Reputation
611
Top tag
Next privilege 1,000 Rep.
See votes, expandable usercard
Badges
2 4
Newest
 Yearling
Impact
~24k people reached

  • 0 posts edited
  • 0 helpful flags
  • 3 votes cast
Jun
10
answered tcpdump freezes and not capturing properly without internet connection
Jun
10
comment tcpdump freezes and not capturing properly without internet connection
What happens if you use -n, i.e. tcpdump -n -i xenbr0?
May
24
comment How can I easily locate a specific TCP conversation in two separate (and large) packet captures using wireshark?
(I.e., Wireshark does support searching for a stream ID, but there is no guarantee whatsoever that the stream ID for a given TCP conversation in one capture will be the same as the stream ID for that conversation in another capture, as there are no stream IDs in TCP, just endpoint identifiers - IP address and TCP port. So you'll have to use Statistics -> Conversations to find the conversations in both captures, and then display them separately.)
Apr
30
comment How can the SSDP protocol be filtered out of Wireshark view?
That's not surprising, given that http and not udp and http && !udp are the exact same filter.
Apr
30
comment tcpdump strange udp line
Just udp, not [|udp]? What does tcpdump -h print?
Apr
30
comment tcpdump increases udp performance
So you're running tcpdump on both the client and on the server, and the packet loss rate drops? What happens if you run it only on the client, and what happens if you run it only on the server? (And, yes, also try turning promiscuous mode off, and perhaps also try capturing on the specific network interface used for the test rather than the "any" device, to see if that makes a difference.)
Apr
30
answered How can the SSDP protocol be filtered out of Wireshark view?
Apr
15
answered PCap filter by IP not filtering out 0.0.0.0
Apr
14
comment PCap filter by IP not filtering out 0.0.0.0
The "dst" (destination) address in an ARP request doesn't indicate the IP address to which the packet is being sent - it's probably being sent as a MAC-layer broadcast to all hosts on the network segment - it indicates the IP address whose MAC address the sending host wants, i.e. it's the IP address to which it would like to send a packet. ARP packets aren't sent to IP addresses, so what made them look as if they were going to 0.0.0.0?
Apr
11
comment PCap filter by IP not filtering out 0.0.0.0
So it's capturing IPv4 packets going to 0.0.0.0? They're not ARP packets?
Apr
10
comment PCap filter by IP not filtering out 0.0.0.0
What does tcpdump -d dst net 10.36.95.0 mask 255.255.255.0 print? (If you were capturing on a particular interface, add -i with that interface name to the command. You may have to run it as root.)
Jan
23
answered Dumpcap on remote linux interface
Nov
20
awarded  Yearling
Nov
20
answered tcpdump truncates to 1472 bytes useful data in UDP packets during the capture
Nov
6
comment Extract nth Packet From a Pacp File
Extract it and print it out, or extract it into a new pcap file?
Oct
6
answered Wireshark “length” column - what does it include?
Aug
14
comment Port Mirroring to Mac Thunderbolt Ethernet
(BTW, hubs rather than switches are often used in that fashion, although true hubs may be hard to find now that switches are cheap.
Aug
14
answered Port Mirroring to Mac Thunderbolt Ethernet
Aug
13
comment Port Mirroring to Mac Thunderbolt Ethernet
Which traffic are you trying to see? Traffic between your Mac and the Internet? Other machines' traffic on your Wi-Fi network?
Jul
31
answered tcpdump: decode packet starting at non-zero offset