capture network traffic using wireshark

kirkcaine · 04-05-2009, 03:05 AM

Hi all.
I've seen alot of failed login attempts on the Admin account during times when I'm asleep. The only time these occur is when the lan is connected to the outside.
So I've installed wireshark on the sbs2003 and I can see the ip and mac addresses coming in but I'm wanting to see what passwords they're trying.
Is this possible with wireshark - i'm pretty new to this tool or are there any other recommendations?

Thanks.

**johnwill** · 04-05-2009, 01:11 PM

Look at the data in the packets when the login attempt occurs.

kirkcaine · 04-05-2009, 05:35 PM

Hi John. Yeah I've tried looking at the data but it's all jumbled which I guess is from the ssl being that it's on port 443.

04-05-2009, 03:05 AM	#1 (permalink)
kirkcaine Registered User Join Date: Mar 2008 Posts: 8 OS: sbs, xp, linux - latest updates	capture network traffic using wireshark Hi all. I've seen alot of failed login attempts on the Admin account during times when I'm asleep. The only time these occur is when the lan is connected to the outside. So I've installed wireshark on the sbs2003 and I can see the ip and mac addresses coming in but I'm wanting to see what passwords they're trying. Is this possible with wireshark - i'm pretty new to this tool or are there any other recommendations? Thanks.

04-05-2009, 01:11 PM	#2 (permalink)
johnwill Manager, Networking Forums Join Date: Sep 2002 Location: S.E. Pennsylvania, US Posts: 41,748 OS: Windows 7, XP-Pro, Vista, Linux Blog Entries: 1	Re: capture network traffic using wireshark Look at the data in the packets when the login attempt occurs. __________________ If TSF has helped you, Tell us about it! or Donate to help keep the site up! Microsoft MVP - Windows Desktop Experience

04-05-2009, 05:35 PM	#3 (permalink)
kirkcaine Registered User Join Date: Mar 2008 Posts: 8 OS: sbs, xp, linux - latest updates	Re: capture network traffic using wireshark Hi John. Yeah I've tried looking at the data but it's all jumbled which I guess is from the ssl being that it's on port 443.