Jim Young's profile - activity

It appears that we have to press the ENTER key twice after choosing an entry from the dropdown list in order to have it

USBPcap is a seperate (Windows only) project. The USBPcap installer (like the NPCAP installer) is bundled with the Wind

There appears to be a middle box somewhere between the two systems messing with some of the TCP options and perhaps drop

With your current capture setup you are capturing data from multiple vlans concurrently. Some of the tcp sessions are c

For some reason the 'Timestamp sec' values for frames 11710 through frame 12445 inclusive jumps forward in time by about

The tshark man page documents the -Q and -P options. For example: tshark -i en0 -Q -P > packet.log &

The notion of "Seconds Since Previous Displayed Packet" is based on the order of the frames in the capture file and diff

Is this simply a case of a host based firewall running on the FTP server (192.168.16.128) silently dropping the TCP conn

For those playing at home and using the capture file shared above, the problem is seen in following set of TCP streams:

You didn't say what OS you are using. If you are using a *nix system with something like bash or zsh and your input file

What version of tshark are you running? The ability to have multiple comments was added later? I typically run on recen

It is possible to add multiple comments to a frame with editcap, but each additional comment must be added as new editca

What specific "time" value have you increased? Does the Win10 machine always appear to stall at the one hour (3600 seco

Coat-tailing on Christain R's answer, Are the access and core switches also used for non-PROFINET traffic? What type o

From the capture you provided, none of the "Origin Timestamp" values from the server match any of the client's "Transmit

In one of your videos you show the TaskManager window. The TaskManager window appears to imply that the C: drive is ISC

It looks as if all protocols are disabled. The Enabled Protocols dialog can be opened from the main menu as Analyze -&g

It appears that the Linksys device as a middle-ware NAT box is reframing the postage machine's traffic ultimately suppre

It appears that the Linksys device as a middle-ware NAT box is reframing the postage machine's traffic ultimately suppre

The Duration field is a derived value. My experience with monitor mode captures created on my macOS systems is that the

The Duration field is a derived value. My experience with monitor mode captures created on my macOS systems is that the

Your pkt raw hex data is missing two octets in the first line. If we add data for the two missing octets between 9b and

Your pkt raw hex data is missing two octets in the first line. If we add two data for the two missing octets between 9b

On macOS lot's of network stats are available via the CLI command: netstat -sn. But if you run this command as a normal

A typical wireless router will have two radios supporting two Wifi channels, one in the 2.4GHz and one in the 5Ghz bands

A typical wireless router will have two radios supporting two Wifi channels, one in the 2.4GHz and 5Ghz bands. Could you

I also meant to add that the DHCP dissector complains about the option 124 sent in the DHCP Discover and DHCP Request pa

Regarding the reported "dhcp/bootp errors", The DHCP replies sent from the server (the DHCP Offers and the DHCP ACKs) ar

Could you have a rogue DHCP server somewhere on your local network? You reported the office as having the subnet 10.26.

Extract the the RTP audio (as .au files) for the Forward Streams from both the Working and Non-Working using Telephony -

Thanks for clarifying. Overlooked the "Clear the LG bit" line in the first comment. Completely agree that clearing LG "a

@ChuckC - The packet detail snippet above shows the source MAC address as 02:50:c2:3b:70:00 (a locally admin address) an

As suggested by bubbasnmp you can use -e ws.col.Time. You can then use tshark's -t option to change the way that column

It's not clear where specifically your capture was taken. Was it on the client or on some middleware device? The TTL va

It's not clear where specifically your capture was taken. Was it on the client or on some middleware device? The TTL va

Merging the egress10.pcap and ingress10.pcap files together yields a more useful capture to analyze.

Your cloudshark link example only contains one side of the conversation, packets sent by the client.

Adding the -e option to the tcpdump command to display link level headers may reveal the presence of 'ethertype 802.1Q (