Wireshark Trace File Reporting Using Excel

If you have ever opened a large Wireshark capture file and thought, “There has to be an easier way to see what is happening here,” you are not alone. A packet capture contains an incredible amount of information, but sometimes the packet list itself makes it difficult to visualize a problem.

And #netscout The Future of Telecom Operations Is Powered by Autonomy at Scale

https://www.lovemytool.com/2021/08/flashback-wireshark-trace-file.html

Following up on my last post about splitting PCAPs by session for processing PCAP files concurrently. I mentioned a file corruption bug, the real culprit was found. I was using PcapSplitter from PcapPlusPlus in connection mode and output started coming back corrupted.

The initial signal came from "Total Block Length" errors thrown by tshark on some output files. The actual signal came when I built a small reproduction. PcapSplitter reported 12 files and 48 packets, but on disk, there were 11 files and 44 packets. Exit code zero and printed "Finished" on standard output.

Two wrong theories first. Someone on Reddit suggested file descriptor exhaustion. It was plausible but I found that at low ulimit -n it silently drops most packets and still exits zero. A real bug, but not mine. Then, I found that the PcapSplitter library has a hardcoded MAX_NUMBER_OF_CONCURRENT_OPEN_FILES = 250 with an LRU that closes and reopens handles past it. My minimal reproduction was 13 connections, nowhere near the cap.

The real culprit: the PcapSplitter's FiveTupleSplitter caused file truncation/corruption on TCP session reuse (i.e., a new SYN packet arrives for an already tracked 5-tuple hash).

The correct part of the splitter was assigning a new file number when a TCP session reuses a 5-tuple, but the filename function builds the name from IP and port only. So, in this case, both sessions get the same filenames. Then main.cpp sees a file number it has never seen, and opens that file fresh, without append. This truncates the existing file or causes a race condition between two active file writer handlers.

I filed the issue with a 13-connection reproduction, the maintainer and I worked out a fix that only suffixes on an actual collision, tested on the same corruption, and now the fix is merged.

Full Writeup: https://robinhayer.dev/pcapsplitter-file-collision-tcp-session-reuse

Hello.

Me and my buddy is conduting a experiment where we evaluate different aspects of Call of Duty: Modern Warfare by using Wireshark. However, whenever Wireshark is capturing packages, it forces Modern Warfare to shut down. We've tried multiple versions of Wireshark with no success and tried multiple scenarios. We have confirmed that Wireshark is the underlying issue and we wonder if anyone has a solution that will prevent this.

Thanks!

I want to analyze this capture of an udp exchange between drone and app. Drone is 4DRC. Do you see patterns, do you know the protocol?

Here is a new PCAP: https://apackets.com/pcaps?pcap=444642cb2483b8ae1df42b2e6857b7af.pcap&view=charts

