Guy Harris's profile - overview

● Critic   × 1

• Tshark piped and filtered

● Good Answer   × 1

• Why are multiple versions released at once

● Commentator   × 1

• Wireshark-win64-2.2.10 Cannot load interfaces for androiddump.exe on Win10

● Editor   × 1

• I cant build wireshark from sources...when make error QtGui/QAction

● Enthusiast   × 1

● Necromancer   × 1

• Updating MATE config

● Associate Editor   × 1

• Proprietary CAN dissector - dissector is never called

● Supporter   × 1

• capture data of a device on network

● Nice Answer   × 6

• What do "Frame is {marked, ignored}" mean in the packet details?
• Difference between !(ip.addr == 192.0.2.1) and (ip.addr != 192.0.2.1)
• how can I download wireshark 1.12
• What kind of HW timestamp is now supported with Wireshark 2.6.0?
• Why are multiple versions released at once
• Frame Arrival Time drift

● Rapid Responder   × 457

• How to set packet metadata in realtime?
• How can I get https to show in Wireshark?
• newbe tried to start wireshark and get the message: "(wireshark:30765): Gtk-WARNING **: cannot open display:"
• PRP Dissector and FCS
• Which version of WS supports WPA2 decryption?
• Calibrating interfaces in a Mac and collecting HTTP protocols.
• How to match ICMP Destination unreachable (Port unreachable) to original message
• Piping tshark to sed intermittently displays packet number in addition to filter.
• What is a valid LLC SNAP indicator?
• In a WiFi capture log, why the 11ac “beamformed” bit is shown as both “true” and “false” in wireshark version 2.4.2 (v2.4.2-0-gb6c63ae086)?
• Is it possible that wireshark doesn't recognize protocol?
• Is it possible to load a pcap file and view packets without loading the whole file?
• Use UDS dissector inside DoIP dissector
• How can I capture the calling process name?
• How to setup a totally new dissector for the data without UDP/TCP header
• How do I dissect packets if the dissection depends on information from earlier packets?
• Proprietary CAN dissector - dissector is never called
• Is it possible to test a capture filter with already captured traffic?
• G.hn packets docoder
• Why is Wireshark using .acp file extension for capture files in Windows when that extension is clearly for aacPlus audio files?
• How to capture UDP traffic and not NBNS traffic?
• HE radiotap support for 802.11ax
• Get field value in tap listener plugin written in C language
• What do "Frame is {marked, ignored}" mean in the packet details?
• Wireless controls are not supported in this version of wireshark
• How would I map this display filter to a capture filter?
• How to switch Mac OS NIC to monitor mode during use internet
• How to convert Pcapng file to pcap file by Tshark
• how can i see the traffic of a cell phone?
• Tshark - Notifications in the error file
• Is the (experimental) packet editor feature still available?
• Difference between !(ip.addr == 192.0.2.1) and (ip.addr != 192.0.2.1)
• Crash at Start Up, I tried all versions. I am not allowed to download anything other than Wireshark itself
• how to identify frames from which merged capture?
• I need version 1.10.9
• How can I get ver 1.1.87
• Can I use tshark with Nordic BLE Sniffer plugin to capture from command line?
• Decoding AVTP Control frames
• Gerrit code review - What does "cannot merge" mean on the bottom right?
• Connect to rpcapd service on Windows from Linux/OSX using tshark
• Writing a post-dissector: can I get the mac-address of the capturing interface?
• how can I download wireshark 1.12
• How can I export the packet bytes not as raw data, but as text?
• seprate packet lines in tshark
• What does this tag mean? Tag: Power Capability Min: 249, Max :19
• How to open CAN dbc file in wireshark
• What does SWE mean on a tcpdump Capture
• DLT_USER for DNP3
• shortcut to copy multiple lines from packet list window
• File format for SS7 PC Name Resolution
• OSX / Wireshark ~2.4.x / Nordic nRF Sniffer v2 - Crash on capture start
• windows missing horizontal scrollbar
• How to capture modbus tcp traffic on a switch
• Lua dissector memory-efficient packet reassembly
• What kind of HW timestamp is now supported with Wireshark 2.6.0?
• Only show reassembled packets instead of frames
• How to use the j1939 dissector?
• the capture file appears to be damaged or corrupt(netscreen:too much hex-data)
• What happened to reassemble_tcp?
• Decode TURN Traffic as RTP
• Can I run Wireshark on my Desktop PC?
