NJL's profile - activity

Output discards are typically because there's more data to transmit than the receiver is capable of receiving. This coul

Thanks for the suggestion, but unfortunately it doesn't work either. The "native" Apple way of enabling sniffer mode wor

Yes and yes.

Ok, the shortcut to Sniffer mode worked, but I couldn't find a way to get out of it again - apart from a complete restar

Same problem for me. Brand new MacBook Pro 15" with Wireshark 3.0.6. I can capture without the tap header (useless), but

I doubt this is something Wireshark can solve - unless they change their code significantly and include "New Tab" or sim

Not sure it's what you want, but wouldn't you be able to use the "frame[POS] == hex-value" filter?

Actually you can use Page Up and Page Down on Mac: use Fn + Up or Fn + Down. First hit on search engine of your choice:

Actually you can use Page Up and Page Down on Mac: use Fn + Up or Fn + Down. First hit on search engine of your choice:

Actually you can use Page Up and Page Down on Mac: use Fn + Up or Fn + Down. First hit on search engine of your choice:

Actually you can use Page Up and Page Down on Mac: use Fn + Up or Fn + Down. I'd recommend that you filter your traces

Actually you can use Page Up and Page Down - use Fn + Up or Fn + Down. I'd recommend that you filter your traces using

First hit from your search engine of choice: https://osqa-ask.wireshark.org/questions/54036/open-multiple-captures-on-m

I don't know the internals of Wireshark to be able to answer your question in detail, but I'm speculating that the reaso

I don't know the internals of Wireshark to be able to answer your question in detail, but I'm speculating that the reaso

I don't know the internals of Wireshark to be able to answer your question in details, but I'm speculating that the reas

Time is when the packet was captured i.e. a fixed value. Delta time is the time between packets - e.g. the time between

Time is when the packet was captured i.e. a fixed value. Delta time is the time between packets - e.g. the time between

Time is when the packet was captured i.e. a fixed value. Delta time is the time between packets - e.g. the time between

Thanks for the capture files, however they would be much more useful if you include the TCP handshake. Can you please re

In the sender.pcapng file, it's clear that 10.92.48.68 for some reason is incapable of processing the incoming data. Loo

Not at this time, no. I'm trying to get more information, so I will hopefully know more by tomorrow.

TCP Acked Unseen segment is Wiresharks way of informing you that in the capture you see ACKs for packets that were not s

Packet capture should be available here: https://drive.google.com/file/d/1kdiS9bVbBsstfT6JL3K0teD9UZXUkheD/view?usp=driv

Remember you can filter a separate TCP session by right-clicking -> Conversation Filter -> TCP. This can then be e

Correct, a retransmission is based on the Retransmission Time Out (RTO) timer set by the OS and typically adjusted conti

Correct, a retransmission is based on the Retransmission Time Out (RTO) timer set by the OS and typically adjusted conti

@Jaap: Thanks for the link. Already read that and others, but (to me at least) it doesn't really explain what I see here

IP Identification behaviour? I've been asked to look at a capture file not captured by me. I know, asking for trouble ri

IP Identification behaviour? I've been asked to look at a capture file not captured by me. I know, asking for trouble ri

Hi,

Use case: identify what gateway servers on a number of different VLANs use, by identifying what GW the servers ARP for. This is needed since the GW must change IP address prior to a larger network migration.

I know I can see the details I'm after by using the field "arp.src.proto_ipv4", but my problem is that I can't search on this using wildcards.

As far as I can tell (https://www.wireshark.org/docs/dfref/...) the field is simply an IPv4 address field, so I'm unable to use the "matches" keyword which would've given me the opportunity to use regex.

I need to know which servers ARP for a GW IP that ends with ".12", so essentially a display filter such as "arp.src.proto_ipv4 == ..*.12" is what I'm looking for.

Any and all help much appreciated!

Thanks

/Niels

Hi Packet_vlad, no I haven't found that thread, very helpful. And you're completely right - it's not arp.src.proto_ipv4

arp arp.src.proto_ipv4 wildcard search? Hi, Use case: identify what gateway servers on a number of different VLANs use,

I won't comment on whether everyone should modify their settings as I don't know the defaults and I certainly don't know