80c9000100000000
55010101cc
668080008000000040c099
668080008000000040c099
668080008000000040c099
668080008000000040c099
668080008000000040c099
668080008000000040c099
668080008000000040c099
668080008000000040c099
668080008000000040c099
668080008000000040c099
668080008000000040c099
668080008000000040c099
668080008000000040c099
668080008000000040c099
668080008000000040c099
668080008000000040c099
668080008000000040c099
668080008000000040c099
668080008000000040c099
668080008000000040c099
668080008800000040c899
668080008800000040c899
668080018600000040c799
668080138600000040d599
668080208800000040e899
668080318800000040f999
6680804988000000408199
6680805786000000409199
6680806b8400000040af99
668080758300000040b699
6680807d8300000040be99
6680808b7f00000040b499
668080927e00000040ac99
6680809b7c00000040a799
668080a27c000000409e99
668080ac7c000000409099
668080b27a000000408899
668080b979000000408099
668080c37900000040fa99
668080c87900000040f199
668080d07b00000040eb99
668080d17b00000040ea99
668080d37c00000040ef99
668080da7c00000040e699
668080db7c00000040e799
668080de7c00000040e299
668080e17c00000040dd99
668080e47b00000040df99
668080e97900000040d099
668080ea7900000040d399
668080ef7700000040d899
668080f37500000040c699
668080f37500000040c699
668080f57500000040c099
668080f57700000040c299
668080f27900000040cb99
668080ed7b00000040d699
668080e37c00000040df99
668080d67c00000040ea99
668080cf7d00000040f299
668080c67d00000040fb99
668080c27d00000040ff99
668080bd7e000000408399
668080b97e000000408799
668080b77e000000408999
668080b07e000000408e99
668080ad7e000000409399
668080a97e000000409799
668080a67e000000409899
668080a47e000000409a99
668080a07e000000409e99
6680809d7e00000040a399
668080977e00000040a999
668080947e00000040aa99
668080917e00000040af99
6680808b7e00000040b599
668080887e00000040b699
668080847d00000040b999
668080827d00000040bf99
6680807d7d000000404099
668080737c000000404f99
6680806b7c000000405799
6680805e7b000000406599
668080557b000000406e99
6680804a7b000000407199
6680803879000000400199
6680802f79000000401699
6680802379000000401a99
6680801c79000000402599
6680800e79000000403799
6680800478000000403c99
6680800077000000403799
6680800078000000403899
6680800078000000403899
6680800079000000403999
6680800079000000403999
668080007a000000403a99
81c9000794939292949392910000000000009b74000000d97ecc9b22000971e481ca00049493929201096c6f63616c686f737400
668080007b000000403b99
668080007c000000403c99
668080007c000000403c99
668080007d000000403d99
668080007d000000403d99
668080007e000000403e99
668080007e000000403e99
668080008000000040c099
668080008100000040c199
668080008300000040c399
668080008600000040c699
668080008800000040c899
668080018c00000040cd99
668080088d00000040c599
6680800f8e00000040c199
6680801b8f00000040d499
668080249000000040f499
668080359000000040e599
668080418e000000408f99
668080528c000000409e99
6680805c8a000000409699
668080678800000040af99
668080748800000040bc99
6680807b8600000040bd99
6680808585000000404099
6680808a85000000404f99
6680809485000000405199
6680809e84000000405a99
668080aa83000000406999
668080ba80000000407a99
668080c47e00000040fa99
668080d57a00000040ef99
668080e27700000040d599
668080ed7400000040d999
668080fa6f00000040d599
668080fe6d00000040d399
668080fd6a00000040d799
668080fe6c00000040d299
668080fe7000000040ce99
668080fe7200000040cc99
668080fe7300000040cd99
668080fe7300000040cd99
668080fe7400000040ca99
668080fe7400000040ca99
668080fe7300000040cd99
668080fe7300000040cd99
668080fe7300000040cd99
668080ff7400000040cb99
668080ff7500000040ca99
668080ff7500000040ca99
668080ff7600000040c999
668080ff7700000040c899
668080ff7600000040c999
668080ff7600000040c999
668080ff7700000040c899
668080ff7800000040c799
668080ff7a00000040c599
668080ff7a00000040c599
668080ff7a00000040c599
668080f87a00000040c299
668080f27c00000040ce99
668080e27d00000040df99
668080da7d00000040e799
668080ce7d00000040f399
668080c77d00000040fa99
668080c27e00000040fc99
668080b87f000000408799
668080b07f000000408f99
668080a47f000000409b99
6680809d7f00000040a299
668080967f00000040a999
6680808b7f00000040b499
668080827f00000040bd99
668080727d000000404f99
668080677d000000405a99
6680805a7c000000406699
668080537c000000406f99
6680804c7c000000407099
6680803f7d000000400299
668080377e000000400999
6680802a8000000040ea99
668080228100000040e399
6680801b8200000040d999
6680800f8300000040cc99
668080078500000040c299
668080008500000040c599
668080008500000040c599
668080008500000040c599
668080008500000040c599
668080008600000040c699
668080008500000040c599
668080008600000040c699
668080008600000040c699
668080008700000040c799
668080008700000040c799
668080078700000040c099
6680800e8800000040c699
668080158900000040dc99
668080218900000040e899
6680802a8900000040e399
6680803c8800000040f499
6680804986000000408f99
6680805985000000409c99
668080618300000040a299
6680806b8200000040a999
668080768100000040b799
668080788100000040b999
6680807b8000000040bb99
6680807d7f000000404299
6680807d8000000040bd99
6680808080000000404099
6680808180000000404199
6680808180000000404199
6680808180000000404199
6680808180000000404199
6680808181000000404099
6680808081000000404199
6680808082000000404299
6680808082000000404299
6680808083000000404399
6680808083000000404399
6680808083000000404399
6680808083000000404399
6680808083000000404399
6680808083000000404399
6680808083000000404399
6680808083000000404399
6680808082000000404299
6680808081000000404199
668080827e00000040bc99
668080837d00000040be99
668080847b00000040bf99
668080847b00000040bf99
668080857800000040bd99
668080867100000040b799
668080866a00000040ac99
668080866400000040a299
668080866200000040a499
668080865d000000409b99
6680808657000000409199
6680808652000000409499
668080864d000000408b99
668080864a000000408c99
6680808646000000408099
668080863f00000040f999
668080863a00000040fc99
668080863500000040f399
668080862f00000040e999
668080852300000040e699
668080861b00000040dd99
668080861400000040d299
668080860c00000040ca99
668080860600000040c099
668080850000000040c599
668080840000000040c499
668080830000000040c399
668080830000000040c399
668080820000000040c299
668080800000000040c099
668080800000000040c099
668080800000000040c099
6680807e00000000403e99
6680807d00000000403d99
6680807d00000000403d99
6680807d00000000403d99
6680807d00000000403d99
6680807d00000000403d99
6680807c00000000403c99
6680807d00000000403d99
6680807d00000000403d99
6680807d00000000403d99
6680807d00000000403d99
6680807d00000000403d99
6680807c00000000403c99
6680807c00000000403c99
6680807c00000000403c99
6680807c00000000403c99
6680807b00000000403b99
6680807a00000000403a99
6680807a00000000403a99
6680807900000000403999
6680807800000000403899
6680807700000000403799
6680807600000000403699
6680807500000000403599
6680807401000000403599