• Difference between ipv4 and ICMP packet
• Trying to setup filter for a specific IP address
• Why is wireshark 2.6.1 forcing a specific keyboard layout on macOS when started with sudo?
• BTLE define custom UUID, Chars, and Handles?
• How do I view the details of an mmse content in v2.6.1 in the same way as they are displayed in v1.8.15?
• how does wireshark identify two or three packets that belong the same tcp segment
• changing link-layer header in the capture interfaces
• What is a field type of label?
• discord app
• How to make Wireshark decompress an already decrypted HTTP2 capture?
• tshark displays Hebrew (and other non-ISO 8859/1) characters in SMB file names as question marks
• When I open the Telephony- VoipCalls Wireshark crashes
• Capture from only one Port in wireshark and tshark
• tshark to write packets to text file every minute?
• Link layer header type for serial/UART communication
• How to capture filename (path) for NFSv4 traffic using tshark
• Question why is tshark ignoring diameter AVP Policy-Counter-Identifier?
• Get CPU and Memory usage of a Wireshark Capture
• Dissector plugin dissector_add clarification
• Under what source folder is the code to edit the statistics tab of the UI?
• How can be create a filter for a particular label ?
• tshark packet data not displaying
• tshark: How do I convert pcap to compressed pcapng?
• How to get a web address through a packet
• How to see the hostname and the URI requested for?
• Find asymmetric streams (tcp.stream with client but no server packets)
• eapol malformed packets
• Lightweight tshark?
• How can I best compare two profiles?
• editcap and per-file comments in pcapng files...
• registering two protocol plugin sharing a same port
• Which install package do I use to install on Linux?
• Force DPLAY dissector
• Students unable to see anything when starting on school lab wireless-connected Windows machines
• Pipe with comments
• How to capture packets using Wireshark in a switched ethernet network?
• I can't get the eth.ig==0 display filter to work
• Capturing traffic from device not supporting wifi router radio type
• Custom column operators
• What does options field mean in IP header?
• i have wireshark on mojave for my mac and the buttons at the top of the screen seen on other versions of wireshark aren't there so i can open files or edit my filters
• Secure Reliable Transport
• preference range
• When I look at a time-to-live exceeded ICMP message (type 11), it contains extra data. what is that data and why does it contain it?
• dumpcap using frame contains and write to file
• Update the Wireshark OUI manufacturer database?
• Wireshark for Mac
• "x" letter wireshak voip calls capture
• "SSL decode as" for more protocols
• does Wireshark have a VPAT
• What does the output of "arp -a" on Windows mean?
• New versions of Wireshark no longer working on unpatched Windows system( api-ms-win-crt-runtime-l1-0.dll )
• Monitor-mode frames in "any"-device captures on Linux aren't dissected correctly
• Capture Filters - What am I doing wrong?
• Trying to write Java raw InputStream data as PCAP to view in Wireshark
• How can I see the interface name and DLT for a packet in Wireshark
• How to enable V2G protocol(DIN70121 and ISO15118)?
• Libpcap behavior on virtual NIC
• http.time using tshark
• vlan capture filter ineffective
• Only capturing usb protocols
• Frame Arrival Time drift
• Is there a way to capture image files via Wireshark?
• What is the difference between wlan.duration and wlan_radio.duration
• Where and can I download wireshark on linux
• Confused about wifi sniffing
• How can I export my hexdump to a file that contains the data in a binary format?
• Capturing on DPDK interface
• how do you read wireshark capture files?
• flow chart save as PDF issues
• How do I show the PDML "geninfo" information in the packet details?
• unrecognized libpcap format error message
• what is the baseline of the 802.11 wireless network retransmission rate?
• Large RTP packet analysis - Wireshark misreporting statistics
• Capturing CDP packets over USB C?
• Why doesn't wireshark dissect packets that have both retransmitted and new data?
• Destination address confusion with wireshark
• Wireshark for Chromium OS?
• no packets captured in monitor mode
• When I try and use the "ip broadcast" capture filter it says "netmask not known, so 'ip broadcast' not supported"?
• cara membaca hasil summary di wireshark 1.12.7
