Ask Your Question

Guy Harris's profile - activity

2020-01-27 02:59:01 +0000 commented question Mac Catalina 10.15.2 loses Internet connection when Wireshark is capturing.

Are you capturing on a Wi-Fi device in monitor mode?

2020-01-27 02:58:38 +0000 edited question Mac Catalina 10.15.2 loses Internet connection when Wireshark is capturing.

Mac Catalina 10.15.2 crashes internet when wire shark is capturing. Once I run wireshark with a capture filter Host “ip

2020-01-26 01:28:26 +0000 edited question With Wireshark 3.2 on Windows with Npcap, the only interface is the loopback interface

Why does the new version only have an adapter for loopback traffic connection and no wireless? I cant use it for anythin

2020-01-25 23:45:29 +0000 commented answer With Wireshark 3.2 on Windows with Npcap, the only interface is the loopback interface

I can't start the npcap either What's reported if you try to start it from the command line ("net start npf" from a

2020-01-25 20:04:04 +0000 commented question With Wireshark 3.2 on Windows with Npcap, the only interface is the loopback interface

This is Windows, right?

2020-01-25 18:51:29 +0000 received badge  Rapid Responder (source)
2020-01-25 18:51:29 +0000 answered a question Excel - how to show date & time correctly?

If you're exporting CSV from Wireshark (File > Export Packet Dissections > As CSV...), rather than using -T fields

2020-01-25 18:33:09 +0000 commented answer HI not sure where to upload this or ask questions about what it is thanks!

It presumably also told you where those packets came from or went to; just saying what the packets are only tells you th

2020-01-25 04:07:32 +0000 commented question How to see / check reassemble(d) the tcp packets

What is it you're checking for? If a DIAMETER message doesn't fit entirely within one TCP segment, there will be packet

2020-01-24 03:37:57 +0000 answered a question DCE/RPC Remote Procedure Call

These might just be non-DCE RPC packets misidentified as DCE RPC because the heuristics Wireshark uses to recognize DCE

2020-01-24 03:37:57 +0000 received badge  Rapid Responder (source)
2020-01-24 03:32:59 +0000 received badge  Rapid Responder (source)
2020-01-24 03:32:59 +0000 answered a question HI not sure where to upload this or ask questions about what it is thanks!

Note that there are no "beacons" in the Wi-Fi sense, just packets going to a domain whose name begins with "beacon-hando

2020-01-23 23:32:23 +0000 edited question HI not sure where to upload this or ask questions about what it is thanks!

HI not sure where to upload this or ask questions about what it is thanks! Packets: Frame 1321: 591 bytes on wire (4728

2020-01-23 23:31:37 +0000 edited question HI not sure where to upload this or ask questions about what it is thanks!

HI not sure where to upload this or ask questions about what it is thanks! Frame 1321: 591 bytes on wire (4728 bits), 59

2020-01-23 23:29:53 +0000 edited question HI not sure where to upload this or ask questions about what it is thanks!

HI not sure where to upload this or ask questions about what it is thanks! Frame 1321: 591 bytes on wire (4728 bits), 59

2020-01-21 01:38:45 +0000 commented question Packet list window not displaying textual FIX message type in 'info' field consistently

You've seen that version of Wireshark do it, or you've seen an older version do it?

2020-01-17 19:43:40 +0000 commented question packet capture via usb is not happening in windows 7 and 10.any alternative for this issue

Do you mean "capturing raw USB traffic over the USB bus" or do you mean "capturing network traffic over a network interf

2020-01-17 19:42:31 +0000 commented question WS 3.2 for Mac has permissions problems for other users

If you run the command ls -l /Applications/Wireshark.app/Contents/Resources/share/wireshark/colorfilters in Terminal,

2020-01-17 19:41:10 +0000 edited question How to add a vendor to the Diameter dictionary

How to add a vendor I am trying to add a vendor to my wireshark running on Windows. I modified the dictionary.xml as fol

2020-01-17 19:40:52 +0000 edited answer How to add a vendor to the Diameter dictionary

This is untested, but I think you have a missing </avp> closing tag in your vendor xml. In dictionary.xml you nee

2020-01-15 22:36:15 +0000 commented answer how to download latest wireshark version dynamically?

The enhancement has been done, as per Gerald's answer.

2020-01-14 19:34:23 +0000 answered a question TEXNET Protocol

Wireshark's ability to capture traffic for a given protocol largely applies only to link-layer protocols; for example, t

2020-01-14 19:34:23 +0000 received badge  Rapid Responder (source)
2020-01-07 01:48:36 +0000 commented answer Can I capture internet traffic between an AP and a connected wireless device when in monitor mode?