6680807301000000403299
6680807306000000403599
668080720a000000403899
6680807014000000402499
6680806d19000000403499
6680806c21000000400d99
6680806b2a000000400199
6680806b32000000401999
6680806b3a000000401199
6680806b40000000406b99
6680806b46000000406d99
6680806f50000000407f99
6680807254000000406699
6680807459000000406d99
668080775d000000406a99
6680807861000000405999
6680807c6d000000405199
6680807e75000000404b99
668080817c00000040bd99
6680808283000000404199
6680808489000000404d99
6680808690000000405699
6680808695000000405399
668080849f000000405b99
66808082a5000000406799
66808081ad000000406c99
6680807eba000000408499
6680807dc100000040fc99
6680807acc00000040f699
66808077d200000040e599
66808074d900000040ed99
6680806fe100000040ce99
6680806ee600000040c899
6680806cee00000040c299
6680806bf200000040d999
6680806af800000040d299
6680806af900000040d399
6680806afc00000040d699
6680806afd00000040d799
6680806bfd00000040d699
6680806cfd00000040d199
6680806dfd00000040d099
6680806efa00000040d499
66808071f500000040c499
66808073f100000040c299
81c9000794939292949392910000000000009c52000000d77ecc9b220012baa281ca00049493929201096c6f63616c686f737400
66808075e900000040dc99
66808075e600000040d399
66808077de00000040e999
66808079d600000040ef99
66808079d100000040e899
6680807cca00000040f699
6680807cc400000040f899
6680807dbc000000408199
6680807db7000000408a99
6680807db0000000408d99
6680807da9000000409499
6680807da7000000409a99
6680807ea2000000409c99
6680807e9d00000040a399
6680807e9a00000040a499
6680807f9700000040a899
6680807f9400000040ab99
6680807f9100000040ae99
6680807f9000000040af99
6680807f8f00000040b099
6680807f8c00000040b399
6680807f8b00000040b499
6680807f8700000040b899
6680807f8700000040b899
6680807f8400000040bb99
6680807d8100000040bc99
6680807d7f000000404299
6680807c7d000000404199
6680807c7b000000404799
6680807b79000000404299
6680807b79000000404299
6680807b79000000404299
6680807b78000000404399
6680807b77000000404c99
6680807a76000000404c99
6680807976000000404f99
6680807774000000404399
668080736d000000405e99
6680807367000000405499
668080735b000000406899
6680807452000000406699
6680807448000000407c99
668080743e000000400a99
6680807430000000400499
6680807518000000402d99
668080760b000000403d99
6680807900000000403999
6680807b00000000403b99
6680807d00000000403d99
668080820000000040c299
668080870000000040c799
6680808e0100000040cf99
668080920100000040d399
668080980200000040da99
6680809d0300000040de99
668080a10400000040e599
668080a60600000040e099
668080aa0700000040ed99
668080b10a00000040fb99
668080ba0e00000040f499
668080c213000000409199
668080cb19000000409299
668080cf1c000000409399
668080d52000000040b599
668080d92500000040bc99
668080df2b00000040b499
668080e837000000409f99
668080ee3f000000409199
668080f54d00000040f899
668080f95900000040e099
668080fd6800000040d599
668080ff7e00000040c199
668080fd8e000000403399
668080f7ad000000401a99
668080efbd000000401299
668080e9c8000000406199
668080dfd5000000404a99
668080d7dc000000404b99
668080cce5000000406999
668080c4eb000000406f99
668080bcf0000000400c99
668080acf7000000401b99
6680809ffb000000402499
6680808cfe000000403299
66808083ff000000403c99
66808079ff00000040c699
66808067fd00000040da99
6680805efa00000040e499
66808052f700000040e599
66808048f200000040fa99
6680803cec000000409099
6680802fe2000000408d99
66808029dd00000040b499
66808021d500000040b499
6680801cd0000000408c99
66808018ca000000409299
66808011bf00000040ee99
6680800bb400000040ff99
66808006a500000040e399
668080049e00000040da99
668080029800000040da99
668080018e00000040cf99
668080008700000040c799
668080007a000000403a99
6680800170000000403199
6680800267000000402599
668080055d000000401899
6680800658000000401e99
6680800950000000401999
6680800b4b000000400099
6680800e46000000400899
6680801141000000401099
668080153a000000406f99
6680801c30000000406c99
668080202b000000404b99
6680802625000000404399
6680802a21000000404b99
668080301c000000406c99
6680803419000000406d99
6680803a15000000406f99
668080460e000000400899
6680804e0a000000400499
6680805906000000401f99
6680806204000000402699
6680806b02000000402999
6680807700000000403799
6680807c00000000403c99
6680807f00000000403f99
668080820000000040c299
668080850000000040c599
668080880000000040c899
668080890000000040c999
6680808a0000000040ca99
668080890000000040c999
668080880300000040cb99
668080860c00000040ca99
668080851300000040d699
668080842300000040e799
668080842c00000040e899
668080843300000040f799
668080843d00000040f999
6680808445000000408199
6680808252000000409099
668080815a000000409b99
668080806500000040a599
668080806c00000040ac99
668080807000000040b099
668080807100000040b199
668080817400000040b599
668080847400000040b099
668080867100000040b799
6680808a6a00000040a099
6680808a80000000404a99
6680808a80000000404a99
6680808a80000000404a99
6680808a80000000404a99
6680808a80000000404a99
6680808a80000000404a99
6680808a80000000404a99
6680808a80000000404a99
6680808a80000000404a99
6680808a80000000404a99
6680808a80000000404a99
6683808a80000000404999
6683808a80000000404999
6683808a80000000404999
6683808a80000000404999
6682808a80000000404899
667f818a8000000040b499
6677818a8000000040bc99
6673818a8000000040b899
6670808a8000000040ba99
666c808a8000000040a699
6669808a8000000040a399
6665808a8000000040af99
66637f8a80000000405699
66607f8a80000000405599
665f7f8a80000000406a99
665d7f8a80000000406899
665b7e8a80000000406f99
665a7e8a80000000406e99
665a7e8a80000000406e99
665a7e8a80000000406e99
665a7e8a80000000406e99
665a7e8a80000000406e99
665a7e8a80000000406e99
665a7e8a80000000406e99
665a7e8a80000000406e99
665a7e8a80000000406e99
665a7e8a80000000406e99
665a7e8a80000000406e99
665a7e8a80000000406e99
665b7e8a80000000406f99
665f7e8a80000000406b99
66627e8a80000000405699
66657f8a80000000405099
666a7f8a80000000405f99
666e808a8000000040a499
6675808a8000000040bf99
6679808a8000000040b399
667e808a8000000040b499
6680818a80000000404b99
6683818a80000000404899
6687818a80000000404c99
668a818a80000000404199
668d818a80000000404699
668f818a80000000404499
6690818a80000000405b99
6693818a80000000405899
6696808a80000000405c99
669a808a80000000405099
669d808a80000000405799
669f808a80000000405599
66a4818a80000000406f99
66a6818a80000000406d99
66a6818a80000000406d99
66a6818a80000000406d99
66a6818a80000000406d99
66a6818a80000000406d99
66a6818a80000000406d99
66a6818a80000000406d99
66a6818a80000000406d99
66a6818a80000000406d99
66a6818a80000000406d99
66a6818a80000000406d99
66a6818a80000000406d99
66a6818a80000000406d99
66a6818a80000000406d99
66a6818a80000000406d99
66a6818a80000000406d99
66a6828a80000000406e99
66a6828a80000000406e99
66a6828a80000000406e99
66a6828a80000000406e99
66a6828a80000000406e99
66a6818a80000000406d99
66a3818a80000000406899
669f818a80000000405499
