Reputation
791
Top tag
Next privilege 1,000 Rep.
See votes, expandable usercard
Badges
3 4
Newest
 Yearling
Impact
~35k people reached

  • 0 posts edited
  • 0 helpful flags
  • 3 votes cast
Jan
3
answered Wireshark unable to capture squid traffic at port other than 3128
Dec
27
comment TCP Messages Merged?
Try turning off all the settings in question, and see what happens. You can't prevent it from happening - programs using TCP cannot rely on message boundaries being preserved, and must be able to deal with multiple messages per TCP segment and messages split between TCP segments.
Dec
26
answered TCP Messages Merged?
Dec
14
comment How can tcpdump monitor TCP disconnect and log timedate stamp?
"Your answer doesn't cover connections ending with RST" Updated.
Dec
14
revised How can tcpdump monitor TCP disconnect and log timedate stamp?
add RST
Dec
14
revised How can tcpdump monitor TCP disconnect and log timedate stamp?
Ow. This doesn't work with IPv6 (IPv6 packets are discarded by that filter).
Dec
14
answered How can tcpdump monitor TCP disconnect and log timedate stamp?
Oct
2
comment What does “-tnn” mean in “tcpdump -i eth0 -tnn dst port 80 -c 1000”
tcpdump from tcpdump.org doesn't have -nn - either you specify -n, in which case none of the conversions to names happens, no matter how many ns you have, or you don't specify it, in which case tcpdump tries to do all of the conversions. Perhaps the Red Hat/Fedora people hacked tcpdump to care how many times you specified n.
Sep
16
awarded  Yearling
Aug
29
answered Promiscuous mode not working with ubuntu and wireshark
Aug
29
answered tshark packet capture performance CentOS 6 v CentOS 7
Aug
3
answered Wireshark Data view
Jun
10
answered tcpdump freezes and not capturing properly without internet connection
Jun
10
comment tcpdump freezes and not capturing properly without internet connection
What happens if you use -n, i.e. tcpdump -n -i xenbr0?
May
24
comment How can I easily locate a specific TCP conversation in two separate (and large) packet captures using wireshark?
(I.e., Wireshark does support searching for a stream ID, but there is no guarantee whatsoever that the stream ID for a given TCP conversation in one capture will be the same as the stream ID for that conversation in another capture, as there are no stream IDs in TCP, just endpoint identifiers - IP address and TCP port. So you'll have to use Statistics -> Conversations to find the conversations in both captures, and then display them separately.)
Apr
30
comment How can the SSDP protocol be filtered out of Wireshark view?
That's not surprising, given that http and not udp and http && !udp are the exact same filter.
Apr
30
comment tcpdump strange udp line
Just udp, not [|udp]? What does tcpdump -h print?
Apr
30
comment tcpdump increases udp performance
So you're running tcpdump on both the client and on the server, and the packet loss rate drops? What happens if you run it only on the client, and what happens if you run it only on the server? (And, yes, also try turning promiscuous mode off, and perhaps also try capturing on the specific network interface used for the test rather than the "any" device, to see if that makes a difference.)
Apr
30
answered How can the SSDP protocol be filtered out of Wireshark view?
Apr
15
answered PCap filter by IP not filtering out 0.0.0.0