Packet_vlad's profile - activity

Hi Chuck, 1) It's just default profile + Stream ID column added: https://drive.google.com/file/d/14xAk8tlOmEK1K-8ugP8ju

Duplicated UDP stream IDs? Hi All, Could you please tell why I see duplicate stream IDs in Conversations dialog: The

Hi all,

Could you please tell if it is possible to set Wireshark column to display only actual field value, but not description of it?

Pls see screenshot attached containing OSPF protocol. I'd rather have LS types displayed as numbers 1 to 9, not as such extra-long descriptions.

PCAP sample

Hi Guys,

I'm struggling with BPF filter to match 2 Bytes inside UDP payload for the next stack: Ethernet-VLAN-IPv6-UDP.

So I make the next expression:

vlan and udp[8:2] = 0x1111    (1)

For some reason it does not work, no packet is matched. I make a step back and delete Byte matching part:

vlan and udp    (2)

This one works correctly matching all UDP inside IPv6.

I then try the first one (with Byte offset), but on Ethernet-VLAN-IPv4-UDP - and it works again.

So I checked compiled BPF and I see:

• For vlan and udp:

There is a check for v4 and v6.

• For vlan and udp[8:2] = 0x1111

There is no more check for v6.

Am I missing something? I'd like to avoid going down the stack and making Ethernet Byte filter with big offsets.

A good file to play with is in Johannes Weber blog:

https://weberblog.net/ipv6-upper-laye...

Thanks,

Vlad

Ah, I see now, thanks Chuck!

BPF Byte filter for VLAN-IPv6-UDP stack Hi Guys, I'm struggling with BPF filter to match 2 Bytes inside UDP payload for

I've updated the link.

Chris Greer recently recorded nice introductory video on the subject.

Maybe Proxy ARP is on?

Ah, ok, thanks for pointing me to the report.

NTP - show calculated fields in columns Hi all, I tried to create columns for NTP protocol fields (see screenshot), but

Hey Christian, sure you can. Right click on the column, 'Edit', Occurrence field:

As an example of what @jaap said: !(ip.addr[0-1] == AC.10 and ip.addr[3] == 25) Filter out all addresses with first

As an example of what @jaap said: !(ip.addr[0-1] == AC.10 and ip.addr[3] == 25) Filter out all addresses with first

Do you have a possibility to arrange packet capture on the Hyper-V side? For me it looks the next: packets from 10.10

Do you have a possibility to arrange packet capture on the Hyper-V side? For me it looks the next: packets from 10.10

Do you have a possibility to arrange packet capture on the Hyper-V side? For me it looks the next: packets from 10.10

Do you have a possibility to arrange packet capture on the Hyper-V side? For me it looks the next: packets from 10.10

Do you have a possibility to arrange packet capture on the Hyper-V side? For me it looks the next: packets from 10.10

Do you have a possibility to arrange packet capture on the Hyper-V side? For me it looks the next: packets from 10.10

Do you have a possibility to arrange packet capture on the Hyper-V side? For me it looks the next: packets from 10.10

Do you have a possibility to arrange packet capture on the Hyper-V side? For me it looks the next: packets from 10.100

Thanks for the detailed information, will take a look soon. ..By FW I meant firmware, not firewall, that could have been

Thanks for the detailed information, will take a look soon. ..By FW I meant firmware, not firewall, that could be mislea

Could you please share network diagram (even simple one, just to see traffic path and endpoints) and capture point locat

From the very high packet rate and TTL not decreasing on per-packet basis I guess you have switching loop. Please review

From the very high packet rate and TTL not decreasing on per-packet basis I guess you have switching loop. Please review

Hello, What application is this? Check its settings/configuration. I guess application could override system-wide value.

You can use any file sharing service (Google Drive, Dropbox etc) and post a link here. Trace file is preferable.

This is perfect time to see the capture or at least a screenshot. Total Bytes in flight = bytes sent (SEQ + last TCP.l