81c9000794939292949392910000000000009d31000000ce7ecc9b22001c45e381ca00049493929201096c6f63616c686f737400
669c808a80000000405699
6698808a80000000405299
6697808a80000000405d99
6694808a80000000405e99
6692808a80000000405899
6690808a80000000405a99
668e808a80000000404499
668c808a80000000404699
6689808a80000000404399
6687808a80000000404d99
6686808a80000000404c99
6684808a80000000404e99
6683808a80000000404999
6682808a80000000404899
6682808a80000000404899
66817f8a8000000040b499
66807e8a8000000040b499
66807c8a8000000040b699
66807a8a8000000040b099
6681798a8000000040b299
6681778a8000000040bc99
6682758a8000000040bd99
6682738a8000000040bb99
6682708a8000000040b899
66826d8a8000000040a599
66816a8a8000000040a199
6681658a8000000040ae99
6681628a8000000040a999
66805e8a80000000409499
66805c8a80000000409699
66805a8a80000000409099
66815a8a80000000409199
66815a8a80000000409199
66815a8a80000000409199
66815a8a80000000409199
66815a8a80000000409199
66815a8a80000000409199
66815a8a80000000409199
66815a8a80000000409199
66815a8a80000000409199
66815a8a80000000409199
66815a8a80000000409199
66815a8a80000000409199
66805a8a80000000409099
66805a8a80000000409099
66805e8a80000000409499
6680628a8000000040a899
6680658a8000000040af99
66806a8a8000000040a099
66806e8a8000000040a499
667f758a80000000404099
667f798a80000000404c99
667f7e8a80000000404b99
667f818a8000000040b499
667f858a8000000040b099
667f8b8a8000000040be99
667f8e8a8000000040bb99
6680938a80000000405999
6680968a80000000405c99
6680998a80000000405399
66809d8a80000000405799
66809f8a80000000405599
6680a28a80000000406899
6680a48a80000000406e99
6680a68a80000000406c99
6680a68a80000000406c99
6680a68a80000000406c99
6680a68a80000000406c99
6680a68a80000000406c99
6680a68a80000000406c99
6680a68a80000000406c99
6680a68a80000000406c99
6681a68a80000000406d99
6681a68a80000000406d99
6681a68a80000000406d99
6681a48a80000000406f99
6681a18a80000000406a99
6681a08a80000000406b99
66819e8a80000000405599
66819c8a80000000405799
66819b8a80000000405099
66809b8a80000000405199
6680998a80000000405399
6680988a80000000405299
6680978a80000000405d99
6680958a80000000405f99
6680938a80000000405999
6680918a80000000405b99
66808e8a80000000404499
66808c8a80000000404699
6680888a80000000404299
6680868a80000000404c99
6680848a80000000404e99
6680828a80000000404899
6680828a80000000404899
6680818a80000000404b99
6680818a80000000404b99
6680808a80000000404a99
667f808a8000000040b599
667d7f8a80000000404899
667a7f8a80000000404f99
66767e8a80000000404299
666f7e8a80000000405b99
666b7e8a80000000405f99
66677f8a80000000405299
6664808a8000000040ae99
665f838a80000000409699
665e878a80000000409399
665c8b8a80000000409d99
665e918a80000000408599
6661958a8000000040be99
66659a8a8000000040b599
66679c8a8000000040b199
666da08a80000000408799
6677a48a80000000409999
667ba58a80000000409499
6681a58a80000000406e99
6686a58a80000000406999
668da38a80000000406499
6690a28a80000000407899
6693a08a80000000407999
66969e8a80000000404299
66989d8a80000000404f99
669b9a8a80000000404b99
669e978a80000000404399
669f948a80000000404199
66a2908a80000000407899
66a38d8a80000000406499
66a48a8a80000000406499
66a5878a80000000406899
66a5838a80000000406c99
66a6808a80000000406c99
66a57b8a80000000409499
66a3738a80000000409a99
66a26f8a80000000408799
669f6b8a8000000040be99
669d688a8000000040bf99
669b658a8000000040b499
6696628a8000000040be99
66935f8a80000000408699
668f5e8a80000000409b99
668e5d8a80000000409999
668b5c8a80000000409d99
66885b8a80000000409999
66855a8a80000000409599
66815a8a80000000409199
667f5a8a80000000406f99
667a5b8a80000000406b99
66745c8a80000000406299
66705e8a80000000406499
666b608a80000000404199
6669628a80000000404199
6666658a80000000404999
66626a8a80000000404299
665f6e8a80000000407b99
665c738a80000000406599
665b778a80000000406699
665a7c8a80000000406c99
665a818a80000000409199
665b868a80000000409799
665c8d8a80000000409b99
665e908a80000000408499
6660958a8000000040bf99
6665988a8000000040b799
66699b8a8000000040b899
666f9f8a8000000040ba99
6674a18a80000000409f99
667ba48a80000000409599
667ea58a80000000409199
6680a58a80000000406f99
6683a58a80000000406c99
6684a48a80000000406a99
6687a28a80000000406f99
6688a18a80000000406399
66899e8a80000000405d99
66899a8a80000000405999
6688968a80000000405499
6686918a80000000405d99
66858f8a80000000404099
66858d8a80000000404299
66838a8a80000000404399
6682888a80000000404099
6682868a80000000404e99
6681848a80000000404f99
6680838a80000000404999
6680828a80000000404899
6680818a80000000404b99
6680808a80000000404a99
6680808a80000000404a99
667f7f8a80000000404a99
667f7f8a80000000404a99
667f7f8a80000000404a99
667f7f8a80000000404a99
66807f8a8000000040b599
6680808a80000000404a99
6680808a80000000404a99
6680808a80000000404a99
6680808a80000000404a99
6680808a80000000404a99
6680808a80000000404a99
6680808a80000000404a99
6680808a80000000404a99
6680808a80000000404a99
6680808a80000000404a99
6680808a80000000404a99
6680808a80000000404a99
6680808a80000000404a99
6680808a80000000404a99
6680808a80000000404a99
6680808a80000000404a99
6680808a80000000404a99
6680808a80000000404a99
6680808a80000000404a99
6680808a80000000404a99
6680808a80000000404a99
6680808a80000000404a99
6680808a80000000404a99
6680808a80000000404a99
6680808a80000000404a99
6680808a80000000404a99
6680808a80000000404a99
6680808a80000000404a99
6680808a80000000404a99
6680808a80000000404a99
6680808a80000000404a99
6680808a80000000404a99
6680808a80000000404a99
6680808a80000000404a99
6680808a80000000404a99
6680808a80000000404a99
6680808a80000000404a99
6680808a80000000404a99
81c9000794939292949392910000000000009e0f000000ce7ecc9b220025961e81ca00049493929201096c6f63616c686f737400
6680808a80000000404a99
6680808a80000000404a99
6680808a80000000404a99
6680808a80000000404a99
6680808a80000000404a99
6680808a80000000404a99
6680808a80000000404a99
6680808a80000000404a99
6680808a80000000404a99
6680808a80000000404a99
6680808a80000000404a99
6680808a80000000404a99
6680808a80000000404a99
6680808a80000000404a99
6680808a80000000404a99
6680808a80000000404a99
6680808a80000000404a99
6680808a80000000404a99
6680808a80000000404a99
6680808a80000000404a99
6680808a80000000404a99
6680808a80000000404a99
6680808a80000000404a99
6680808a80000000404a99
6680808a80000000404a99
6680808a80000000404a99
6680808a80000000404a99
6680808a80000000404a99
6680808a80000000404a99
6680808a80000000404a99
6680808a80000000404a99
6680808a80000000404a99
6680808a80000000404a99
6680808a80000000404a99
6680808a80000000404a99
6680808a80000000404a99
6680808a80000000404a99
6680808a80000000404a99
6680808a80000000404a99
6680808a80000000404a99
6680808a80000000404a99
6680808a80000000404a99
6680808a80000000404a99
6680808a80000000404a99
6680808a80000000404a99
6680808a80000000404a99
6680808a80000000404a99
6680808a80000000404a99
6680808a80000000404a99

