Ask Your Question

cmaynard's profile - activity

2025-06-13 18:16:03 +0000 commented answer New OUI Lookup Tool Design - How do you search multiple OUIs at the same time?

Version 1.12 renames the generated file to oui.txt to avoid overwriting any user-created manuf file and to make it clear

2025-06-12 22:25:28 +0000 commented answer New OUI Lookup Tool Design - How do you search multiple OUIs at the same time?

Note that the latest version of the OUI lookup tool can also be run from the command-line using tshark. Refer to the wi

2025-06-12 18:13:24 +0000 answered a question New OUI Lookup Tool Design - How do you search multiple OUIs at the same time?

Until the online OUI lookup tool is reverted or modified to support multiple OUI lookups once again, you might be able t

2025-06-04 16:30:51 +0000 answered a question Interface name display

Yes, you can capture on multiple interfaces and get the information you're seeking. Just don't capture on the any inter

2025-06-04 16:30:51 +0000 received badge  Rapid Responder (source)
2025-03-06 18:17:20 +0000 commented question Long running tshark process and "-M" flag

Have you looked at using the -b flag? See: https://blog.wireshark.org/2014/07/to-infinity-and-beyond-capturing-forever-

2025-02-10 19:32:54 +0000 commented question getting zero length range from end of buffer

Something like so? function getString(buffer, position) local length = buffer:range(position, 4):uint() positio

2025-02-04 06:11:20 +0000 received badge  Notable Question (source)
2025-02-04 06:11:20 +0000 received badge  Famous Question (source)
2025-02-04 06:08:19 +0000 received badge  Notable Question (source)
2025-02-04 06:08:19 +0000 received badge  Popular Question (source)
2025-01-29 19:20:52 +0000 commented question How to write a listener/tap (in Lua) to follow streams inside of a dissected custom protocol?

I'm not sure if this will be helpful to you or not, but try having a look at https://osqa-ask.wireshark.org/questions/55

2025-01-29 19:20:30 +0000 commented question How to write a listener/tap (in Lua) to follow streams inside of a dissected custom protocol?

I'm not sure if this will be helpful to you or not, but try having a look at https://osqa-ask.wireshark.org/questions/55

2025-01-13 16:56:48 +0000 commented answer Looking for strategies when Lua dissectors are getting too big

If I understand you correctly, you could add a table concatenation function, such as the one given in the top answer at

2025-01-08 15:22:00 +0000 received badge  Rapid Responder (source)
2025-01-08 15:22:00 +0000 answered a question Looking for strategies when Lua dissectors are getting too big

Regarding " I used up all the 200 local variables at ProtoFields, and from the looks I still have use for at least 200+

2025-01-07 17:46:47 +0000 edited answer how can we tell what update version covers which version of windows?

You can refer to the End of Support Planning table on the Wireshark LifeCycle wiki page for this information.

2025-01-07 17:45:30 +0000 received badge  Rapid Responder (source)
2025-01-07 17:45:30 +0000 answered a question how can we tell what update version covers which version of windows?

You can refer to the End of Support Planning table on the Wireshark wiki for this information.

2025-01-07 17:04:43 +0000 commented question avec win11 je ne peux pas enregistrer un fichier sur le disque dur de freebox delta

Google Translate: Question Title: with win11 I cannot save a file on the hard drive of freebox delta Question: "I can

2025-01-07 02:07:06 +0000 commented question Tracking udp stream

What capture mechanism are you using to capture packets? If it's a SPAN port, then the switch might not be mirroring al

2024-11-04 01:35:08 +0000 commented question CTF's in Wireshark.. I'll give it up..

It's unfortunate that you decided to give up. My (our) hope was to help guide you along so you could ultimately solve t

2024-10-31 16:36:56 +0000 commented question CTF's in Wireshark.. I'll give it up..

@s64470, were you able to make any progress with the hints provided so far?

2024-10-31 03:54:29 +0000 commented question CTF's in Wireshark.. I'll give it up..

That's the pcap file signature, not the file signature of the file that was downloaded via FTP. It might help to follow

2024-10-30 15:59:27 +0000 commented question CTF's in Wireshark.. I'll give it up..

Ask yourself what does the payload data start with, and then search to see what type of file signature that might indica

2024-10-16 13:41:13 +0000 edited answer small spikes(click/pop) of audio during media playback

The thing you need to be aware of is that media playback depends not only on the audio samples, but on the timely availa

2024-07-03 16:46:11 +0000 commented question tshark fails to extract RTP data from pcap even if it is available

What version of tshark are you using? Can you post tshark -v output (copyright paragraph not needed)?

