Wireshark Traffic – Why Wireshark Does Not Show All Traffic (Especially GVSP Data)

wireshark

This discussion reveals that Wireshark may not capture every packet on a network. In that case, the reason pertains to TCP data.

I am specifically interested in seeing (extremely bulky) GVSP data. As I understand it, this is based on UDP. I would have thought that even if Wireshark had no filter available for GVSP data, it would at least offer me the UDP data. But I don't see any data at all, despite being absolutely it is transmitted. Why not?

In my situation, I have a PLC triggering a camera regularly, which duly sends its images via GVSP to a host on an isolated network. Also, the PLC sends a UDP packet per trigger event down another isolated network to the same host. On that host, I run Wireshark, I capture on both channels simultaneously, and I see (1) visual evidence of the camera images arriving, (2) Wireshark evidence of the regular UDP packets, and (3) GVCP data from the camera. But the GVSP data is missing. What do I need to do to see this data?

Best Answer

I managed to show them (as UPD protocol packets) by disabling the Vimba GigE Vision Filter Driver, thanks to the answers in the rest of this post.

Related Solutions

Why Only QUIC and Not UDP is Seen During Wireshark Capture

Wireshark uses dissectors and lua scripts to analyze and classify capture traffic (or parts thereof). What is displayed in the Protocol field of Wireshark's Packet List Pane is the information returned that is most specific after analyzing the data and will determine how the data is presented.

If the UDP dissector is the most specific dissector for the captured data, than the Protocol column will show UDP. However many types of UDP traffic will be identified (SIP, RTP, DNS, etc).

The same is true for TCP traffic as well. Typically you will see this as HTTP, FTP, IRC, etc.

I've using wireshark and noticed that I no longer see UDP but QUIC, why is this the case?

In your case because the traffic has been analyzed as QUIC data. It may or may not be QUIC traffic; no program of this type is perfect, but Wireshark will be correct more often than not.

QUIC is one of the "newer" classifications, as it appears to have been added in 1.11.3/1.12.0. If you were using a version of Wireshark prior to these versions, the same traffic may likely have been classified as UDP (or another protocol).

If you don't want the QUIC protocol to be identified, simply go to the "Analyze" menu and select "Enabled Protocols" from the list. Find the entry for QUIC and uncheck the box.

Why does Wireshark show Version TLS 1.2 here instead of TLS 1.3

Sorry, for the confusion, I was missing the exact TLS 1.3 semantics: For instance, in the Client Hello, the field "version" must contain the fixed value 0x0303 (TLS 1.2), while the prefered version is contained in the extension "supported versions".

From RFC 8446 (TLS 1.3 spec):

struct {
      ProtocolVersion legacy_version = 0x0303;    /* TLS v1.2 */
      Random random;
      opaque legacy_session_id<0..32>;
      CipherSuite cipher_suites<2..2^16-2>;
      opaque legacy_compression_methods<1..2^8-1>;
      Extension extensions<8..2^16-1>;
  } ClientHello;

legacy_version: In previous versions of TLS, this field was used for version negotiation and represented the highest version number supported by the client. Experience has shown that many servers do not properly implement version negotiation, leading to "version intolerance" in which the server rejects an otherwise acceptable ClientHello with a version number higher than it supports. In TLS 1.3, the client indicates its version preferences in the "supported_versions" extension (Section 4.2.1) and the legacy_version field MUST be set to 0x0303, which is the version number for TLS 1.2. TLS 1.3 ClientHellos are identified as having a legacy_version of 0x0303 and a supported_versions extension present with 0x0304 as the highest version indicated therein. (See Appendix D for details about backward compatibility.)

This agrees with what Wireshark displays:

Best Answer

Related Solutions

Why Only QUIC and Not UDP is Seen During Wireshark Capture

Why does Wireshark show Version TLS 1.2 here instead of TLS 1.3

Related Topic