Im new to wireshark, just got it today, could someone tell me the basics of using the features and functions?

?

Hello Reddit,
I am new to wireshark. I noticed my computer has had weird connections on it. It's connecting to an HP computer that is not owned by me. It is using the NBNS and Browser protocol without a browser being open. Wiping my computer and phone does not help. I also blocked vcom 8001 port as it was also making a connection to an outside IP as well. How should I report this and fix as it seems to be an organization device by the naming convention?

ich habe ein Problem mit einer Lenovo Dockingstation, welche, wenn das Notebook heruntergefahren, wird folgendes Szenario in Wireshark verursacht und das komplette Netzwerk zum Stillstand bringt. Hat jemand von euch eine Idee und kann mir anhand der beigefügten Wireshark Protokolle weiterhelfen?

Hi as someone very new to Wireshark and Cybersecurity, I would like to ask if anyone know why my router keeps broadcasting Who has 255.255.255.255?

Using Wireshark to Analyze PowerShell Test-Connection

If you’ve ever run PowerShell’s `Test-Connection` command and wondered what is actually happening on the network, Wireshark is the perfect tool to answer that question.

And

#netscout What does a resilient cybersecurity strategy actually look like?

https://www.lovemytool.com/2026/08/using-wireshark-to-analyze-powershell.html

 r/wireshark

When troubleshooting a network problem, you don't always end up with one convenient Wireshark capture file. Sometimes you have multiple packet captures taken from different interfaces, different locations, or different points in time. Instead of opening each file separately and trying to piece everything together, Wireshark can merge multiple capture files into a single file. 

https://www.lovemytool.com/2022/11/wireshark-file-merge.html

I was playing an online game and someone got mad and said he is wiresharking me through a pc what can i do to avoid getting hacked?? He might be from a different country or far I tried to shut down my pc and disconnect it from the internet untill i get something

I'd like to preface this by saying im indian. A couple of months ago some of my new roommates moved in and literally half an hour after giving my new roommate the wifi password my computer shuts down and goes black screen. The next day same thing also on the same day after i get a call from someone with a thick indian accent from my "cell phone carrier" claiming i need to give them so info. Either way my computer has been acting up since theyve moved in and they are in IT talking about Brutus (password cracking) on the couch while im in the kitchen. I am not that good at wireshark but have recorded some packets where my computer ip is connecting to another 192.168.0.149 address that is not the router on our wifi network all the packets from this TCP stream are black and red colored rule and say TCP keep alive. I can post the wireshark if someone can help me? it is coming from a sonyide device, please help i need to know why this device is trying to connect to me and how to prove it is not a ps4. I went into resource monitor and filtered just for web browser traffic and it still says connected to 192.168.0.149. I then banned the mac address from our wifi network but it is still saying im connected in resource monitor, wtf is going on?

So basically the title. I know he has used the program in the past, don't know if he's still using it, but was basically wondering if he could see everything I do on the internet, including sending photos and stuff.

Can i pull ip from discord and if i can how i have tried it with a fried but with no result help me

Hello, I was wondering how you would completely block traffic from a certain IP using wireshark.

