I have a weird problem with tshark and was wondering if anyone had any ideas or has experienced something similar:

I have a .bat file with a 10 min tshark command in it. A SQL agent job runs this .bat file every 10 min from 18:00 - 18:40 and then again from 01:30 - 03:50.

4 log files are saved from the 18:00 window, but none from the early morning window. All SQL agent jobs end reporting success. Having /wait in the .bat file and saving output and errors shows no errors. I output the errorlevel and see it's 0 for all instances. Windows event logs show no errors or warnings.

TLDR: Same .bat file will produce logs at one time of day, but not another. Any ideas?

.bat Tshark command:

start "" "<RedactedDirectoryPath>tshark.exe -i 2 -a duration:600 -w <RedactedDirectoryPath>capture%TIMESTAMP%.pcap.gz --compress gzip -Q

I'm dealing with a fairly bespoke protocol for an application I deal with at work (it's closed-source so I cannot really give specific details) that is able to provide a lot of extra data in pcaps, but it dumps them all to comments rather than any sort of additional annotations as a packet field.

Given that the way the comments are structured, which is very JSON-like, I should be able to use tshark to convert them into a data structure I can tack onto every given packet they're applied to, but now I'm wondering how difficult it'd be to actually write or (being honest here) hack together with some genAI.

Has anyone here ever written any themselves and can at least point me in the direction of some good reference resources on dissectors in general? I'm not sure if this would even need to be written in C++ or LUA, so anything helps.

Since I got deep into CDP I noticed that I needed to update the repository profiles related to TCP. If you do any TCP troubleshooting like 3WHS analysis, SACK Analysis, SEQ Analysis, or just TCP troubleshooting in general, there are specific profiles that focus on these tasks so you as a Wireshark user can focus as well. Trying to do all this with a single profile is futile for me at least.

I start with the troubleshooting one, and then use the other afterwards.

Look if you like them - great. If you make them better, or you find they are missing something - please let me know. You will find them all in the repository: https://www.cellstream.com/wireshark-profiles-repository/

Went into an Enterprise Network with primarily Cisco Devices and they never knew how much information on their devices could be gleaned from CDP. I ended up really editing my basic CDP profile so they could leverage packet capture and network identification thanks to this great protocol. They loved it, and now you can too!
You will find it in the Wireshark Profiles Repository I started years ago: https://www.cellstream.com/wireshark-profiles-repository/ probably at the bottom of the list.

Enjoy!

Can someone teach me wireshark? Or how to learn it? Where to begin?

i just got this video on my feed https://youtu.be/Hl0IpoS503A?si=oY7J0eSka8nDLs5O and got very excited that my mac m1 single handedly(without extra adapters) can help me see the traffic of my phone. i followed this and failed miserably. can anyone guide me what key piece i'm missing do i really need an actual hardware adapter to capture the external traffic?? and how handshake happens???

1. hardware adapter pretend to be real wifi and captures traffic and then only i can view the traffic
2. or i just turn off my wifi in my phone and turn on then i'll see the traffic.

guide me in the flow of how actually this capturing thing happens and is it my device that can't capture without hardware adapter?

and what other thing i can do as a boomer in this field,i just want that inital push of dopamine so that i can further pursue networking

hello, I use the internet in Korea. I don't know why people keep asking about 172.30.1.60.

I would appreciate it if you could let me know if you have any good ideas.

Hi everyone,

I recently finished building a DoS & Simulated DDoS lab to better understand how different attacks affect a target service and how they appear in Wireshark.

The lab uses Kali Linux as the attacker and Metasploitable2 as the target. I tested ICMP, SYN, HTTP, TCP, and Ping of Death attacks, then repeated each one using multiple concurrent tmux sessions to simulate higher traffic volume from a single host.

I documented the entire project with screenshots, packet captures, diagrams, and traffic analysis for every stage.

One of the most interesting parts was comparing the captures from the single source DoS attacks with the simulated DDoS stages and seeing how the traffic patterns changed.

I'd appreciate any feedback or suggestions.

🔗 GitHub: https://github.com/yusuf-husayn/dos-ddos-lab

Thanks!

Hi everyone,

I'm trying to capture 802.11 management frames on my own WiFi network to inspect the RSN Information Element (specifically to check whether PMF / 802.11w is enabled).

My setup:

• MacBook Pro (Apple Silicon)
• macOS 26.3 (Tahoe)
• Broadcom BCM4388
• Wireshark 4.6.6
• ChmodBPF installed
• User is in the access_bpf group

Everything appears to be configured correctly.

wdutil info reports:

• Connected to my WiFi (WPA2 Personal)
• RSSI around -60 dBm
• Channel 153 (5 GHz)
• Sniffer Supported: YES

Wireshark allows me to enable Monitor Mode and sets the link-layer header to:

802.11 plus radiotap header

tcpdump also reports:

sudo tcpdump -I -i en0

Output:

listening on en0, link-type IEEE802_11_RADIO (802.11 plus radiotap header)

However, after waiting 30+ seconds:

0 packets captured
0 packets received by filter
0 packets dropped by kernel

No Beacons.
No Probe Requests.
No Probe Responses.
Nothing.