2024-07-03 16:31:00 +0000 commented question tshark fails to extract RTP data from pcap even if it is available

Does adding -2 help?

2024-07-02 00:26:43 +0000 edited question Wireshark build on MacOS fails.

Wireshark build Hi everyone, I am trying to build Wireshark on a Mac and have successfully installed Qt 6.5.3, run the

2024-05-27 19:01:41 +0000 edited answer CVE-2024-24476, 78, 79

What indication do you have that these a) are valid issues and b) exist in the 4.0 branch? As far as I can tell, neither

2024-05-23 20:18:03 +0000 edited question Tshark filter issue

Tshark filter issue Hi, I have a tshark command but it does not work. Basically I use it like that: TSHARK_FILTER="\"p

2024-05-23 20:17:34 +0000 edited question Tshark filter issue

Tshark filter issue Hi, I have a tshark command but it does not work. Basically I use it like that: TSHARK_FILTER="\"p

2024-05-23 20:16:49 +0000 edited question Tshark filter issue

Tshark filter issue Hi, I have a tshark command but it does not work. Basically I use it like that: TSHARK_FILTER="\"p

2024-05-23 20:15:17 +0000 edited question I am generating a UDP packet. The data payload is interpreted by Wireshark as a ADwin_config message. What determines an ADwin_config message?

I am generating a UDP packet. The data payload is interpreted by Wireshark as a ADwin_config message. What determines an

2024-05-20 21:17:02 +0000 commented question Resolve SS7 PCs didn't work

Did you try placing it in the "Personal configuration" directory? Find that directory from the Wireshark Portable's: Ab

2024-05-13 16:24:44 +0000 commented question tshark - extract conversations (ip,tcp,udp) / endpoints with GeoIP

As reflected in the NOTES section at the bottom of the tshark man page, the online man page is for version 4.2.4 of Wire

2024-04-30 14:22:34 +0000 commented answer Does tshark has an equivalent option of tcpdump [ -z postrotate-command ]

An enhancement to dumpcap and/or tshark could possibly be made to support a postrotate command to match tcpdump's functi

2024-04-23 16:52:28 +0000 commented answer Extract dissected fields from a capture with LUA console

Right, it's the table of all extracted field values. I don't know, maybe I should have called it asdu_table instead, bu

2024-04-23 16:18:04 +0000 answered a question Extract dissected fields from a capture with LUA console

I don't know how efficient this Lua post-dissector solution is or if indeed it's bullet-proof under all possible corner

2024-04-04 03:24:22 +0000 commented answer Is there a table somewhere that tells us which versions of Wireshark are compatible with which Windows OS and Windows Server OS as well as an EOL of that version of Wireshark?

I updated the wiki page to add the missing information regarding EOS for Windows Server 2012.

2024-04-03 20:32:54 +0000 received badge  Rapid Responder (source)
2024-04-03 20:32:54 +0000 answered a question Is there a table somewhere that tells us which versions of Wireshark are compatible with which Windows OS and Windows Server OS as well as an EOL of that version of Wireshark?

Maybe https://wiki.wireshark.org/Development/LifeCycle#end-of-support-planning has the information you're looking for?

2024-03-12 14:43:08 +0000 commented answer How should I share code when I lack the karma to attach it?

This is not the answer to your question, "How should I get karma?" As @grahamb mentioned, "Karma is obtained by activit

2024-03-12 14:42:50 +0000 commented answer How should I share code when I lack the karma to attach it?

This is not the answer to your question, "How should I get karma?" As @grahamb mentioned, "Karma is obtained by activit

2024-03-12 14:40:01 +0000 commented question How should I share code when I lack the karma to attach it?

You could post the files to the wireshark-dev mailing list, along with your questions about them.

2024-02-01 17:43:34 +0000 received badge  Famous Question (source)
2024-01-30 16:19:50 +0000 received badge  Rapid Responder (source)
2024-01-30 16:19:50 +0000 answered a question What is the bracket on the left representing in the packet list pane?

If you refer to the Wireshark User Guide in section 3.18. The "Packet List" Pane, you will find Table 3.16. Related pack

2024-01-08 14:21:08 +0000 edited answer How to filter by item?

I'm not sure if this will work for the way your protocol adds the multiple messages to the tree, but if it does, the lay

2024-01-02 20:01:19 +0000 answered a question Can I disable dark mode in Windows version

There does seem to be a way to work around this issue by modifying your Wireshark shortcut. Append -platform windows:da