Guy Harris's profile - activity

Is there a dissector already created for this purpose? Wireshark has an LLDP dissector. If so, is it able to id

filters do not seem to work I would like to upload a picture but I get error:" details must have > 10 points" Anywho

Unfortunately, there's currently no filter to check for that (unlike, for example, checking for the time between the ini

A display filter of http.user_agent contains "string" where "string" is something that {Chrome, Edge} puts into the U

What was the exact text of the error message?

...where "packet" means "link-layer frame" in this context. There are protocols where more than one PDU for that protoc

That won't work. file:/// URLs are URLs that refer to local files, and work only on your machine. I infer from the "On

The appropriate place to report problems - especially if you have a solution you're proposing, as in this case - is the

My take is that Wireshark capture filters use the Berkeley Packet Filter syntax Yes, given that Wireshark (dumpcap,

Nothing inherently prevents capture filters from existing for Bluetooth LE. To support it would require 1) whatever sof

How can I call proto_tree_add_format_wsp_text() in my dissector I am trying to make a call to proto_tree_add_format_wsp_

I want to call methods from proto.c in my dissector. What library or dll do I need to link to. I am using Windows platfo

Do you mean "how do I find packets that have a given number, in ASCII, somewhere in the packet?"

What do you mean by "shark"? Do you mean Wireshark, TShark, or some other program?

Perhaps the menu item should be renamed "Show Field Bytes", as it doesn't show all the bytes of the entire frame selecte

That's a separate question, and should be asked separately. (This is a Q&A site - think of it as a crowdsourced FAQ

As Spooky notes, this would require code changes. You should submit an enhancement request on the Wireshark Bugzilla fo

I had the sneaking feeling the "M" could also stand for "Military". :-) (The "United States" in the specification name

My textbook knowledge tells me that the AP is a layer 2 device. So how does the trace collected from the AP provide a

Wireshark no longer supports autotools, so current releases do not include a configure script. You need to install CMak

And if it still doesn't work, file a bug against npcap as an nmap issue on GitHub.

What is the format of the data going over the serial port? Is it in the form of raw Ethernet packet data, with one 8-bi

how to change packet length in the packet header for every incoming packet I am getting "Frame 1 too long(18109400 bytes

pcap_hdr_tr.magic_number = 0xd4c3b2a1; As per the pcap-savefile man page, the magic number is 0xa1b2c3d4, no 0xd4c3b

pcap_hdr_tr.magic_number = 0xd4c3b2a1; As per the pcap-savefile man page, the magic number is 0xa1b2c3d4, no 0xd4c3b

What program is writing the headers to the pipe? That program may be buggy. What happens if you run the program, send

Again, I would STRONGLY suggest that you report this as an Npcap issue. Most Wireshark developers have no knowledge of

Is the "traffic" you're searching for keywords the SMTP protocol's commands and responses or the contents of the message

...because it's also a separate project from Wireshark. File a bug report at the map GitHub site, using the link Graham

Either 1) you really do have packets that large or 2) somehow the file you're trying to read got damaged, and there may

TSL dissectors missing in "decode as" feature (ex: TPKT) Hi. I've been working with Wireshark quite a bit, and when I co

Libpcap discards the "thiszone" value, dating back to libpcap 0.4 (i.e., a LONG time ago), so tcpdump doesn't know it or

File a bug on the Wireshark Bugzilla, then.

I m not able to upload screen shots as it needs 60 points. Jaap said "share a capture file", not "share a screensho

So what is the issue and where is the trace? Without that, we can't give you any help.

See the CaptureSetup/Ethernet page on the Wireshark Wiki for more information on capturing on switched networks.

The "V" in "VLAN" stands for "virtual"; ultimately, on an Ethernet network, a machine is plugged into a physical LAN, so

From a quick look at the source, the answer appears to be "no".

Just DNS packets, from a quick look at the code; we don't use NBNS traffic to get NetBIOS names.

Wireshark does not support having multiple capture files open in the same process, so it can't fully function as a stand