• how to read the summary results in Wireshark 1.12.7
• 00:00 Source Address 00:00 Destination Address 0x0000 Protocol 342 length
• Why sometimes Wireshark restarts after a profile change?
• Wireshark on MacOS Mojave crashes when setting SSL key in protocols
• Usb-Audio Midi dissector not working properly
• Response times = delta times after reordering (sorting) the row values.
• filtering open ports on wireshark
• User Guide Version Numbers
• 2 IP Sources & Destination on the same packet ?
• Understand when Wireshark is active on an interface on Linux
• uninstall - mmdbresolve.exe could not be removed
• Reviewing a pcap how do i uncover version of php running?
• "Trailing stray characters" warning
• Tshark command to output the original source and destination IPs of an icmp.type==3 code==4 packet.
• My modified tshark fails with "file type short name already exists"
• capture filter "vlan and stp" showing nothing
• Not able to Capture packets on Remote Interface
• I have Windows Server 2008; where can I get Wireshark 2.2?
• Decryption of OPC UA
• how can i add additional preferences for some protocols programmically?
• Why is a dissector called multiple times?
• Decoding Micropross mplog files
• Using Tshark to remove malformed packets
• specific layer protocols
• 1576 bytes on wire, 790 bytes captured!
• sshdump does not connect and provides no error
• What does "absent" mean on some fields of the radiotap header?
• ARP transmission delays promiscuous capture (libpcap/wireshark)
• Is it possible to capture packets on all available interfaces simultaneously?
• pcap_dispatch hangs when interface down
• Stop live capture command line osx
• What are these packets with an Ethertype of 0x0e00?
• What are these packets with an Ethertype of 0x0e00?
• Send wireshark capture directly to a file
• Remote capture support for Mac
• Why are there 3 active versions of Wireshark
• Why are multiple versions released at once
• Tshark capture filter using VLAN ID
• tshark capture and filter HTTP in WPA2 secured network
• Are there any plans to add GCP-RPHY decodes?
• tshark tmp file not stop growing
• How to decode ERSPAN-without-a-header in Wireshark 2.6 and later?
• What are possible reasons the source and destination showing as N/A in this PPP traffic?
• Npcap 0.992 lost net connection
• Do you support USB Ethernet adapters?
• How can I hide the Ethernet and IP protocol layer packet display in Wireshark?
• How do WireShark capture Wi-Fi ?
• What's causing the performance issue with Citrix here?
• Wireshark sees Ethernet LLC, but packet is probably Ethernet raw
• Is there a way on macOS to tell Wireshark to use more CPU/memory
• Why is Wireshark reporting Skype traffic on a network with no Skype traffic?
• Infer machine boot time/up-time from network packets?
• Mac and Windows different versions of wireshark?
• Export to text with tshark
• How does mac os open multiple cap packets?
• How exactly does tshark -z hosts come up with the list?
• Is wireshark capable of decoding MBO IE - oui 50:6f:9A oui type=0x16
• Has anyone else noticed that the Wi-SUN FAN decoder incorrectly decodes the Explicit Channel Plan?
• How does wireshark read TCP headers
• How to add some field to decode netflow
• Installation of version 3.0.2 fails due to vcredist_x64.exe location.
• File Downloads using Chrome are much slower than Microsoft Edge
• How to get all tcp-stream by passed filter?
• Looking to debug 802.3AT PoE+ LLDP power class negotiation frames exchanged between a Non-Cisco PoE-Plus Powered device and a Cisco switch
• snmp v3 not decoding properly
• How do I select the driver?
• Custom sub protocols registering with a custom protocol's dissector table
• How to call a Wireshark plugin protocol dissector programmatically?
• USB Capture Of Ethernet Traffic Using Sharktap
• How to properly use heuristic dissector for TCP
• Does Wireshark have to be run in kernel mode (system mode) on Red Hat Enterprise Linux?
• Ethernet hardware loopback
• Why is my computer sending hundreds of SSDP packets to the same IP?
• wireshark causes NO receive errors with UDP
• From where does wireshark get the traffic? Where does it reside?
• how to move wireshark to system tray when it is minimized
• issue with Mellanox NIC on recent Ubuntu
• Large Capture Filter
• Regarding APIs changes/replacement in Latest Version in wireshark
• Is it promiscuous mode doing this?
• Loopback npcap added in Win10 network
