Ask Your Question

johnthacker's profile - activity

2026-10-03 10:35:36 +0000 commented answer Why does Wireshark 4.6.9 use the wrong language?

Also note that all the translations are always installed. I understand a reluctance to change your OS settings.. You can

2026-10-03 10:34:29 +0000 commented answer Why does Wireshark 4.6.9 use the wrong language?

Also note that all the translations are always installed. You can always go to Preferences and explicitly select English

2026-09-29 22:28:10 +0000 commented answer Why does Wireshark 4.6.9 use the wrong language?

Windows 11 has support for multiple languages. You almost certainly have English (United Kingdom) as your preferred lang

2026-08-28 14:44:01 +0000 edited answer Did Wireshark change the way files are stored?

The previous open files dialog was a custom dialog using a Win32 API that has been deprecated by Microsoft. The current

2026-08-28 14:38:52 +0000 received badge ● Rapid Responder (source)
2026-08-28 14:38:52 +0000 answered a question Did Wireshark change the way files are stored?

The previous open files dialog was a custom dialog using a Win32 API that has been deprecated by Microsoft. The current

2026-05-07 13:58:03 +0000 received badge ● Rapid Responder (source)
2026-05-07 13:58:03 +0000 answered a question ICU.dll/4.6.5 Windows Server Issue

This was a Qt issue. The automated builds should work, please try one of the 4.6.6rc0 installers here: https://www.wires

2026-02-05 13:56:12 +0000 answered a question OpenSSL Security Vulnarability

In addition to the answer above, Wireshark does not link against OpenSSL so OpenSSL vulnerabilities are not relevant. Gn

2026-02-05 13:56:12 +0000 received badge ● Rapid Responder (source)
2026-01-24 00:28:14 +0000 commented answer Netgear USB wifi adapters, Windows 11 and monitor mode

https://github.com/morrownr/USB-WiFi is another good place for suggestions.

2025-12-28 18:58:50 +0000 commented question Is it possible to change the decoding priority when ports conflict?

Is it not possible to configure with the expected server source port? The current version of Wireshark prefers using the

2025-12-17 18:40:16 +0000 commented question Unable to Decode Matter IM Traffic in Wireshark using nRF52840-DK as Thread Sniffer

Since 4.2.0, Wireshark has included a built in Matter dissector. Is there a reason you need to use a third party dissect

2025-11-24 23:36:18 +0000 answered a question PDU reassambly on data read from a custom log file in lua

If I understand correctly, your custom log file does not have the TCP layer at all, and just has the PDUs from each fram

2025-11-24 23:36:18 +0000 received badge ● Rapid Responder (source)
2025-11-20 18:26:37 +0000 answered a question Time of Day and Log Scale options Missing Wireshark 4.6.0

They're on the context menu. Right click to see and change those options. They were relocated because they made it impos

2025-11-20 18:26:37 +0000 received badge ● Rapid Responder (source)
2025-11-19 22:55:19 +0000 commented answer Out-of-order EtherCAT frames with identical timestamps

Are you able to use Linux, macOS, or some other operating system other than Windows to do the capture? Higher resolution

2025-10-17 15:16:53 +0000 commented answer tshark parse AMR-WB instead AMR

Tshark uses the default profile without -C, not the last used profile the way Wireshark does

2025-10-17 15:14:49 +0000 commented answer tshark parse AMR-WB instead AMR

I am sorry, I misread what you wrote. Yes, the problem is in your preferences.

2025-10-16 22:56:00 +0000 answered a question tshark parse AMR-WB instead AMR

Try using -d rtp.pt=112,amr_wb instead in that command.

2025-10-16 22:56:00 +0000 received badge ● Rapid Responder (source)
2025-10-15 13:42:17 +0000 received badge ● Rapid Responder (source)
2025-10-15 13:42:17 +0000 answered a question Conditional cascaded built-in dissector from a LUA dissector

Use Dissector.get("cfdp") Protocol and dissector are not synonymous, as there can be (but is not always) multiple disse

2025-10-14 18:29:39 +0000 commented answer Wireshark 4.6.0 qt6core.dll SetThreadDescription Error on Server 2016

It is also possible to build Qt yourself and set a flag apparently: https://bugreports.qt.io/browse/QTBUG-134075

2025-10-14 18:14:57 +0000 commented answer Wireshark 4.6.0 qt6core.dll SetThreadDescription Error on Server 2016

It does seem like in the Windows documentation that SetThreadDescription is supposed to be available in Windows 2016, bu

2025-10-14 18:12:50 +0000 commented answer Wireshark 4.6.0 qt6core.dll SetThreadDescription Error on Server 2016

It does seem like in the Windows documentation that SetThreadDescription is supposed to be available in Windows 2016, bu

2025-10-14 12:41:54 +0000 commented answer Wireshark 4.6.0 qt6core.dll SetThreadDescription Error on Server 2016

There will be security related updates for Wireshark related issues for the life of 4.4 (which will be at least until 5.

