Ask Your Question

Christian_R's profile - activity

2025-06-11 05:28:30 +0000 commented question Two TTL values seen when using ip.ttl

Do you mean in one packet or in two packets?

2025-06-11 05:27:22 +0000 received badge  Rapid Responder (source)
2025-06-11 05:27:22 +0000 answered a question Two TTL values seen when using ip.ttl

A value of 128 means in a lot of cases, that the capture was taken in the same subnet or even on the same host. A value

2025-04-29 05:24:10 +0000 answered a question TCP SACK analysis best practice?

Hello, here are some videos about Analyzing SACK/DSACK/PacketLoss: How to analyze SACK/DSACK with Wireshark TCP SACK

2025-03-19 20:47:01 +0000 answered a question what is slowing down the restore?

Hello, It is a little bit hard to read you capture as you cut in the middle of the tcp header, so that SACK is not visi

2025-03-19 20:47:00 +0000 answered a question what is slowing down the restore?

Hello, It is a little bit hard to read you capture as you cut in the middle of the tcp header, so that SACK is not visi

2024-06-22 15:19:14 +0000 marked best answer Can I limit the display filter to a specific layer

For example: An IP header inside an ICMP message. In that case we have two IP Headers in one packet.

But can I limit the display filter (e.g. ip.dst) to only one of them, like in the columns dialog?

2024-06-22 15:19:06 +0000 commented answer Can I limit the display filter to a specific layer

Update for new readers: Bug 3971 is closed for 3 years now.

2024-06-20 06:08:17 +0000 received badge  Notable Question (source)
2024-06-20 06:08:17 +0000 received badge  Famous Question (source)
2024-04-28 14:17:39 +0000 received badge  Famous Question (source)
2024-04-28 14:17:39 +0000 received badge  Notable Question (source)
2024-02-07 19:36:13 +0000 received badge  Famous Question (source)
2024-01-02 19:55:07 +0000 received badge  Notable Question (source)
2023-12-26 23:16:53 +0000 answered a question Help with network connection issues - TCP Dup ACK / Retransmission

Hello, you always have a loss of packets when the packets are too big. In your trace 1418 bytes (Layer4) is still good 1

2023-12-26 23:16:49 +0000 answered a question Help with network connection issues - TCP Dup ACK / Retransmission

Hello, you always have a loss of packets when the packets are too big. In your trace 1418 bytes (Layer4) is still good 1

2023-12-26 23:16:41 +0000 answered a question Help with network connection issues - TCP Dup ACK / Retransmission

Hello, you always have a loss of packets when the packets are too big. In your trace 1418 bytes (Layer4) is still good 1

2023-12-05 09:21:07 +0000 received badge  Popular Question (source)
2023-11-24 21:16:30 +0000 commented answer Window Size in packet

Unfortunately exactly here comes the 3-way handshake into play, because we need to know the window scaling factor (WS).

2023-11-24 21:16:14 +0000 commented answer Window Size in packet

Unfortunately exactly here comes the 3-way handshake into play, because we need to know the window scaling factor (WS).

2023-11-24 21:13:15 +0000 commented answer Window Size in packet

Unfortunately exactly here comes the 3-way handshake into play, because we need to know the window scaling factor (WS).

2023-11-24 21:03:18 +0000 marked best answer Can I disable dark mode in Windows version

Hello, Wireshark 4.2 comes with the dark mode for windows. Can I disable the dark mode somewhere in Wireshark?

2023-11-24 21:03:13 +0000 commented answer Can I disable dark mode in Windows version

Thanks, for the answer. Hoping for soon fix.

2023-11-22 20:36:56 +0000 received badge  Rapid Responder (source)
2023-11-22 20:36:56 +0000 answered a question Window Size in packet

Window size will be announced in each package. When a packet is received, the packet is stored in the receive buffer. An

2023-11-22 20:36:49 +0000 received badge  Rapid Responder (source)
2023-11-22 20:36:49 +0000 answered a question Window Size in packet

Window size will be announced in each package. When a packet is received, the packet is stored in the receive buffer. An

2023-11-22 20:24:34 +0000 asked a question Can I disable dark mode in Windows version

Can I disable dark mode in Windows version Hello, Wireshark 4.20 comes with the dark mode for windows. Can I disable the

2023-11-22 20:24:33 +0000 asked a question Can I disable dark mode in Windows version

Can I disable dark mode in Windows version Hello, Wireshark 4.20 comes with the dark mode for windows. Can I disable the

2023-09-10 16:38:24 +0000 answered a question Is [TCP segment of a reassembled PDU] an issue?

No, that is not an issue in general. It just says that the transferred data is too large for one packet. Therefor it is

2023-06-25 19:25:10 +0000 commented question why retransmisson of TCP handshake

Can you share us atria?

2022-11-11 03:20:35 +0000 received badge  Famous Question (source)
2022-11-11 03:20:35 +0000 received badge  Notable Question (source)
2022-05-09 16:46:31 +0000 received badge  Popular Question (source)
2022-04-13 14:57:12 +0000 received badge  Famous Question (source)
2022-03-29 19:57:24 +0000 commented answer Packet delay during PROFINET realtime communication

The article states that the Profinet Frames comes with a pre tagged VLAN0 Header. And this could cause some issues, depe

2022-03-29 19:55:43 +0000 commented answer Packet delay during PROFINET realtime communication

The article states that the Profinet Frames comes with a pre tagged VLAN0 Header. And this could cause some issues, depe

2022-03-23 21:21:18 +0000 received badge  Popular Question (source)
2022-03-21 19:52:30 +0000 commented answer Packet delay during PROFINET realtime communication

FYI: Due to the fact that the PROFILINK frames are sometimes too small for the Ethernet network, the access switch p

2022-03-21 19:50:48 +0000 commented answer Packet delay during PROFINET realtime communication

FYI: Due to the fact that the PROFILINK frames are sometimes too small for the Ethernet network, the access switch ports

2022-03-21 19:49:54 +0000 commented answer Packet delay during PROFINET realtime communication

FYI: Due to the fact that the PROFILINK frames are sometimes too small for the Ethernet network, the access switch ports

2022-03-20 20:54:01 +0000 commented question Is it ARP Spoofing?

Either it is an ARP storm or a loop. Could you share a trace with us?

2022-03-20 20:53:48 +0000 commented question Is it ARP Spoofing?

Either it is an ARP storm or a loop. Could you share a trace with us.

2022-03-20 20:51:26 +0000 answered a question Packet delay during PROFINET realtime communication

Yes you are right, the CPU-acknowledges are queued in the network (my best guess is somewhere on the LACP). You can se

2022-03-20 20:51:26 +0000 received badge  Rapid Responder (source)
2022-01-06 17:19:19 +0000 received badge  Popular Question (source)
2022-01-06 17:19:19 +0000 received badge  Famous Question (source)
2022-01-06 17:19:19 +0000 received badge  Notable Question (source)
2021-08-02 00:52:50 +0000 received badge  Popular Question (source)