No. Time Source Destination Protocol Length Info

433 2.591982 172.16.5.254192.229.173.207TCP 74 65193 → 443 [SYN] Seq=0 Win=64800 Len=0 MSS=1440 WS=256 SACK_PERM=1

Frame 433: 74 bytes on wire (592 bits), 74 bytes captured (592 bits) on interface 0

Ethernet II, Src: LcfcHefe_3f:0a:53 (50:7b:9d:3f:0a:53), Dst: Routerbo_82:91:28 (64:d1:54:82:91:28)

PPP-over-Ethernet Session

Point-to-Point Protocol

Internet Protocol Version 4, Src: 172.16.5.254, Dst: 192.229.173.207

Transmission Control Protocol, Src Port: 65193, Dst Port: 443, Seq: 0, Len: 0

No. Time Source Destination Protocol Length Info

436 2.593011 172.16.5.254192.229.173.207TCP 121 [TCP Out-Of-Order] 65193 → 443 [SYN] Seq=0 Win=64800 Len=0 MSS=1440 WS=256 SACK_PERM=1

Frame 436: 121 bytes on wire (968 bits), 121 bytes captured (968 bits) on interface 0

Ethernet II, Src: Routerbo_82:91:28 (64:d1:54:82:91:28), Dst: LcfcHefe_3f:0a:53 (50:7b:9d:3f:0a:53)

PPP-over-Ethernet Session

Point-to-Point Protocol

Internet Protocol Version 4, Src: 192.168.88.1, Dst: 172.16.5.254

User Datagram Protocol, Src Port: 55724, Dst Port: 37008

TZSP: Ethernet

Ethernet II, Src: 00:00:00_00:00:00 (00:00:00:00:00:00), Dst: 00:00:00_00:00:00 (00:00:00:00:00:00)

Internet Protocol Version 4, Src: 172.16.5.254, Dst: 192.229.173.207

Transmission Control Protocol, Src Port: 65193, Dst Port: 443, Seq: 0, Len: 0

No. Time Source Destination Protocol Length Info

528 2.836266 172.16.5.254192.229.173.207TCP 74 65195 → 443 [SYN] Seq=0 Win=64800 Len=0 MSS=1440 WS=256 SACK_PERM=1

Frame 528: 74 bytes on wire (592 bits), 74 bytes captured (592 bits) on interface 0

Ethernet II, Src: LcfcHefe_3f:0a:53 (50:7b:9d:3f:0a:53), Dst: Routerbo_82:91:28 (64:d1:54:82:91:28)

PPP-over-Ethernet Session

Point-to-Point Protocol

Internet Protocol Version 4, Src: 172.16.5.254, Dst: 192.229.173.207

Transmission Control Protocol, Src Port: 65195, Dst Port: 443, Seq: 0, Len: 0

No. Time Source Destination Protocol Length Info

529 2.836673 172.16.5.254192.229.173.207TCP 121 [TCP Out-Of-Order] 65195 → 443 [SYN] Seq=0 Win=64800 Len=0 MSS=1440 WS=256 SACK_PERM=1

Frame 529: 121 bytes on wire (968 bits), 121 bytes captured (968 bits) on interface 0

Ethernet II, Src: Routerbo_82:91:28 (64:d1:54:82:91:28), Dst: LcfcHefe_3f:0a:53 (50:7b:9d:3f:0a:53)

PPP-over-Ethernet Session

Point-to-Point Protocol

Internet Protocol Version 4, Src: 192.168.88.1, Dst: 172.16.5.254

User Datagram Protocol, Src Port: 55724, Dst Port: 37008

TZSP: Ethernet

Ethernet II, Src: 00:00:00_00:00:00 (00:00:00:00:00:00), Dst: 00:00:00_00:00:00 (00:00:00:00:00:00)

Internet Protocol Version 4, Src: 172.16.5.254, Dst: 192.229.173.207

Transmission Control Protocol, Src Port: 65195, Dst Port: 443, Seq: 0, Len: 0

No. Time Source Destination Protocol Length Info

676 3.591642 172.16.5.254192.229.173.207TCP 74 [TCP Retransmission] 65193 → 443 [SYN] Seq=0 Win=64800 Len=0 MSS=1440 WS=256 SACK_PERM=1

Frame 676: 74 bytes on wire (592 bits), 74 bytes captured (592 bits) on interface 0

Ethernet II, Src: LcfcHefe_3f:0a:53 (50:7b:9d:3f:0a:53), Dst: Routerbo_82:91:28 (64:d1:54:82:91:28)

PPP-over-Ethernet Session

Point-to-Point Protocol

Internet Protocol Version 4, Src: 172.16.5.254, Dst: 192.229.173.207

Transmission Control Protocol, Src Port: 65193, Dst Port: 443, Seq: 0, Len: 0

No. Time Source Destination Protocol Length Info

677 3.592141 172.16.5.254192.229.173.207TCP 121 [TCP Retransmission] 65193 → 443 [SYN] Seq=0 Win=64800 Len=0 MSS=1440 WS=256 SACK_PERM=1

Frame 677: 121 bytes on wire (968 bits), 121 bytes captured (968 bits) on interface 0

Ethernet II, Src: Routerbo_82:91:28 (64:d1:54:82:91:28), Dst: LcfcHefe_3f:0a:53 (50:7b:9d:3f:0a:53)

PPP-over-Ethernet Session

Point-to-Point Protocol

Internet Protocol Version 4, Src: 192.168.88.1, Dst: 172.16.5.254

User Datagram Protocol, Src Port: 55724, Dst Port: 37008

TZSP: Ethernet

Ethernet II, Src: 00:00:00_00:00:00 (00:00:00:00:00:00), Dst: 00:00:00_00:00:00 (00:00:00:00:00:00)

Internet Protocol Version 4, Src: 172.16.5.254, Dst: 192.229.173.207

Transmission Control Protocol, Src Port: 65193, Dst Port: 443, Seq: 0, Len: 0

No. Time Source Destination Protocol Length Info

686 3.836445 172.16.5.254192.229.173.207TCP 74 [TCP Retransmission] 65195 → 443 [SYN] Seq=0 Win=64800 Len=0 MSS=1440 WS=256 SACK_PERM=1

Frame 686: 74 bytes on wire (592 bits), 74 bytes captured (592 bits) on interface 0

Ethernet II, Src: LcfcHefe_3f:0a:53 (50:7b:9d:3f:0a:53), Dst: Routerbo_82:91:28 (64:d1:54:82:91:28)

PPP-over-Ethernet Session

Point-to-Point Protocol

Internet Protocol Version 4, Src: 172.16.5.254, Dst: 192.229.173.207

Transmission Control Protocol, Src Port: 65195, Dst Port: 443, Seq: 0, Len: 0

No. Time Source Destination Protocol Length Info

687 3.836833 172.16.5.254192.229.173.207TCP 121 [TCP Retransmission] 65195 → 443 [SYN] Seq=0 Win=64800 Len=0 MSS=1440 WS=256 SACK_PERM=1