• If there is no network, copying data to DVD comes under which OSI layer? Can we even categorize into OSI protocols?
• I can't capture 802.11 on wireshark
• When will the downloads page documentation be updated to remove WinPCAP and replace with NPCAP (with current version number) as the stated packet capture tool?
• use ip address to capture traffic?
• Extend the Homeplug AV protocol
• reading .txt files transferred in an FTP capture
• IPv4 total length exceeds packet length - always 8.0.69.0!
• Adding a protocol between ethernet and IP
• Protecting a proprietary protocol
• tcp_dissect_pdus warning message
• In get_foo_message_len(...) - What value is passed into offset?
• How many times does tcp_dissect_pdus get called?
• Parsing Wireshark Capture Files
• layer 2 protcol value
• in TCP Follow Stream Window, can support of CP1252 encoding be added
• TCP reassembly - How do you determine the PDU length when there is no length field?
• Tshark piping issue
• Win10Pcap and Panda USB PAU06
• Don't mask non-printable characters (Windows)
• The capture session could not be initiated on interface '\Device\NPF_Loopback' (Error opening adapter: Er is een niet-bestaand apparaat opgegeven. (433)).
• dumpcap -a duration:XX not working when capturing from Napatech card
• how to download latest wireshark version dynamically?
• Citrix ADC (NetScaler) Metric Exchange Protocol
• Why isn't Wireshark marked as malware by Antivirus?
• How can I capture Bluetooth packets without any dongle by macOS?
• Help needed converting text file from FortiGate to pcap
• unable to sniff Windows 10 bridge
• Homeplug AV
• Can I monitor all http on OSX within LAN?
• Can't no longer find Quic/Gquic protocol on Wireshark analysis
• What is the community policy in respect of plugins?
• How do you wireshark wireless body area networks?
• AskBot sort by activity does not consider comment times
• Problem with tshark and plain text output with column names
• Capture/Display Filters
• Wireshark 3.1 freeze under macOS Catalina
• Does uninstallation of wireshark in RHEL requires a reboot?
• Parsing LLDP exported to JSON (or XML) has problems
• How do I get "Local Area Connection" to show up as an interface in Wireshark on Linux?
• Positive value of antenna signal
• How can I display DNS time to live (TTL) in Days Hours Minutes Seconds format?
• how can i get the source code with GUI for windows Op?
• If someone calls my iPhone and I answer it through my IPad, can Wireshark collect packets from that transmission?
• How to read mentioned packet logs?
• How can I find clients that are using SMB1?
• 802.11 decryption on Wireshark 3.0.7
• rsyslog RSH packet
• radiotap.mcs.format erroneously = greenfield (1)
• How can I read a hex dump of packet data from TShark, filter it with a Python program, and write it out as a capture file?
• No adapters are listed after upgrade to 3.2 with Npcap; Npcap FixInstall.bat reports error
• TEXNET Protocol
• HI not sure where to upload this or ask questions about what it is thanks!
• DCE/RPC Remote Procedure Call
• Excel - how to show date & time correctly?
• how do i capture packets from only 1 IP address
• No HTTP protocols in Captured Scan
• Is wireshark available to be used on Android
• canfd in pcapng file
• Has anyone worked out how to save a pcap with shifted (interpolated/extrapolated) timestamps?
• Should packet dissection be made multi-threaded?
• Are there plans to add dark theme support?
• Error 995 Report
• Why am I seeing no interfaces other than "Adapter for Loopback traffic capture" on my Windows system?
• Wireshark source repository not found
• Why do I get "Can't get list of interfaces: message payload is too short" when trying to add remote interfaces?
• WS 3.2 on Mac: ring buffer file permission and file extension
• WLAN setup only seeing local & broadcast traffic in promiscuous mode
• How to export resolved host addresses in 3.2.2 ?
• Wireshark build error
• If a request is being sent via unicast or broadcast, would that show in the destination or source address?
• make and ./configure don't work
• What's a display filter that only shows packets with a particular UDP source port number?
• How Can I Display as Much Pcapng Information As Possible?
• Why is there no bluetooth-monitor device on Linux Mint?
• How Can I view Pre-Frame Data?
• Feature request in Wireshark: lua, zlib (and other compr libs)
• How do I get information about the processes corresponding to TCP and UDP endpoints?
