Guy Harris's profile - activity

In particular, read the very first word of the answer.

dont show up pleas help hi wireshark when i turn on my wireshARK it doest ask my on what connection i am for example et

It's not supposed to ask. Instead, it finds out, from the operating system, what network interfaces you have, and lets

dont show up pleas help hi wireshark when i turn on my wireshARK it doest ask my on what connection i am for example et

IEEE 802a is now section 9.2.4 "OUI Extended EtherType" of IEEE 802-2014. It's a way to provide the same capabilities a

How to install the ncap for wireshark on a galaxy S book with a 64-bit ARM that emulates a 32 bit x86 processor? I am un

Npcap currently doesn't support Windows-on-ARM; that's issue #57 on the Npcap issue list. (It includes a kernel-mode dr

This isn't a forum, it's a Q&A site; think of it as a "crowdsourced FAQ". The relevant information should be public

Please mention that somewhere in a relevant Npcap issue.

Hit:1 http://deb.debian.org/debian buster InRelease Hit:2 https://packages.microsoft.com/debian/10/prod buster InReleas

This appears to be Npcap issue #221. Report details there.

No HTTP requests in a TCP stream? (also decoding-help) So I am having an issue where I am not able to see the actual HTT

my new MacBook Air There's your problem. the en0 set with promiscuous mode and monitor mode checked, I see noth

Where can I download source code ? DECT dissector for DECT Catiq is available in this product http://www.ezutech.com/D

And, given that Wireshark is provided under the GPL, add-on dissectors must also be licensed under the GPL, and thus mus

So all packets have the default color? I tried it on my 11.2.1 VM, with a default installation of 3.4.3, and it does co

colorization isn't working MacOS 11.2.1 On WS version 3.4.3 (v3.4.3-0-g6ae6cd335aa9) colorization of any packets isn't w

I hope its okay to ask a second question here. It's best to ask each question separately. This is a Q&A site,

So what happens if, when you're not connected to a VPN, you run the command sudo dseditgroup -q -o edit -a {your user n

What does the command dscl . -read /Groups/access_bpf print?

After building libpcap, did you run make install in its source directory, as root? If you want Wireshark to be built wi

Now that it's working, does the access_bpf group show up in System Preferences > Users and Groups?

unusually many access trys Meaning "too many Google searches" or "too many failed attempts to log into your Google

That's either a crashing bug in Npcap (or WinPcap) or in Windows itself. My guess is the latter, because it crashed aft

Monitor mode capturing on Windows is, in some areas, a big ball of pain. For one thing, drivers don't do a good job of

@Chuckc: I don't know whether everybody's allowed to do this, but there's a "convert to answer" link below a comment, af

On what operating system are you capturing this?

(This is really a libpcap question, but....) The packets are always VLAN encapsulated. That means that all filters

(This is really a libpcap question, but....) The packets are always VLAN encapsulated. That means that all filters

As the new MacBook still uses the AirPort Extreme there should be a solution? Perhaps you want there to be a soluti

So the first 14 bytes of the packet are XX XX XX XX XX XX XX XX XX XX XX XX 08 00, with the XX's being the destination a

afaik there is no "native" Wireshark version for the M1 processor. Not yet - we'll need either to do a cross-build

Would it be possible to confirm if we havefull BLE decoding support in recent Wireshark versions? Yes, it would be

On what operating system is this? What version of Wireshark were you using?

But please have a look on the edit. That gives no additional information. At this point, I need to see at least s

Can you show Wireshark's detailed dissection of one of those packets? You don't need to show anything after the UDP lay

On what operating system is this? And on what version of that operating system?

So if you capture without a filter, you see traffic to and from port 30000, but if you capture with "port 30000", you do

So you're just capturing on an Ethernet or Wi-Fi interface, and you're just capturing at your home or at your office (an

wireshark io graph can't show some parameters in Y field hi One parameter in Y Field (set MAX Y Field)can't be displaye

So are you capturing on Ethernet or on Wi-Fi? From "when using a HUB or Port mirrored switch" it sounds as if it'd be E