This is a static archive of our old Q&A Site. Please post any new questions and answers at ask.wireshark.org.

How do I track UDP packets from localhost?

0

Greetings, Gentlemen! I am totally new to Wireshark and Networks too. Please help me to do a simple exercise.

I have coded a simple UDP server-client pair according to Java tutorials: http://docs.oracle.com/javase/tutorial/networking/datagrams/clientServer.html It works. The server is running on my machine and client too. What I want now is to track the packets I send using my fantastic software setup. How can I find them?

So here are 2 questions:

1) how can I find "my" messages?

2) how can I decode there content into normal text to be sure it is mine?

UPDATE: finally I did it! on Macos by specifying lo0 address for Wireshark. Here is a 'data' from my message I have captured.

alt text

The questions are:

1) In which format the message shown in the picture is encoded?

2) Why my message in the right column (which I suppose to be the decoded data) is split by dots and has some strange symbols before?

asked 19 Jun '13, 08:37

Dymytry's gravatar image

Dymytry
6123
accept rate: 0%

edited 20 Jun '13, 03:09


2 Answers:

0

Now you've managed to capture the traffic you must use Wireshark's facilities to inspect it. According to the link you gave the server operates on udp port 4445, so you should set a capture filter of udp port 4445.

Having done that and captured some traffic you can inspect it. Wireshark has lots of built-in dissectors for many types of traffic, but doesn't have one for the Java test application you are using, so at best the traffic may be displayed as plain "data", and you'll just see the hex bytes, or a dissector may mistake the data for another protocol and attempt to dissect it and will fail with possible errors.

If the "data" view is sufficient then you're done, if, however, you want to have a proper protocol dissection of your traffic then you'll need to create a dissector for that. There are a few options for doing that and as it happens, that was the topic of my presentation at SharkFest'13 - PA10: Writing a dissector, and the PowerPoint, capture and example dissectors will be available at the SharkFest site shortly.

answered 20 Jun '13, 09:09

grahamb's gravatar image

grahamb ♦
19.8k330206
accept rate: 22%

0

What is your OS? Capturing loopback traffic is very difficult on Windows. If you are using Windows then the simplest solution will be to run the client and server on different machines.

See the Wiki page on loopback capture for more info.

answered 19 Jun '13, 10:10

grahamb's gravatar image

grahamb ♦
19.8k330206
accept rate: 22%

I have Macos Lion, but if necessary I can run the same setup at home on Windows 7.

(20 Jun '13, 01:27) Dymytry

Got it! grahamb, could you please revisit my topic for updates!

(20 Jun '13, 01:52) Dymytry