Spooky's profile - activity

Hi Daniel, You may be using a passive FTP connection. FTP-DATA uses port TCP/20 for an active FTP connection. Please s

If you decide to try capturing ICMP then Wireshark can be used to analyze the response times or check for missing replie

If you decide to try capturing ICMP then Wireshark can be used to analyze the response times or check for missing replie

If you decide to try capturing ICMP then Wireshark can be used to analyze the response times or check for missing replie

Because TCP is connection-oriented, there will be retransmission when segments are lost. You could come up with a mathem

A 120-second loss is triggering alarms on the reporting team's side but not on your side so you must not be monitoring t

You could run Wireshark while starting one host at a time and see if the host is the one trying to connect to the mail s

Simply put Occam's razor is a problem-solving principle that recommends looking for the simplest or most obvious explana

If the source MAC address ("DrayTek_66:17:48") is the actual MAC of the router interface and seeing the IPv4 TTL being 1

When a host sends a TCP segment with SYN flag set, it usually means that this host wants to establish a TCP connection w

You can start by running a capture to see what packets are seen right now and to try to understand what event is generat

Not sure what you need here. Start by checking How To Set Up a Capture to see if this answers your question. When you

Not sure what you need here. Start by checking How To Set Up a Capture to see if this answers your question. When you

The capture file is from the point of view of the host or the network device where the packet capture occurred. You did

Hi, There is a dissector for J1939 if you look at the Wireshark source code. I also see Controller Area Network (CAN)

A TCP connection always begins with a 3-way handshake: I find it unlikely that LDAP traffic over TCP would work without

Hi, From the 5 packets in the PCAP file, I can only offer some general analysis. Is the connection between the server

Hi, The two octets field is used to indicate payload size when the value is below 0x0600 (1536). Only when the value is

Hi Rasika, I'm not sure what you want to know here. Are you looking to troubleshoot latency or jitter in your implement

Hi, The best way to do this is with the original packet capture file inside Wireshark. Wireshark will do a lot of the

Hi, Packetized Elementary Stream (PES) is a data format for carrying elementary streams (audio, video, etc.) where thes

If this is a network security-related assignment then to answer your question you need to understand what is the basic d

Hi, In the shared PCAP we are not seeing a complete TCP 3-way handshake. Host 192.168.249.67 keeps trying to get a TCP

There are dnp3 display filters for sure. Are you talking about filtering during the capture itself?

You need to be more precise in what you want to analyze. The entire Statistics menu could fit your need.

Hi Andrew, I opened the PCAP and took a look at TCP conversations and sorted by the number of packets. You mentioned t

I don't see any traffic for an IP ending in .218. Did you mean 192.168.0.213?

This is a huge file. I see about 50/50 split between UDP and TCP traffic by number of packets. Can you narrow down what

Hi, Another reason for out of order may be fragmentation. Fragment arrives out of order from rest of traffic for instan

Hi, The trick to troubleshooting discards is to capture the traffic before it is dropped by the interface. I don't thi

If you go to i3d.net you see they are a hosting service. This traffic could be gaming related or possibly any of their

It's better to edit your question with a link to Dropbox so more people can try to help you.

Hi, This is not really a Wireshark question per se but I'll bite. I think most of my fellow network engineers would sa

If possible can you post the capture file on a public share?

Hi, There are two protocols that I can think off the top of my head that could be present in your capture where that in

You seem to be describing the behavior of packet loss but I'm not sure. Can you post the PCAP files on a public share?

Hi, There are two protocols that I can think off the top of my head that could be present in you capture where that inf

Hi, TCP SYN segment with Explicit Congestion Notification (ECN) in IP header can be dropped or have that feature remove

Hi VamsiKrishnaMeda, I have answered a similar question in the past. If the VM is running on your local PC then you sh