• Game crashes when opening Wireshark
• Wireshark not capturing any web traffic
• RFC8613 Object Security for Constrained RESTful Environments (OSCORE) defines the Coap Option number 9 as OSCORE Option. Wireshark seems to use the number 21 instead. Is there a newer Wireshark version that will follow RFC8613?
• Unable to open Capture taken with IXIA
• Merge binary data of multiple packets
• How can I capture network traffic from my smart TV?
• Why does Wireshark not capture any data when in monitor mode on my Mac?
• How would I use MAC address to locate router
• What Is The Endianness of Captured Packet Headers?
• dumpcap -k is not accepting channel type values on macOS
• Wireshark equivalent of TSecr?
• Help! Asking a question causes Internal Server Error.
• How can I find an IP address for unknown equipment?
• lua plugin calling built-in dissector, does not pass pkt data to it
• 30 minutes to download a 50Mo file in 2020 lmao
• What's a capture filter that captures only RIP and OSPF packets?
• Tshark export object with IPs
• Not able to compile packet-pkcs12-template.c
• Can I check network advertising calls (pubad, confid, krux etc..) using Wireshark?
• Problems post install with npcap killing network connection
• Can a capture be saved in files on multiple drives?
• Where Can I Find The Packet Display Stream File(s)
• Unable to connect to network when Npcap Packet Driver is enabled
• Sniff usb with non-root user under Ubuntu 18.04
• How to enable rpcap support in linux version
• Wireshark 3.2.3 appeared to have corrupted my network connections
• Is there a plan to support SRv6 service TLV?
• How to read a specified packet in hex and ASCII?
• Wireshark doesn't recognize TWAMP-Test packets
• Uninstall/Reinstall 'corrupts' windows 7 network stack
• Converting Pcap file to CSV file while defautly keeping all features/fields defined in pcap
• Dissector that decodes payload on another layer
• can wireshark capture the packet from 40Gb Ethernet?
• Wireshark OUI Lookup Tool Broken
• What is this TCP error telling me?
• dumpcap - get packet drop report periodically
• Decrypt FTP login?
• Wireshark Freezes During WAN Speed Tests
• Not seeing EtherNet/IP traffic
• capture ntlm traffic
• Wireshark does not read padding
• How to use custom protocol with text2pcap?
• How do you get tcp flags in another dissector
• wireshark enabled "promisc" mode but ifconfig displays not
• can i search for certain port destinations im trying to make it easier to find
• I have connection problems after installing wireshark and using it for literally 5 minutes.
• Help installing PCAP WPCAP in Windows 7 64 bits (syswow64-system32)
• Ethercat Frames are not being recorded due to Symantec EP
• RSSI / Signal Strength
• I can't see the interfaces of my computer
• Merge regular text logs (as info) and packet captures
• NMEA 2000 Packet Capture
• Access to previous frame
• Seeking Example for Protocol Encapsulating IPv4
• Capitalising hex strings in dissector field output?
• tshark - Flag to remove index entry from ek output format
• Type for Dissecting n-bit Quantities
• How Can i edit pcap files in wireshark
• How to find the model number of a printer in wireshark
• Why am I not seeing any zero-length TCP segments in one capture file?
• how to enable monitor mode on mac?
• Capture Filter for FRAMES
• Is it possible to detect what is blocking port 80
• tshark with --export-dicom gives “Segmentation fault (core dumped)”
• How can I get Wireshark to show me the packed VLAN and Priority tag?
• How to Determine Low Level Filter
• How to Determine Low Level Filter
• Editcap not found on mac osx
• Single line JSON output for tshark
• Different versions of SIP packets on local and remote site?
• TFTP packet size and MTU
• Why I cannot see anything when I use this wlan.fc.type filters?
• can wireshark write files to Alcatel DMX 1665 via the LNW2 card?
• How frame number determined
• Monitor mode capture on macOS Catalina is not seeing any packets
• Does USBPcap not capture USB Hub Class transfers?
• Continuous counting of packets on a port
• Format column display
• Starting wireshark with a particular column ordered?
• No Data Packets in Monitor Mode Capture
• lua dissector absolute time
• Not seeing iSCSI traffic in an Infiniband RRoCE capture without initial ConnectRequest/ConnectReply/ReadyToUse sequence
• Wireshark Promiscuous Mode not working on MacOS Catalina
