506 reputation
24
bio website
location
age
visits member for 2 years, 6 months
seen Mar 2 at 19:29

Jan
23
answered Dumpcap on remote linux interface
Nov
20
awarded  Yearling
Nov
20
answered tcpdump truncates to 1472 bytes useful data in UDP packets during the capture
Nov
6
comment Extract nth Packet From a Pacp File
Extract it and print it out, or extract it into a new pcap file?
Oct
6
answered Wireshark “length” column - what does it include?
Aug
14
comment Port Mirroring to Mac Thunderbolt Ethernet
(BTW, hubs rather than switches are often used in that fashion, although true hubs may be hard to find now that switches are cheap.
Aug
14
answered Port Mirroring to Mac Thunderbolt Ethernet
Aug
13
comment Port Mirroring to Mac Thunderbolt Ethernet
Which traffic are you trying to see? Traffic between your Mac and the Internet? Other machines' traffic on your Wi-Fi network?
Jul
31
answered tcpdump: decode packet starting at non-zero offset
Jun
10
answered multicast tcpdump and subscriptions
May
18
comment Network flooded with seemingly empty packets
Or defective firmware or software running on that hardware. This answer is probably correct.
May
18
comment Network flooded with seemingly empty packets
All this assumes the frames aren't just junk transmitted by broken hardware or buggy software; see the other answer to this question, which notes that the frame appears to consist of 0x03 0x20 0x00 0x00 repeated over and over again.
May
3
answered Capturing multicast data with Wireshark with IGMP Snooping Enabled at the switch
Apr
22
awarded  Editor
Apr
22
revised What do “Unknown SSAP” and “Unknown DSAP” mean in tcpdump?
Explain *which* Ethernet frames have 802.2 headers. (We ignore the old NetWare 802.3-with-length-but-no-802.2-header frames here.)
Feb
9
comment When analyzing packets with Wireshark, is there a way to know which program is sending which packet?
(Note that NetMon obviously can't show you the process responsible for a packet that's not sent from or to the machine running NetMon.)
Feb
9
answered Caculating packet offset
Feb
9
comment Caculating packet offset
He might be trying to write a capture filter; the syntax for them is more limited.
Feb
3
answered Strange Ethernet II packets in wireshark
Nov
16
comment Why is the “don't fragment” flag set in https and ssh protocols?
(I.e., it has nothing to do with encryption, and everything to do with TCP.)