Questions tagged [wireshark]
Wireshark is a graphical packet capture and analyser open-source software. It can be used for a variety of network communication analysis tasks like protocol development and troubleshooting. It shows packets on the IP level.
342 questions
4 votes
1 answer
1k views
Intercepting HTTPS traffic with a trusted root cert and packet capture from the WiFi AP
I have an application in Android (version 6, so quite old) whose communication I want to monitor. I have installed my own root certificate in the user store and Android warns me correctly that data ...
- 521
1 vote
0 answers
115 views
Target machine receives ARP probe packets but not spoofed ARP response packets
I’m doing an ARP spoofing experiment in my local network, but I’ve encountered an issue. The target machine can successfully receive ARP probe packets (e.g., network discovery packets) sent from the ...
-1 votes
1 answer
173 views
How do we secure our network traffic from packet sniffing tools [beyond TLS/SSL] [duplicate]
From following link: Decrypting TLS with Netsh/WireShark I found its pretty easy to segregate the keys file from tcp requests and later decrypt with WireShark. Are there any reliable/bullet-proof ...
- 107
1 vote
1 answer
147 views
Does this Wireshark traffic dump show that there was a successful login?
After bruteforce (many POST requests to "wp-login.php" from host 10.0.1.85) there were a couple of requests to admin-ajax.php followed by a response from the server (10.0.1.88). Further ...
- 11
0 votes
1 answer
237 views
Anlyzing PSK-TLS handshake (Handshake Finished record) in Wireshark
I am doing testing with some ethernet device, for which I use an own TLS implementation (using OpenSSL for the actual cryptographic functions). There are pre shared keys used. When I am connecting to ...
- 3
0 votes
1 answer
619 views
export burp certificate to wireshark for inspection
I am trying to figure out if i can take the burpsuite certificate and export it to wireshark to be able to inspect the traffic going through it. My main goal here is to test a website i own to see ...
- 49
1 vote
0 answers
115 views
Unable to capture authentication frames in monitor mode in linux
Unable to capture authentication frames in monitor mode in linux using Wireshark. I am able to see probe request & response, Acknowledgement, Beacon, cts, rts frames. Followed below steps and also ...
1 vote
0 answers
243 views
How to investigate data transmission of a suspicious camera
I recently bought a camera (for indoors home monitoring), and I got suspicious of its behavior data wise. It is set up like this: First you download and install an app called Lookcam onto your phone. ...
- 111
0 votes
1 answer
268 views
wireshark captures vpn tun0 smtp as unencrypted, why?
I am trying to learn more about cryptography and am stumped, i dont know what direction to move to even research an answer myself so would appreciate any input. I have a vpn set up to an adapter, tun0,...
2 votes
1 answer
578 views
Decrypt SSL with Wireshark supported browsers
I've been following the guide: https://www.comparitech.com/net-admin/decrypt-ssl-with-wireshark/ Using it for chrome and Safari on MacOS does not populate any keys in the file, Did browsers stop keys ...
- 21
3 votes
2 answers
1k views
Decrypting network traffic and finding HTTPS private key
I've been battling with one school task for couple days and can't seem to find any idea how to solve it. The task is pretty simple: Log in to the server using SSH. The answer to the task is in ...
- 95
2 votes
1 answer
1k views
Capturing packets in an android application or ios application?
I've an android and ios app. They run on the same application server on Linux. I want to capture the packets when users are trying to log in to the app. How do I proceed? I'm thinking of doing it with ...
- 163
2 votes
1 answer
220 views
DHE key exchange with p value 257 bytes but a pubkey of 256 bytes
I came across a packet capture in Wireshark where p length = 257 bytes and pubkey length = 256 bytes. See the ServerKeyExchange snip below: Diffie-Hellman Server Params p Length: 257 p: ...
- 23
0 votes
0 answers
220 views
Wireshark can't decrypt TLS from a specific python library
I have a problem. I'm using Wireshark 4.0.8. I created my ssl file to store my "(pre)-master-secrets". I can thus decrypt TLS from my browser or from different python libraries without ...
- 1
1 vote
0 answers
373 views
How can I verify that my DoS attack is effective?
I was trying to simulate a DoS attack on the CORE network emulator using hping3 (Ubuntu). The topology is like three PCs connected by a router. The client's IP is 10.0.0.20/24, The server's IP is 10.0....