I interpret the link different - you will only get non-data frames if you are in monitor mode. Your interpretation

2020-01-07 01:46:38 +0000 commented question I have install on my Mac Mojave 10.14 but it shows multiple error like permission denied , could not create profiles directory , lots of permission are denied

If you start up Terminal (it's in the Utilities folder inside the Applications folder), and run the command ls -ld ~/.c

2020-01-04 00:40:12 +0000 received badge  Rapid Responder (source)
2020-01-04 00:40:12 +0000 answered a question No adapters are listed after upgrade to 3.2 with Npcap; Npcap FixInstall.bat reports error

You might try reporting this as an Npcap issue; others have reported similar issues with Npcap, and the more information

2020-01-03 22:24:31 +0000 commented answer Oracle DB request connection packets always identified as malformed

That's because the 1.8 release you were using was too old, and you needed a newer release. The problem here is that no

2020-01-03 22:23:23 +0000 commented answer Oracle DB request connection packets always identified as malformed

Nope, not a regression; Wireshark never handled the case where a Connect packet didn't contain the connect string, a sub

2020-01-03 22:22:30 +0000 commented answer Oracle DB request connection packets always identified as malformed

This appears to be correct, as per my comments in the bug; it appears that the Connect packet doesn't contain the connec

2020-01-03 22:20:04 +0000 edited question No adapters are listed after upgrade to 3.2 with Npcap; Npcap FixInstall.bat reports error

Update Issue Just updated to version 3.2 and installed npcap in the process. Had a version running ok with WinPCap. Wind

2020-01-03 19:38:10 +0000 commented answer Oracle DB request connection packets always identified as malformed

If you have a capture that 2.6.x dissects correctly but 3.0.x or 3.2.x doesn't dissect correctly, that is definitely a d

2020-01-03 19:33:13 +0000 commented answer Oracle DB request connection packets always identified as malformed

Given that, in the capture attached to bug 15727, the connect in frame 1809 is reported as malformed by code from the ti

2020-01-01 04:19:19 +0000 edited answer can tshark rotate logs when using json output (-T ek)?

The ring buffer is a mechanism in the raw binary capture code path (in dumpcap). There is no ring buffer mechanism for

2019-12-31 20:37:52 +0000 edited answer can tshark rotate logs when using json output (-T ek)?

The ring buffer is a mechanism in the raw binary capture code path (in dumpcap). There is no ring buffer mechanism for

2019-12-31 20:34:59 +0000 answered a question can tshark rotate logs when using json output (-T ek)?

The ring buffer is a mechanism in the raw binary capture code path (in dumpcap). There is no ring buffer mechanism for

2019-12-31 04:07:57 +0000 edited question Command to Capture MAC and IP addresses

Command to Capture MAC and IP addresses What command can I enter in Wireshark to capture LAN MAC addresses and LAN IP ad

2019-12-31 04:07:49 +0000 edited question Command to Capture MAC and IP addresses

Command to Capture Mac and IP addresses What command can I enter in Wireshark to capture LAN Mac addresses and LAN IP ad

2019-12-31 04:07:30 +0000 commented question Command to Capture MAC and IP addresses

What do you mean by "capture LAN MAC addresses and LAN IP addresses"? Do you mean you only want to capture traffic to o

2019-12-31 04:06:19 +0000 edited answer How can I read a hex dump of packet data from TShark, filter it with a Python program, and write it out as a capture file?

Or what am I doing wrong? Assuming that a raw blob of data is a valid capture file. There are a number of capture

2019-12-31 04:05:19 +0000 edited question How can I read a hex dump of packet data from TShark, filter it with a Python program, and write it out as a capture file?

Are raw data provided by tshark full? Because display filters are not supported when saving captured data with tshark I

2019-12-31 04:03:50 +0000 answered a question How can I read a hex dump of packet data from TShark, filter it with a Python program, and write it out as a capture file?

Or what am I doing wrong? Assuming that a raw blob of data is a valid capture file. There are a number of capture

2019-12-31 04:03:50 +0000 received badge  Rapid Responder (source)
2019-12-31 03:59:33 +0000 edited question How can I read a hex dump of packet data from TShark, filter it with a Python program, and write it out as a capture file?

Are raw data provided by tshark full? Because display filters are not supported when saving captured data with tshark I

2019-12-31 03:58:11 +0000 commented question What is this called?

By "The tool used: Wireshark." do you mean that this Web application runs Wireshark to capture the traffic?

2019-12-30 04:18:44 +0000 edited question The only interfaces that show up on my Windows machine are USBPcap1-4

i want to go on my wifi/Ethernet but the only thing it says is USBPcap1-4 i want to go on my wifi/Ethernet but the only

2019-12-30 04:17:55 +0000 commented question I have a set of PCAP files with sample ICS protocols but they won't open on my windows wireshark install

What does "won't open" mean? Did you try double-clicking on the file? If so, what happened? Did nothing happen, or wa

2019-12-27 22:08:01 +0000 commented answer Why do I keep getting the error, "No interfaces found"?

As Graham said, "...which should show the "START_TYPE" as "SYSTEM_START". If this isn't the case then pursue it with the

2019-12-26 23:24:25 +0000 commented question Why do I keep getting the error, "No interfaces found"?

Try upgrading to Npcap 0.9986 from the Npcap site.