wbenton's profile - activity

I was finally able to uninstall Npcap and then properly re-install Wireshark with new Npcap after I rebooted my PC.

The error I keep getting is: Unable to load Npcap or WinPcap (wpcap.dll); you will not be able to capture packets. In or

NPCap 6.0 will not uninstall I upgraded my Wireshark today and it also tried to replace my NPCap 6.0 with a new 7.1, but

Makes sense. Thanks for the explanation.

Further analysis of that file I previously mentioned, the problem ONLY seems to occur in streams 40, 41, 43, 45, 46 and

The file came from an old Malware-Traffic-Analysis.net file. Zipped Sniffer File The zipped file is encrypted. The passw

The file came from an old Malware-Traffic-Analysis.net file. link text The zipped file is encrypted. The password is [in

I used to work with massive 800MB captures... hundreds of them. You start using tshark for management like the followin

Follow HTTP stream vs Follow TCP stream bug? When I view HTTP streams vs TCP streams, the displayed content varies depen

Does this happen with both Admin and non-Admin users?

This is an old question, but I think you mean "How do you tell the difference between 2 IP addresses"? Is that correct?

Is there a load balancer in front of your server? It sounds like one load balancer/or server might fail and clients att

What are the 4 displayed options you do see? What Operating System are you using? Windows or Linux? Did you install PCAP

I want to use a Tshark command to pick out the original icmp source and destination ip and dump it into a text file:

Example (shortened):

No.     Time                          Source                Destination           Protocol SrcPrt DstPrt Length Info
      1 2019-02-26 15:33:43.297203    10.74.192.78          192.168.128.112       ICMP     34945  443    590    Destination unreachable (Fragmentation needed)

Internet Protocol Version 4, Src: 10.74.192.78, Dst: 192.168.128.112
Internet Control Message Protocol
    Type: 3 (Destination unreachable)
    Code: 4 (Fragmentation needed)
    Checksum: 0x8a3c [correct]
    [Checksum Status: Good]
    Unused: 0000
    MTU of next hop: 1280
    Internet Protocol Version 4, Src: 192.168.128.112, Dst: 36.92.190.198 <== I want these IP addresses dumped to a text file.

What Tshark command can I use to read in multiple files and only output the text source and IPs mentioned above?

Cheers,

Yes, I was looking for ip.src and ip.dst and your final answer [tshark -r icmp.code4.pcapng -T fields -E occurrence=l -e

It's the second instance of tcp.src & tcp.dst that I'm interested in... not the first instance. The one in the ICMP

Tshark command to output the original source and destination IPs of an icmp.type==3 code==4 packet. I want to use a Tsha

That sounds about right. I just dug up a screen capture of the counter from a few months ago and it showed 1,953,747,894

I'm currently looking at the tshark packet counter and it shows 747,345,008 packets with 297,457 packets dropped! What

From the DOS prompt, go to the Wireshark directory {usually under C:\Program Files\Wireshark> unless you installed it

tshark packet counter maximum value When using tshark to dump to large files (i.e. 1GBytes/file) and you want to capture