Tag: Wireshark

android – How to capture AVD traffic using wireshark?

I’m accessing internet using Android Virtual Device and I’m trying to capture this traffic using Wireshark application (so I can capture traffic of different android applications and later on do the TLS fingerprinting). Although I see no traffic at all (all interfaces) in the Wireshark, even though I’m browsing internet on the AVD.

Does anybody have experience or some hints how to capture traffic from AVD in Wireshark?

ssh – Wireshark – Why is this ASCII data not human readable?

I just did a capture for an SSH transmission. At the bottom of the wireshark window, I see the following…

enter image description here

To open the window to the right, I right clicked the data segment and chose “Show Packet Bytes”

My question is why is the data in the window to the right human readable, and the data to the left not. How is the data to the left being displayed/decoded?

I would expect both of these things to match since this is the first packet of an SSH session which should just contain some string to identify the SSH client type to the server.

Edit: I mean the text to the right of the HEX dump, not the HEX dump itself.

What is default wireless cards mode using Wireshark?

So, I think when I run Wireshark the wireless card works using promiscuous mode because if it is managed mode the wireless card will capture only packages directed to its. Monitor mode also cannot be used by default. Is it so?

What windows APIs wireshark uses? [closed]

What windows APIs wireshark uses when it is run on windows platform? Wireshark is always capturing network traffic live but it needs windows API for that right?

vulnerability – Dealing with Wireshark vulnerabilities in practice

First some context:

  • We have software running on a production Windows server that runs within a local network of one of our customers. We installed our software on that server and some tools such as Wireshark and deliver paid support for our software. The server itself has no internet access (in the customer’s network there will be access to the internet at some points elsewhere).
  • The customer uses a scanning tool such as Nessus and noticed Wireshark and requests it entirely uninstalled because of vulnerabilities. They are not requesting updating, which we already do, they want it uninstalled.
  • We use Wireshark occasionally for investigating issues (for which the cause can be on our side or on the customers’ side). A Wireshark capture may then be running for some hours or days, whatever is necessary to analyze the issue. No Wireshark capture is running 24/7 and we don’t automatically start a capture on server startup or anything like that.

Now the core of the question:

Overview of known Wireshark vulnerabilities can be found here: https://www.cvedetails.com/vulnerability-list/vendor_id-4861/product_id-8292/Wireshark-Wireshark.html

Most of these vulnerabilities seem rather low risk and involve crashing Wireshark (or perhaps the entire Windows Server? The vulnerability descriptions are often not entirely clear) or inducing a memory leak in Wireshark. Although there were also a few remote code execution vulnerabilities in very old versions in the past, I see no recent ones of those.

To exploit this someone must have already gained access to the network of our customer and must be injecting network packets at a time during which we happen to run Wireshark and in the worst case they can make the server crash and there is an outage.

  • How do you deal with Wireshark vulnerabilities in practice on production servers?
  • Do you also uninstall it completely for these low-risk vulnerabilities?
  • Do you accept the risk? Do you mitigate it somehow?

Edit:
I’m not looking for advice specific for our case, these things are trade off to be made. I’m just looking for examples in practice from other people here, how they have dealt with this or how they chose to deal with this for their use cases. The obvious utopian answer of course is to uninstall Wireshark (although you might argue to uninstall Windows then as well), but I’m looking for experience in practice from other people.

wireshark – Redirecting an IP address to a local IP address, something akin to the hosts file?

I’m currently (legally) reverse engineering a game written in Java, so the client I have is a jar file.

I started Wireshark and started intercepting the traffic between the server and the client.
enter image description here

As you can see, the game’s server has an IP address of 151.xx.xxx.xxx

Although the game’s server doesn’t have a hostname, I tried converting its IP address to its hostname, the result was something like this nsXXXXX.ip-151-xx-xxx.net

My plan is to allow all the TCP traffic to first go through a proxy of mine (which is my other local machine 192.168.0.7) so that we can intercept, analyze and edit the traffic if necessary.

So I tried editing my hosts file. This is what I currently have:

   192.168.0.7    nsXXXXX.ip-151-xx-xxx.net 
   192.168.0.7    151.xx.xxx.xxx

Pinging that hostname fails and redirects to 192.168.0.7 just fine.
However, pinging 151.xx.xxx.xxx results in me still being able to receive packets and logging into the game.

I want to redirect that IP address to my other machine 192.168.0.7

On that machine, I’ll open the port it needs to connect to and let the traffic go to 151.xx.xxx.xxx

Is there a way to redirect 151.xx.xxx.xxx to 192.168.0.7, akin to what the hosts file does?

Thank you in advance.

vpn – How can I see ISAKMP packets via Wireshark on a client computer?

I am trying to learn more about the IPSec and VPN. I am using TunnelBear on Firefox. When I start VPN service, I only see TLS connections on Wireshark but not the ISAKMP or other IPSec related packets. I did another trial with the Cisco AnyConnect client and connected to my school. Still I see TLS connections but nothing about IPSec related messaging. In my test setup I am using my Windows PC and the required VPN software. The servers I am trying to connect should be VPN servers.

Do these programs use another method to connect to those servers? Why do I only see TLS connections? Thanks.

packet – How to fix TCP stream in wireshark w/ spurious retransmission

This was for a CTF (It ended yesterday, so not cheating), but I’ve spent so many hours on it that I really just want to understand what I should have done.

Here is the PasteBin Hex Dump. I imported and followed the TCP stream and get a flag, but it’s not correct, looking at the packets there are several errors tho, a spurious retransmission, some retransmissions and an unseen segment.

screenshot

I’ve read a ton about the errors and what they mean, but I must not understand it correctly, because nothing I tried worked. I tried following the seq and ack by hand, with the understanding of how it is they are supposed to increase, but again, I’m doing something wrong because I just get what wireshark gives.

Hopefully this is an appropriate question, because I would love to know how to solve this so I can sleep at night again. Many thanks

wireshark – Capture traffic between iPhone and a Network Audio Playe from a third machine

I am trying to capture traffic between a remote control app on my iPhone and a Pioneer Audio Player, with the goal of being able to reproduce the commands from a CLI app.

I have attempter to use wireshark with a filter like this:

ip.src==IP.OF.IPH.ONE || ip.src==IP.OF.PLA.YER

but all I capture are broadcasts from the phone.

The player itself is connected to the network via ethernet over powerline – not via wifi.

Any ideas?

How to read contents if SSH packers are transparent in a .pcapng file with wireshark?

I’ve a pcapng file in which the SSH file was modified resulting in all SSH packets being transparent. How can I read its content using wireshark?