396 reputation
14
bio website
location
age
visits member for 2 years, 1 month
seen Oct 21 at 21:40

Oct
6
answered Wireshark “length” column - what does it include?
Aug
14
comment Port Mirroring to Mac Thunderbolt Ethernet
(BTW, hubs rather than switches are often used in that fashion, although true hubs may be hard to find now that switches are cheap.
Aug
14
answered Port Mirroring to Mac Thunderbolt Ethernet
Aug
13
comment Port Mirroring to Mac Thunderbolt Ethernet
Which traffic are you trying to see? Traffic between your Mac and the Internet? Other machines' traffic on your Wi-Fi network?
Jul
31
answered tcpdump: decode packet starting at non-zero offset
Jun
10
answered multicast tcpdump and subscriptions
May
18
comment Network flooded with seemingly empty packets
Or defective firmware or software running on that hardware. This answer is probably correct.
May
18
comment Network flooded with seemingly empty packets
All this assumes the frames aren't just junk transmitted by broken hardware or buggy software; see the other answer to this question, which notes that the frame appears to consist of 0x03 0x20 0x00 0x00 repeated over and over again.
May
3
answered Capturing multicast data with Wireshark with IGMP Snooping Enabled at the switch
Apr
22
awarded  Editor
Apr
22
revised What do “Unknown SSAP” and “Unknown DSAP” mean in tcpdump?
Explain *which* Ethernet frames have 802.2 headers. (We ignore the old NetWare 802.3-with-length-but-no-802.2-header frames here.)
Feb
9
comment When analyzing packets with Wireshark, is there a way to know which program is sending which packet?
(Note that NetMon obviously can't show you the process responsible for a packet that's not sent from or to the machine running NetMon.)
Feb
9
answered Caculating packet offset
Feb
9
comment Caculating packet offset
He might be trying to write a capture filter; the syntax for them is more limited.
Feb
3
answered Strange Ethernet II packets in wireshark
Nov
16
comment Why is the “don't fragment” flag set in https and ssh protocols?
(I.e., it has nothing to do with encryption, and everything to do with TCP.)
Oct
16
answered tcpdump on a capture card
Sep
17
awarded  Yearling
Jul
22
comment Why does OS X spend one more packet to establish and close a TCP connection?
If you don't have a GUI, you can, at least the way Wireshark is packaged for many Linux distributions, just install the tty-mode version, TShark (although you have to figure out what the name of that package is). For OS X, however, the Wireshark developers only offer a full-blown package with both Wireshark and TShark, and it currently requires that you "install a GUI" in the sense of installing X11.
Jul
8
answered Can Wireshark capture an entire Ethernet frame including preamble, CRC and Interframe spacing?