The second step to finding the packets that contain login information is to understand the protocol to look for.This Visual Studio Code(tm) extension adds support to open pcap/network files. Steps to capture relevant data : 1) Set the filter as ip.addr 2) Make sure the packet sequence matches the image given below 3) Now set the filter as ip.dst 4) Now check for the first occurrence of HTTP/1.

Select Capture > Start or click on the Blue start icon.HTTP (Hyper Text Transfer Protocol) is the protocol we will be dealing with when looking for passwords. Wireshark comes with the option to filter packets. Leaving Wireshark running in the background, replicate the problem. Once the issue has been fully replicated, select Capture > Stop or use the Red stop icon. You do need to figure out what YOUR MAC address is. Lastly, navigate to File > Save As and select a place to save the file. On Windows you can run ipconfig /all and look for the 'Physical address'. When you are done capturing, you can check the Ethernet tab after clicking Statistics -> Conversation and see what MAC addresses are present in your capture. Ensure the file is saved as a PCAPNG type.

By filtering this you are now only looking at the post packet for HTTP. This drastically narrows the search and helps to slow down the traffic by minimizing what pops up on the screen. Make sure both the device being tested and the computer are connected to the same network. Then at the far right of the packet in the info section you will see something like '.login' or '/login'. The source MAC address is the one of the sender (the one encircled in red) and the destination MAC address is of the receiver. You can see exactly what I am talking about if you follow the pictures above. Note: On Mac OS/Unix OSs you might have to grant read access to the network interfaces (e.g. When u click on a packet/frame corresponding window highlights: Here if you expand the Ethernet Section you will see source and destination address. sudo chmod +r /dev/bpf works but has to be done after every OS. Then you will right click on it and go down to 'FOLLOW' then to 'TCP STREAM'. Once you get there look in the red text paragraphs and try to find what I was able to locate in the picture.

And you have just located the password and username you have entered on the unprotected login page - whether or not the password and username are correct are irrelevant.

Pcapng wireshark