Guy Harris's profile - activity

Are you capturing on a Wi-Fi device in monitor mode?

Mac Catalina 10.15.2 crashes internet when wire shark is capturing. Once I run wireshark with a capture filter Host “ip

Why does the new version only have an adapter for loopback traffic connection and no wireless? I cant use it for anythin

I can't start the npcap either What's reported if you try to start it from the command line ("net start npf" from a

This is Windows, right?

If you're exporting CSV from Wireshark (File > Export Packet Dissections > As CSV...), rather than using -T fields

It presumably also told you where those packets came from or went to; just saying what the packets are only tells you th

What is it you're checking for? If a DIAMETER message doesn't fit entirely within one TCP segment, there will be packet

These might just be non-DCE RPC packets misidentified as DCE RPC because the heuristics Wireshark uses to recognize DCE

Note that there are no "beacons" in the Wi-Fi sense, just packets going to a domain whose name begins with "beacon-hando

HI not sure where to upload this or ask questions about what it is thanks! Packets: Frame 1321: 591 bytes on wire (4728

HI not sure where to upload this or ask questions about what it is thanks! Frame 1321: 591 bytes on wire (4728 bits), 59

HI not sure where to upload this or ask questions about what it is thanks! Frame 1321: 591 bytes on wire (4728 bits), 59

You've seen that version of Wireshark do it, or you've seen an older version do it?

Do you mean "capturing raw USB traffic over the USB bus" or do you mean "capturing network traffic over a network interf

If you run the command ls -l /Applications/Wireshark.app/Contents/Resources/share/wireshark/colorfilters in Terminal,

How to add a vendor I am trying to add a vendor to my wireshark running on Windows. I modified the dictionary.xml as fol

This is untested, but I think you have a missing </avp> closing tag in your vendor xml. In dictionary.xml you nee

The enhancement has been done, as per Gerald's answer.

Wireshark's ability to capture traffic for a given protocol largely applies only to link-layer protocols; for example, t

I interpret the link different - you will only get non-data frames if you are in monitor mode. Your interpretation

If you start up Terminal (it's in the Utilities folder inside the Applications folder), and run the command ls -ld ~/.c

You might try reporting this as an Npcap issue; others have reported similar issues with Npcap, and the more information

That's because the 1.8 release you were using was too old, and you needed a newer release. The problem here is that no

Nope, not a regression; Wireshark never handled the case where a Connect packet didn't contain the connect string, a sub

This appears to be correct, as per my comments in the bug; it appears that the Connect packet doesn't contain the connec

Update Issue Just updated to version 3.2 and installed npcap in the process. Had a version running ok with WinPCap. Wind

If you have a capture that 2.6.x dissects correctly but 3.0.x or 3.2.x doesn't dissect correctly, that is definitely a d

Given that, in the capture attached to bug 15727, the connect in frame 1809 is reported as malformed by code from the ti

The ring buffer is a mechanism in the raw binary capture code path (in dumpcap). There is no ring buffer mechanism for

The ring buffer is a mechanism in the raw binary capture code path (in dumpcap). There is no ring buffer mechanism for

The ring buffer is a mechanism in the raw binary capture code path (in dumpcap). There is no ring buffer mechanism for

Command to Capture MAC and IP addresses What command can I enter in Wireshark to capture LAN MAC addresses and LAN IP ad

Command to Capture Mac and IP addresses What command can I enter in Wireshark to capture LAN Mac addresses and LAN IP ad

What do you mean by "capture LAN MAC addresses and LAN IP addresses"? Do you mean you only want to capture traffic to o

Or what am I doing wrong? Assuming that a raw blob of data is a valid capture file. There are a number of capture

Are raw data provided by tshark full? Because display filters are not supported when saving captured data with tshark I

Or what am I doing wrong? Assuming that a raw blob of data is a valid capture file. There are a number of capture

Are raw data provided by tshark full? Because display filters are not supported when saving captured data with tshark I

By "The tool used: Wireshark." do you mean that this Web application runs Wireshark to capture the traffic?

i want to go on my wifi/Ethernet but the only thing it says is USBPcap1-4 i want to go on my wifi/Ethernet but the only

What does "won't open" mean? Did you try double-clicking on the file? If so, what happened? Did nothing happen, or wa

As Graham said, "...which should show the "START_TYPE" as "SYSTEM_START". If this isn't the case then pursue it with the

Try upgrading to Npcap 0.9986 from the Npcap site.