First time here? Check out the FAQ!
THIS IS A TEST INSTANCE. Feel free to ask and answer questions, but take care to avoid triggering too many notifications.
Ask Your Question
0

Rogue Elasticstack, replacing all protocols with Elasticstack

I was capturing traffic through ethernet, when all of a sudden every single packet coming through turned into protocol Elasticstack, and all the fields appeared to be encrypted. I dont have Elasticstack. I contacted Elasticstack regarding this issue, they told me to reach out to Wireshark. So since you dont have any contact information at your company Wireshark, I feel this is the best place to start. Please explain to me what would cause this to happen. If packets never lie, then there might be something of value to learn from this. Thankyou.

xxxDEV1xxx's avatar
1
xxxDEV1xxx
asked 2023-02-19 18:03:30 +0000
edit flag offensive 0 remove flag close merge delete

Comments

add a comment see more comments

1 Answer

0

The Elasticsearch dissector uses UDP port 54328 and TCP port 9300 by default. UDP and TCP packets using these ports run the risk of being mislabeled like this. Simplest way to solve this, since you do not deploy Elasticsearch, is to simple disable the Elasticsearch protocol, through the menu Analyze | Enabled protocols..., search for Elasticsearch in that dialog and uncheck the protocol.

Jaap's avatar
13.7k
Jaap
answered 2023-02-20 12:13:52 +0000
edit flag offensive 0 remove flag delete link
more

Comments

add a comment see more comments

Your Answer

Please start posting anonymously - your entry will be published after you log in or create a new account. This space is reserved only for answers. If you would like to engage in a discussion, please instead post a comment under the question or an answer that you would like to discuss.

Add Answer