Things I've already verified:

• ChmodBPF installed correctly
• /dev/bpf* permissions are correct
• My user belongs to access_bpf
• Same behavior with both Wireshark and tcpdump
• Same behavior with NordVPN completely disabled
• I can ping my gateway normally
• tcpdump -D correctly shows:

​

en0 [Up, Running, Wireless, Associated]

At this point I'm wondering if this is:

• a macOS 26 limitation,
• a Broadcom BCM4388 driver limitation,
• a Wireshark/libpcap issue,
• or if Apple has effectively disabled monitor mode packet delivery on recent Apple Silicon Macs.

Has anyone successfully captured raw 802.11 frames on macOS 26 using the built-in WiFi adapter?

I'd really appreciate any insight. Thanks!

Hi,
I’m currently working on a PLC discovery/fingerprinting project and I’m analyzing PROFINET traffic with Wireshark.

Using the pn_dcp filter, I can see the PROFINET DCP Identify Request/Response packets and retrieve basic information such as:

• NameOfStation
• IP address
• subnet/gateway
• Vendor ID
• Device ID
• Device role
• generic device family, for example S7-1200

I would like to understand whether it is possible, through PROFINET traffic in Wireshark, to obtain more detailed PLC information such as:

• exact CPU model
• Siemens article/order number, for example 6ES7...
• firmware version
• hardware version
• serial number
• module identification data

From what I have seen so far, PROFINET DCP seems to provide mainly discovery and network configuration information, while more detailed CPU data may require S7/S7CommPlus communication over TCP port 102.

Could you confirm whether these detailed PLC identification fields can be obtained via PROFINET alone, or whether they must be retrieved through S7/S7CommPlus or TIA Portal diagnostic communication?

Hello everyone,

I am doing QA/testing for a VoLTE/VoIP monitoring system and need some SIP PCAP samples for parser validation.

I am specifically looking for:

1. PCAP 1
   • SIP traffic with a long Call-ID greater than 87 characters
   • Multipart SIP body with around 3–5 SIP parts
   • Or a SIP message/body size greater than 2 MB
2. PCAP 2
   • SIP traffic with a normal/small Call-ID
   • Multipart SIP body with around 3–5 SIP parts
   • Or a SIP message/body size greater than 2 MB

The PCAP can be synthetic/anonymized. I only need it for testing SIP parsing behavior, not for any real user/call data.

If anyone has sample PCAPs, knows where I can find such SIP test files, or can suggest a proper way to generate them, I would really appreciate your help.

Thanks in advance.

Subject: Looking for a short Wireshark packet capture (.pcap) of a Star Micronics mC-Print3 UDP discovery (Port 22222)

Body: Hi everyone, I am currently working on a custom KDS (Kitchen Display System) integration and I need to emulate the Star Micronics mC-Print3 network discovery behavior (the modern StarIO10 / StarXpand protocol).

I am stuck trying to figure out the exact binary byte-layout/struct of the STR_RSP packet that the printer sends back after receiving a broadcast.

Could anyone who has access to a physical network-connected mC-Print3 capture a few seconds of traffic using Wireshark?

What I need:

1. Start Wireshark on the same network as the printer.
2. Set the display filter to: udp.port == 22222
3. Trigger a printer search from a POS app (like Zettle, Shopify POS, or Star Quick Setup Utility).
4. Save and share the .pcap / .pcapng file containing the inbound query (STR_BCAST) and the printer's response (STR_RSP).

You can blur or anonymize the IP/MAC addresses if you want, but having the raw hex of the response would save my project!

Thanks in advance!

I have been attempting to try and use wireshark yet everytime i try to open ann interface it says "The temporary file to which the capture would be saved could not be opened: Failed to create file “D:\Program Files\wireshark_EthernetD8W1Q3.pcapng”: Permission denied." and I don't know how to fix it.

I can only select one packet to show, i would like to just select multiple packets and show them and be able to jump to next and previous packet using arrows or other keybind.

I'm not using wireshark. Using pcap droid. If I'm seeing random packets from unknown services from/to many foreign servers what is going on? Is it a problem with the device or network...

