that this sort of question is appropriate here, so forgive me if I'm wrong. Here is a problem: I want to see what a specific program is sending to the internet, but the thing is that on the computer there are lot's of applications and…
Salvador Dali
  • 925
  • 6
  • 19
  • 31
23
votes
4 answers

Change protocol associated with port in wireshark

I'm trying to monitor some web traffic using wireshark. Our web proxy is on port 9191. How can I get the wireshark view to treat port 9191 just like port 80 - ie as HTTP. Just using Decode_As on the menu seems to allow half the conversation but only…
Nick Fortescue
  • 375
  • 1
  • 2
  • 7
22
votes
1 answer

Wireshark Display Filter protocol==TLSV1? (and PacketLength)

What would the filter expression be to just select the protocols where the protocol = TLSV1? Something obvious like protocol == "TLSV1" or TCP.protocol == "TLSV1" is apparently not the right way. ip.proto == "TLSV1" says "ip.proto cannot accept…
NealWalters
  • 1,273
  • 7
  • 18
  • 39
20
votes
2 answers

What's the Wireshark packet receiving and processing procedure on a Windows machine?

I am about to use Wireshark for some traffic monitoring on my Windows computer. While working on it, I was wondering how Wireshark manages to catch low level network packets before Windows does. First of all, a network interface on my NIC receives…
Hansi
  • 211
  • 1
  • 6
19
votes
4 answers

What causes duplicate ACK records?

We're reviewing Wireshark captures from a few client machines that are showing multiple duplicate ACK records which then triggers retransmit and out-of-sequence packets. These are shown in the following screen shot. .26 is client and .252 is…
Sam
  • 720
  • 2
  • 8
  • 18
18
votes
5 answers

Is there a way to get wireshark to capture packets sent from/to localhost on Windows?

Is there a way to get wireshark to capture packets sent from/to localhost? When I monitor traffic going from my computer to another, or from another computer to my computer, then it works. But from localhost to localhost does not register…
Brian R. Bondy
  • 743
  • 2
  • 10
  • 16
18
votes
2 answers

How can I search the info column in Wireshark?

Wireshark | Windows I want to search a packet capture of SMTP traffic for specific addresses/messages. Normally, I just sort the info column and browse but it would be nice if I could just run a search or filter for the specific string I'm looking…
Mike B
  • 11,570
  • 42
  • 106
  • 165
16
votes
2 answers

How can I measure the cumulative network usage of a process, from execution beginning to end

I want to measure how much bandwidth git pull uses, preferably by prefixing git command with desired program, i.e. nettally git pull Alternatively, is there some sneaky way to accumulate nethogs / wireshark data and add up the figures after…
caduceus
  • 295
  • 2
  • 7
16
votes
3 answers

Stopping the WinPcap Packet capture service

I just installed WireShark, which also installed WinPcap. During the installation it said "do you want xxx to start automatically", which I answered yes. Now I would like to stop the service when I am not running wireshark, but cannot find a service…
Shiraz Bhaiji
  • 2,219
  • 8
  • 34
  • 47
15
votes
5 answers

Wireshark is not showing my network interface?

I want to capture traffic on Ethernet 4 but you can see that Ethernet 4 is not present in Wireshark network interface though Ethernet 4 is present in Networking and sharing center. Screenshot of interface list: Screenshot of network&sharing…
defalt
  • 249
  • 1
  • 2
  • 5
1
2 3
…
32 33