Hacker News Reader

Comment by jzwinck | Hacker News Reader

Wireshark is great but it does not show you every byte the network carried. For example it never shows Ethernet preambles, only sometimes shows Ethernet frame checksums, and never shows interpacket gaps (which are a required part of the Ethernet protocol).

So yes it comes close but it just goes to show you, there is always more detail hiding somewhere!

View on HN

Yes, the toughest "hidden things" problems are pulling together data that is related, but not part of the same system. In this case, Wireshark can only show you what the OS gives to it.

In the article, it was pointed out that DNS caches can be hidden. They're especially hidden when they're upstream and in another computer!

It doesn’t show electrical signals either. That’s a pointless nitpick if you’re developing anything beyond an Ethernet implementation.

My biggest problem with Wireshark is that it can't do anything with HTTPS traffic - which is most of the traffic I'd be interested in. I understand that's kind of the point of HTTPS, and a MITM proxy with cert replacement is somewhat out of the scope of Wireshark, it still limits the usefulness of the program.

This method is really simple for Chrome, Firefox and other OpenSSL apps: https://wiki.wireshark.org/TLS#using-the-pre-master-secret

You set an environment variable to instruct the app the write a file that Wireshark can use to decrypt its traffic, and change a setting in Wireshark to use that file, and that's it.

You will even be able to see decrypted WebRTC traffic.

it can, just not as easily as MITM proxies: https://wiki.wireshark.org/TLS

Check out Charles Proxy for mac. It’s great.

Are the Ethernet frame checksums even visible to Wireshark, which hooks into the IP layer? would some of the ethernet stuff be only visible within the ethernet card itself, not to the software stack?

Sometimes they are. It depends on how the capture was generated. If you look in the options of Wireshark there is one to detect bad checksums, so clearly there is a way to capture them. Here is one such way: https://stackoverflow.com/questions/22101650/how-can-i-recei...

This can be used to detect partially-bad network cables, because there is no reason you should ever receive a bad FCS.

Wireshark has support for lots of interfaces, it's just a consumer for OS/driver supplied data in this aspect.

See eg this bit about wlan for some of the complexity: https://wiki.wireshark.org/CaptureSetup/WLAN#link-layer-radi...

Wireshark works at the data link layer (L2).

Well...

ethhdr only has 14 bytes: 6 for dest mac address, 6 for source mac address, 2 for ethertype (e.g. IPv4 vs IPv6).

Any bad checksums that Wireshark can detect are predominantly at the transport layer (L4; TCP / UDP).

You'd have to explicitly turn on FCS, which I don't know if you can even do on, say, Windows.

To be fair, the preamble can be easily considered just an electrical signal due to its objective (sync) which doesn't affect how the network works.

Wireshark will also frequently show the wrong checksums for IP, UDP, and TCP. Specifically when computing them is ofloaded to the network card.

Reply on news.ycombinator.com