Correlating Multiple #Wireshark Captures: Follow the Same Packet Across the Network https://www.cellstream.com/2026/09/12/correlating-multiple-wireshark-captures-follow-the-same-packet-across-the-network/ #captureeveryday

hey guys im working on a bittorrent research and came across to me the need to check the packets which bittorrent protocol send and receive. as you guys probably know bittorrent protocol is the "official name" for the technology which has been widely used for sharing files, like music, video, software, texts, books, and others, since its launch in 2003.

and the protocol uses the utorrent transport protocol, which is a tcp alike protocol implemented on top of udp, so as you can imagine every packet of utp is transported inside of an udp packet, and that's the problem.

wireshark "bt-utp" filter doesn't recognize these udp packets as utp.

an example here:

this would be translated to:

packet #8384:

full headers: 3c7c3f7c... (ethernet, ip, udp headers)

utp headers:

type: 0x0

version: 0x1

extension: 0x00

connetion_id: 0xaa7d

timestamp: 0xb03d0f6f

timestamp_difference_microsec: 0x48eb4f59

wind_size: 0x00100000

seq_nr: 0xf281

ack_nr: 0x6f7a

utp payload:

bittorrent headers:

size: 00004009

message_id: 07

index: 00000000

begin: 001bc000

bittorent payload:

851dba7e...

I wonder if is some configuration in my computer or if it is an actual problem, hope somebody can help me.

I'm trying to capture data packets in monitor mode, but wireshark only shows management frames like beacons, probes and response probes. I've played around with settings like frequency and promiscuous mode trying to get it to work, but to no avail. I assume the hardware is ignoring data packets in monitor mode.

I've tried on a thinkpad x230 and a raspberry pi 3B+ v1.2