mzhan017's profile - activity

overview network karma followed questions activity

2024-04-09 04:53:25 +0000	marked best answer	How to let tshark reassemble the fragments on GRE? I have captured on pcap with gre traffic. and could filter out the gre traffic by: `[root@vmtca-2101 mzhan017]# tshark -r ims_merged_bad.pcap "ip.proto == 47" Running as user "root" and group "root". This could be dangerous. 42037 144.861194 10.0.0.7 → 55.0.0.5 IPv4 1512 Fragmented IP protocol (proto=UDP 17, off=0, ID=079a) 42039 144.861213 10.0.0.7 → 55.0.0.5 IPv4 69 Fragmented IP protocol (proto=UDP 17, off=1448, ID=079a)` These two fragments are one SIP INVITE message. So I tried to filter the SIP with following command. `tshark -2 -r ims_merged_bad.pcap -R "ip.proto == 47" "sip.CSeq.method==\"INVITE\""` But couldn't get the INVITE message out. Does tshark support this kind of re-assemble? Any suggestion for this demand? Thanks, Mark
2024-04-09 04:53:25 +0000	received badge	● Scholar (source)
2024-04-09 04:52:35 +0000	received badge	● Notable Question (source)
2024-04-09 01:22:46 +0000	received badge	● Rapid Responder (source)
2024-04-09 01:22:46 +0000	answered a question	Could tshark capture the de-encrypted packet when receiving ESP? Seems expected for tunnel mode, from code of kernel. xfrm_input .... if (x->outer_mode->flags & XFRM_M
2024-04-09 00:23:53 +0000	asked a question	Could tshark capture the de-encrypted packet when receiving ESP? Could tshark capture the de-encrypted packet when receiving ESP? We encounter one problem: When using tshark to captu
2023-12-11 15:05:08 +0000	received badge	● Popular Question (source)
2023-05-17 21:43:12 +0000	commented answer	How to let tshark reassemble the fragments on GRE? hello cmaynard, sorry for misleading. I pasted wrong command. It should be -R.
2023-05-17 21:42:19 +0000	received badge	● Editor (source)
2023-05-17 21:42:19 +0000	edited question	How to let tshark reassemble the fragments on GRE? How to let tshark reassemble the fragments on GRE? I have captured on pcap with gre traffic. and could filter out the gr
2023-05-17 21:40:29 +0000	commented answer	How to let tshark reassemble the fragments on GRE? Hello Grahamb, Thanks for your support. Yes, with -o option, the SIP INVITE could be showed. Does this mean, tshark has
2023-05-17 06:47:26 +0000	commented question	How to let tshark reassemble the fragments on GRE? By the way, the fragments happened on IP over GRE.
2023-05-17 06:42:51 +0000	asked a question	How to let tshark reassemble the fragments on GRE? How to let tshark reassemble the fragments on GRE? I have captured on pcap with gre traffic. and could filter out the gr