Ask Wireshark - RSS feedhttps://ask.wireshark.org/questions/Wireshark questions and answersenCopyright Wireshark Foundation, 2017-2019Sun, 16 Jun 2019 20:02:09 +0000Finding a gap in length or idhttps://ask.wireshark.org/question/9728/finding-a-gap-in-length-or-id/ I am testing a LAN switch and I am sending packets with the length of each frame incremented by 1 from 126 to 1500 and back again. I am trying to use the incremented lengths to find a gap. All of these packets are coming from the same source, so if there is a way to find a gap in IP identifiers that would also solve my problem.
Thanks you!Tue, 11 Jun 2019 22:27:13 +0000https://ask.wireshark.org/question/9728/finding-a-gap-in-length-or-id/Answer by Bob Jones for <p>I am testing a LAN switch and I am sending packets with the length of each frame incremented by 1 from 126 to 1500 and back again. I am trying to use the incremented lengths to find a gap. All of these packets are coming from the same source, so if there is a way to find a gap in IP identifiers that would also solve my problem.</p>
<p>Thanks you!</p>
https://ask.wireshark.org/question/9728/finding-a-gap-in-length-or-id/?answer=9730#post-id-9730Maybe graph length of frames in the IO graph tool and look for a discontinuity? Do you know how to use it? Unless the gap is big, it might be easy to miss.
I would probably export the dataset and move to excel or another tool and have it calculate the length deltas for me... they should all be 1, except where a gap exists. So, graphing the delta calculation, anything above 1 would be a gap. It should stand out a little more this way.Wed, 12 Jun 2019 00:51:26 +0000https://ask.wireshark.org/question/9728/finding-a-gap-in-length-or-id/?answer=9730#post-id-9730Comment by Bob Jones for <p>Maybe graph length of frames in the IO graph tool and look for a discontinuity? Do you know how to use it? Unless the gap is big, it might be easy to miss.</p>
<p>I would probably export the dataset and move to excel or another tool and have it calculate the length deltas for me... they should all be 1, except where a gap exists. So, graphing the delta calculation, anything above 1 would be a gap. It should stand out a little more this way.</p>
https://ask.wireshark.org/question/9728/finding-a-gap-in-length-or-id/?comment=9853#post-id-9853It's possible to get other values on the graph. If you are interested, we can provide more detail.Sun, 16 Jun 2019 20:02:09 +0000https://ask.wireshark.org/question/9728/finding-a-gap-in-length-or-id/?comment=9853#post-id-9853Comment by LPF for <p>Maybe graph length of frames in the IO graph tool and look for a discontinuity? Do you know how to use it? Unless the gap is big, it might be easy to miss.</p>
<p>I would probably export the dataset and move to excel or another tool and have it calculate the length deltas for me... they should all be 1, except where a gap exists. So, graphing the delta calculation, anything above 1 would be a gap. It should stand out a little more this way.</p>
https://ask.wireshark.org/question/9728/finding-a-gap-in-length-or-id/?comment=9742#post-id-9742The I/O viewer isn't helpful because it is always bytes/sec, but exporting to excel works great!
Thanks Bob!Wed, 12 Jun 2019 12:40:12 +0000https://ask.wireshark.org/question/9728/finding-a-gap-in-length-or-id/?comment=9742#post-id-9742Answer by Christian_R for <p>I am testing a LAN switch and I am sending packets with the length of each frame incremented by 1 from 126 to 1500 and back again. I am trying to use the incremented lengths to find a gap. All of these packets are coming from the same source, so if there is a way to find a gap in IP identifiers that would also solve my problem.</p>
<p>Thanks you!</p>
https://ask.wireshark.org/question/9728/finding-a-gap-in-length-or-id/?answer=9851#post-id-9851You can do this task by different ways. 2 of them I show you.
1. You can use tshark -> Have a detailed look here https://www.youtube.com/watch?v=gMg8ttIzry0
2. You can use the "File -> Export Packet dissections -> As CSV..." dialog to export the packet pane view to a csv file. After that you can import it into excel and do some sorts or scripting around it....Sun, 16 Jun 2019 18:52:24 +0000https://ask.wireshark.org/question/9728/finding-a-gap-in-length-or-id/?answer=9851#post-id-9851