• After uploaded to 3.2.6 ver there is usbcap interface only
• check udp payload in wireshark
• what is the function of /epen/dissectors of wireshark 2.2.1??
• Why am I seeing "J%C3%A4%C3%A4kaapi" rather than "jääkaappi"?
• capture serial data using USBPcap
• Wireshark only showing me 3 digit ips
• Can't capture now, but could before. MacOS Catalina
• wireshark dissect message again when I click the message
• Where is the FCS field shown in the WireShark output?
• Npcap loopback adapter not showing in Windows > Network Connections
• 'Telephone-event' in RTP Payload
• SMB2: Incorrect padding in pcap
• Wireshark For External URL?
• Which version should I download on new Mac pro with new m1 chip
• How do I know what the upper layer protocol is above TCP or UDP?
• Ethernet padding in 802.11 packets
• Promiscuous mode not working on my Wi-Fi network
• Segmentation fault (core dumped)
• Promiscuous mode and switch
• How to add a column from ProtoField value
• Is there a way to view what machine utilized the packet capture for the trace file?
• Not able to capture bridge connection. The capture session could not be initiated on interface
• Is there an update for 2.6.20?
• Is there an update for 2.6.20?
• Load dll dissector from Windows to Linux
• cmake error with source 3.4.2 on (k)ubuntu 20.04
• what is the best way to clean up in extcap?
• Bluetooth traffic not seen by Wireshark on Windows
• Homebrew indicates [email protected] is now deprecated - will [email protected] be integrated?
• After I installed Wireshark on Windows, my Ethernet shows up as an "unidentified network"
• Get 802.11 frames while associated with network
• How to filter packets with BPF in a C++ program when they're not read from a live capture or pcap/pcap-ng file?
• Blue Screen while saving 1-hour capture
• problem getting traffic on wifi network between smartphone and printer on a Mac- monitor mode problem
• Internet ethernet not working until starting capture on win10
• Building on Debian 10 - gcrypt not found?
• How to install Npcap for wireshark on a galaxy S book with a 64-bit ARM that emulates a 32 bit x86 processor?
• IEEE802a OUI Extended Ethertype
• Wireshark doesn't ask what connection (Ethernet, Wi-Fi, etc.) I'm on when it starts up
• "No buffer space available" reported when capturing high-volume traffic on nflog device on Linux
• "Can't set promiscuous mode" reported on Snapdragon X55 mobile phone modem on Windows
• what is maximum frame size?
• [Converting PCAP file] Changing encapsulation type from NFLOG to Raw IP
• Is my methods to view data in this UDP Protocol correct?
• Remove Remote Interfaces
• What's the filter for a DNS query for type DS?
• Unable to capture packets on Surface Mobile Broadband adaptor
• packet block queue option length 8 is not 4
• I have problem when update plugins for latest version of Wireshark
• Highlight or color packet detail item if it caused the display filter to match the packet
• How do I resolve system error 31 when trying to start the npcap service on Windows?
• without nghttp2
• tshark Tek options not human readable
• reading pcap files with nanosecond precision
• I only need the data of OICQ protocol, but the filtering protocol does not seem to be effective
• I only want to get UDP packets with source port 8000
• dissector bug h265
• How to increase capture length ("frame.cap_len") when using Wireshark for USB sniffing on Ubuntu?
• Does Wireshark supports Urdu National Language Locking Shift Table
• Frame number & Frame time & Frame.time_delta
• Error message msvcp140.dll
• can wireshark capture packets sent by a thunderbolt ethernet adapter
• interface XHC20 does not exist (still)
• iOS app capture
• Is it possible to publish the signatures file with each release set instead of only the signature file for the current main release?
• Can wireshark be used with usb to ethernet adapters?
• Dissector: register a name for a ethertype
• Wireshark reassembly stops working after "TCP previous segment not captured"
• What is the difference between packet Inter arrival time and time delta from previous captured frame.
• Wireshark not displaying packets on my LAN for iPhone
• Dissector doesn't see retransmission packets
• How do I let the user specify for which UDP ports a dissector should be used?
• zipcode of network
• Please fix in-app upgrade

● Organizer   × 1

• How to see the FCS in Ethernet frames?

● Teacher   × 1

• How can I get https to show in Wireshark?