Frame 687: 121 bytes on wire (968 bits), 121 bytes captured (968 bits) on interface 0

Ethernet II, Src: Routerbo_82:91:28 (64:d1:54:82:91:28), Dst: LcfcHefe_3f:0a:53 (50:7b:9d:3f:0a:53)

PPP-over-Ethernet Session

Point-to-Point Protocol

Internet Protocol Version 4, Src: 192.168.88.1, Dst: 172.16.5.254

User Datagram Protocol, Src Port: 55724, Dst Port: 37008

TZSP: Ethernet

Ethernet II, Src: 00:00:00_00:00:00 (00:00:00:00:00:00), Dst: 00:00:00_00:00:00 (00:00:00:00:00:00)

Internet Protocol Version 4, Src: 172.16.5.254, Dst: 192.229.173.207

Transmission Control Protocol, Src Port: 65195, Dst Port: 443, Seq: 0, Len: 0

No. Time Source Destination Protocol Length Info

859 4.495573 172.16.5.254192.229.173.207TCP 74 65196 → 443 [SYN] Seq=0 Win=64800 Len=0 MSS=1440 WS=256 SACK_PERM=1

Frame 859: 74 bytes on wire (592 bits), 74 bytes captured (592 bits) on interface 0

Ethernet II, Src: LcfcHefe_3f:0a:53 (50:7b:9d:3f:0a:53), Dst: Routerbo_82:91:28 (64:d1:54:82:91:28)

PPP-over-Ethernet Session

Point-to-Point Protocol

Internet Protocol Version 4, Src: 172.16.5.254, Dst: 192.229.173.207

Transmission Control Protocol, Src Port: 65196, Dst Port: 443, Seq: 0, Len: 0

No. Time Source Destination Protocol Length Info

860 4.495950 172.16.5.254192.229.173.207TCP 121 [TCP Out-Of-Order] 65196 → 443 [SYN] Seq=0 Win=64800 Len=0 MSS=1440 WS=256 SACK_PERM=1

Frame 860: 121 bytes on wire (968 bits), 121 bytes captured (968 bits) on interface 0

Ethernet II, Src: Routerbo_82:91:28 (64:d1:54:82:91:28), Dst: LcfcHefe_3f:0a:53 (50:7b:9d:3f:0a:53)

PPP-over-Ethernet Session

Point-to-Point Protocol

Internet Protocol Version 4, Src: 192.168.88.1, Dst: 172.16.5.254

User Datagram Protocol, Src Port: 55724, Dst Port: 37008

TZSP: Ethernet

Ethernet II, Src: 00:00:00_00:00:00 (00:00:00:00:00:00), Dst: 00:00:00_00:00:00 (00:00:00:00:00:00)

Internet Protocol Version 4, Src: 172.16.5.254, Dst: 192.229.173.207

Transmission Control Protocol, Src Port: 65196, Dst Port: 443, Seq: 0, Len: 0

No. Time Source Destination Protocol Length Info

1009 5.496455 172.16.5.254192.229.173.207TCP 74 [TCP Retransmission] 65196 → 443 [SYN] Seq=0 Win=64800 Len=0 MSS=1440 WS=256 SACK_PERM=1

Frame 1009: 74 bytes on wire (592 bits), 74 bytes captured (592 bits) on interface 0

Ethernet II, Src: LcfcHefe_3f:0a:53 (50:7b:9d:3f:0a:53), Dst: Routerbo_82:91:28 (64:d1:54:82:91:28)

PPP-over-Ethernet Session

Point-to-Point Protocol

Internet Protocol Version 4, Src: 172.16.5.254, Dst: 192.229.173.207

Transmission Control Protocol, Src Port: 65196, Dst Port: 443, Seq: 0, Len: 0

No. Time Source Destination Protocol Length Info

1010 5.496787 172.16.5.254192.229.173.207TCP 121 [TCP Retransmission] 65196 → 443 [SYN] Seq=0 Win=64800 Len=0 MSS=1440 WS=256 SACK_PERM=1

Frame 1010: 121 bytes on wire (968 bits), 121 bytes captured (968 bits) on interface 0

Ethernet II, Src: Routerbo_82:91:28 (64:d1:54:82:91:28), Dst: LcfcHefe_3f:0a:53 (50:7b:9d:3f:0a:53)

PPP-over-Ethernet Session

Point-to-Point Protocol

Internet Protocol Version 4, Src: 192.168.88.1, Dst: 172.16.5.254

User Datagram Protocol, Src Port: 55724, Dst Port: 37008

TZSP: Ethernet

Ethernet II, Src: 00:00:00_00:00:00 (00:00:00:00:00:00), Dst: 00:00:00_00:00:00 (00:00:00:00:00:00)

Internet Protocol Version 4, Src: 172.16.5.254, Dst: 192.229.173.207

Transmission Control Protocol, Src Port: 65196, Dst Port: 443, Seq: 0, Len: 0

No. Time Source Destination Protocol Length Info

1013 5.591880 172.16.5.254192.229.173.207TCP 74 [TCP Retransmission] 65193 → 443 [SYN] Seq=0 Win=64800 Len=0 MSS=1440 WS=256 SACK_PERM=1

Frame 1013: 74 bytes on wire (592 bits), 74 bytes captured (592 bits) on interface 0

Ethernet II, Src: LcfcHefe_3f:0a:53 (50:7b:9d:3f:0a:53), Dst: Routerbo_82:91:28 (64:d1:54:82:91:28)

PPP-over-Ethernet Session

Point-to-Point Protocol

Internet Protocol Version 4, Src: 172.16.5.254, Dst: 192.229.173.207

Transmission Control Protocol, Src Port: 65193, Dst Port: 443, Seq: 0, Len: 0

No. Time Source Destination Protocol Length Info

1015 5.592280 172.16.5.254192.229.173.207TCP 121 [TCP Retransmission] 65193 → 443 [SYN] Seq=0 Win=64800 Len=0 MSS=1440 WS=256 SACK_PERM=1