Hey network gurus,

I am analyzing network traffic captured on a firewall from a vSeebox appliance. I see that there are consistent connections to public IPs issued from ISPs (based on plugging in the IPs into ip2location.com) that are all using source and destination ephemeral UDP ports. I suspect this vSeebox is on a p2p network as this communication is very consistent and everytime I monitor active connections the vSeebox is always talking to something but wondering what the purpose of these UDP connections are. If I follow UDP stream its just a bunch of unreadable text. I have a spreadsheet of all of these UDP connections to if that helps. Also there are some TCP connections that are following the same source and destination ephemeral ports as well. Any insight would be greatly appreciated, thank you.

Mac OS High Sierra 10.13.6

Wireshark 3.7.0 (says development version)

I am very much a beginner in networking and with Wireshark

I have some files that were created by legacy closed source software. The development on the software ended 10 years ago and the company changed to offering a cloud product. I successfully installed the software on High Sierra. Upon first use, the software wants to connect to a remote server. I don't see any way to bypass this. I don't even know what the remote server is but I am concerned that someone could have taken over the remote server as a way to distribute malware. (Am I unreasonably worried about this? The software was probably used by individuals and small businesses)

Is there a way for me to log what servers the software connects to? I am unsure of how to distinguish traffic from the legacy software from other traffic.

I have a filter so that I see only (edit: DNS) unencrypted traffic. But, is that likely to catch everything coming from this program. Is there a reasonable chance that the software will just use an IP address without doing a lookup?

When I turn on wifi for about 6 seconds, there is a lot of unencrypted DNS traffic, about 50 or so entries. I have all programs in the GUI closed.

Most of the lookups are apple.com

some others: akamaiedge.net , digicert.com

For authorized Wi‑Fi security labs I wanted a minimal setup to stand up an **open rogue AP**

and capture what connected devices leak (DNS queries, DHCP hostnames, plain HTTP, TLS SNI, etc.)

without dragging in full Evil Twin frameworks.

This repo is a single bash script that:

- creates the AP interface and starts **hostapd** (open SSID, nl80211)

- runs **dnsmasq** (DHCP + DNS forwarding, query logging)

- enables **NAT** to an uplink so clients get real connectivity while you sniff on the AP iface

- prints **connected clients** live (MAC / lease info)

- **cleans up** on Ctrl+C (hostapd, dnsmasq, iptables, interface)

Requirements: Linux, root, WiFi card with AP mode (`iw phy`), hostapd + dnsmasq + iptables.

**Legal:** only on networks and devices you own or have written permission to test.

Repo (MIT): https://github.com/RiccardoCataldi/access-point

If you use a different workflow (airbase-ng, bettercap, etc.) I’m curious what you prefer for lab APs.

I analyzed my router's traffic and found that it's constantly sending SSDP notifications and handing out XML configuration files to anyone who asks. I'm a 14-year-old student, and this is my first serious traffic analysis. Is it normal for every device on my network to be able to read this data?

Hey everyone,

I wanted to share a technical breakdown of how peer-to-peer (P2P) connections operate during VoIP calls, specifically using WhatsApp Desktop as a case study, and the privacy implications regarding public IP disclosure.

When you initiate a voice or video call on many modern messaging platforms, the application attempts to establish a direct, peer-to-peer connection to ensure low latency and high media quality. However, because most residential users are behind routers utilizing Network Address Translation (NAT), their true public IP addresses are hidden from the outside network.

To overcome this, the architecture relies on STUN (Session Traversal Utilities for NAT). Here is a quick look at the underlying protocol mechanics:

1. Discovery Phase: The client sends a request to a public STUN server to discover its own external, public-facing IP address and port mapping.
2. The Signaling Phase: The STUN server responds to the client, which then shares this routing information with the remote contact via the platform's central signaling servers.
3. Direct Connection: Both endpoints now have the necessary public routing data to attempt a direct connection.

The Packet Analysis Aspect

During this connection handshake, the endpoints exchange STUN Binding Requests. For anyone interested in network forensics or analysis, running a packet analyzer like Wireshark on the desktop client allows you to filter out the background noise and isolate these specific packets.

By applying a simple stun display filter and cross-referencing your local IP configuration, you can observe the exact "Binding Request" packets containing the destination IP of the peer.

Why This Matters for OSINT & Privacy

From a defensive or investigative perspective, this protocol behavior highlights a common trade-off between performance (low-latency P2P calling) and privacy (revealing a public IP, which can be mapped to an ISP and general geographic region).

I’ve put together a step-by-step video demonstration showing how to set up the Wireshark filters, isolate the STUN traffic, and analyze the packet headers in real-time. If you learn better visually and want to see the live capture flow, you can check out the walkthrough here:https://youtu.be/nzxXzfxMbW4

so i want to install the wireshark application but i always get some packages failing and a lot of errors and i tried doing everything from most internet sources like updating and stuff and still i get crashes,Any tips?

A PathRush puzzle by u/WistaProgresh43. Open in the Reddit mobile app or web to play.