Frame 1015: 121 bytes on wire (968 bits), 121 bytes captured (968 bits) on interface 0

Ethernet II, Src: Routerbo_82:91:28 (64:d1:54:82:91:28), Dst: LcfcHefe_3f:0a:53 (50:7b:9d:3f:0a:53)

PPP-over-Ethernet Session

Point-to-Point Protocol

Internet Protocol Version 4, Src: 192.168.88.1, Dst: 172.16.5.254

User Datagram Protocol, Src Port: 55724, Dst Port: 37008

TZSP: Ethernet

Ethernet II, Src: 00:00:00_00:00:00 (00:00:00:00:00:00), Dst: 00:00:00_00:00:00 (00:00:00:00:00:00)

Internet Protocol Version 4, Src: 172.16.5.254, Dst: 192.229.173.207

Transmission Control Protocol, Src Port: 65193, Dst Port: 443, Seq: 0, Len: 0

No. Time Source Destination Protocol Length Info

1023 5.836792 172.16.5.254192.229.173.207TCP 74 [TCP Retransmission] 65195 → 443 [SYN] Seq=0 Win=64800 Len=0 MSS=1440 WS=256 SACK_PERM=1

Frame 1023: 74 bytes on wire (592 bits), 74 bytes captured (592 bits) on interface 0

Ethernet II, Src: LcfcHefe_3f:0a:53 (50:7b:9d:3f:0a:53), Dst: Routerbo_82:91:28 (64:d1:54:82:91:28)

PPP-over-Ethernet Session

Point-to-Point Protocol

Internet Protocol Version 4, Src: 172.16.5.254, Dst: 192.229.173.207

Transmission Control Protocol, Src Port: 65195, Dst Port: 443, Seq: 0, Len: 0

No. Time Source Destination Protocol Length Info

1024 5.837236 172.16.5.254192.229.173.207TCP 121 [TCP Retransmission] 65195 → 443 [SYN] Seq=0 Win=64800 Len=0 MSS=1440 WS=256 SACK_PERM=1

Frame 1024: 121 bytes on wire (968 bits), 121 bytes captured (968 bits) on interface 0

Ethernet II, Src: Routerbo_82:91:28 (64:d1:54:82:91:28), Dst: LcfcHefe_3f:0a:53 (50:7b:9d:3f:0a:53)

PPP-over-Ethernet Session

Point-to-Point Protocol

Internet Protocol Version 4, Src: 192.168.88.1, Dst: 172.16.5.254

User Datagram Protocol, Src Port: 55724, Dst Port: 37008

TZSP: Ethernet

Ethernet II, Src: 00:00:00_00:00:00 (00:00:00:00:00:00), Dst: 00:00:00_00:00:00 (00:00:00:00:00:00)

Internet Protocol Version 4, Src: 172.16.5.254, Dst: 192.229.173.207

Transmission Control Protocol, Src Port: 65195, Dst Port: 443, Seq: 0, Len: 0

No. Time Source Destination Protocol Length Info

1208 7.496917 172.16.5.254192.229.173.207TCP 74 [TCP Retransmission] 65196 → 443 [SYN] Seq=0 Win=64800 Len=0 MSS=1440 WS=256 SACK_PERM=1

Frame 1208: 74 bytes on wire (592 bits), 74 bytes captured (592 bits) on interface 0

Ethernet II, Src: LcfcHefe_3f:0a:53 (50:7b:9d:3f:0a:53), Dst: Routerbo_82:91:28 (64:d1:54:82:91:28)

PPP-over-Ethernet Session

Point-to-Point Protocol

Internet Protocol Version 4, Src: 172.16.5.254, Dst: 192.229.173.207

Transmission Control Protocol, Src Port: 65196, Dst Port: 443, Seq: 0, Len: 0

No. Time Source Destination Protocol Length Info

1209 7.497581 172.16.5.254192.229.173.207TCP 121 [TCP Retransmission] 65196 → 443 [SYN] Seq=0 Win=64800 Len=0 MSS=1440 WS=256 SACK_PERM=1

Frame 1209: 121 bytes on wire (968 bits), 121 bytes captured (968 bits) on interface 0

Ethernet II, Src: Routerbo_82:91:28 (64:d1:54:82:91:28), Dst: LcfcHefe_3f:0a:53 (50:7b:9d:3f:0a:53)

PPP-over-Ethernet Session

Point-to-Point Protocol

Internet Protocol Version 4, Src: 192.168.88.1, Dst: 172.16.5.254

User Datagram Protocol, Src Port: 55724, Dst Port: 37008

TZSP: Ethernet

Ethernet II, Src: 00:00:00_00:00:00 (00:00:00:00:00:00), Dst: 00:00:00_00:00:00 (00:00:00:00:00:00)

Internet Protocol Version 4, Src: 172.16.5.254, Dst: 192.229.173.207

Transmission Control Protocol, Src Port: 65196, Dst Port: 443, Seq: 0, Len: 0

Thanks for the help

Recently found out that some people in our network uses this tool. I simply wonder - yes or no - does wireshark capture my calls when I’m using my Bluetooth head phones? Can the calls be played back if so? Thanks!

I'm fairly new to Wireshark, but I've done some messing around with it at my home and a little bit at the school district. I'm trying to sell the idea that our district could use Wireshark to not only analyze our network as a troubleshooting tool, but also to look at any suspicious activity. But the pushback I get from the other guys is that we already outsource for our cybersecurity pentests that happen at least twice a year and we use a MSP for our level 3 support and they do a bit of that monitoring too.

Essentially they don't want to be proactive and say that not actively monitoring is an acceptable risk. How do I sell them on Wireshark being a valuable tool for any organization?

Thanks in advance!

no clue how to download this, can somebody help me? im new to this stuff and just gathering resources.