2025-10-14 12:35:30 +0000 answered a question Custom display field for text-based protocol

Assuming thar your numbers fit in an appropriate size integer, I would declare a FT_UINT32 or whatever with the BASE_SPE

2025-10-14 12:35:30 +0000 received badge ● Rapid Responder (source)
2025-10-13 23:05:34 +0000 edited answer Wireshark 4.6.0 qt6core.dll SetThreadDescription Error on Server 2016

Windows Server 2016 is not supported on Qt 6.9 (or 6.8), and so the official Wireshark packages will not run on it. You

2025-10-13 23:04:57 +0000 edited answer Wireshark 4.6.0 qt6core.dll SetThreadDescription Error on Server 2016

Windows Server 2016 is not supported on Qt 6.9 (or 6.8), and so the official Wireshark packages will not run on it. You

2025-10-13 22:19:50 +0000 commented answer Wireshark 4.6.0 qt6core.dll SetThreadDescription Error on Server 2016

Qt 6.8 and later run on Windows 1809 or later, which is Server 2019 and Windows 10 with some service pack updates.

2025-10-13 22:13:46 +0000 received badge ● Rapid Responder (source)
2025-10-13 22:13:46 +0000 answered a question Wireshark 4.6.0 qt6core.dll SetThreadDescription Error on Server 2016

Windows Server 2016 is not supported on Qt 6.9 (or 6.8), and so the official Wireshark packages will not run on it. You

2025-10-02 23:28:32 +0000 answered a question Bundled NPCAP versions

Usually the versions track fairly closely in the development version, but for stable releases of Wireshark it depends. S

2025-10-02 23:28:32 +0000 received badge ● Rapid Responder (source)
2025-09-10 22:17:35 +0000 commented question How to auto-select TCP conversations the old way?

There's a discussion here, but the only suggested method is using the Conversations dialog as you mention: https://gitla

2025-09-10 12:18:14 +0000 commented answer How to reference .proto files to tshark

You can also use -C on the command line with TShark to select particular configuration profiles other than the default,

2025-09-01 14:41:37 +0000 commented answer QT6 Entrypoint could not be found

One would think that the entry point would exist in the Qt6 DLL regardless of the version of Windows. The problem i

2025-08-31 16:36:36 +0000 commented question Is there a way to play AMR-WB in Wireshark?

Wireshark has "codec" plugins. It is possible to add support for AMR-WB using the open source library. It would be very

2025-08-31 16:27:22 +0000 commented question QT6 Entrypoint could not be found

Are you sure it's Windows 10? You said fresh install, is it fully updated, and to what update version? That's an error t

2025-08-31 16:25:44 +0000 commented question QT6 Entrypoint could not be found

Are you sure it's Windows 10? You said fresh install, is it fully updated, and to what update version? That's an error t

2025-08-24 15:23:17 +0000 commented answer Why does "dumpcap -d" and "Wireshark -> Capture Options -> Compile BPFs" produce different output for the same capture filter?

https://gitlab.com/wireshark/wireshark/-/merge_requests/21025 will make it so that the actual filter is printed.

2025-08-23 12:33:52 +0000 edited answer Why does "dumpcap -d" and "Wireshark -> Capture Options -> Compile BPFs" produce different output for the same capture filter?

It appears that the difference is that show_filter_code in dumpcap is calling open_capture_device which eventually calls

2025-08-23 12:32:02 +0000 received badge ● Associate Editor (source)
2025-08-23 12:32:02 +0000 edited answer Why does "dumpcap -d" and "Wireshark -> Capture Options -> Compile BPFs" produce different output for the same capture filter?

It appears that the difference is that show_filter_code in dumpcap is calling open_capture_device which eventually calls

2025-08-23 12:28:18 +0000 answered a question Why does "dumpcap -d" and "Wireshark -> Capture Options -> Compile BPFs" produce different output for the same capture filter?

It appears that the difference is that show_filter_code in dumpcap is calling open_capture_device which eventually calls

2025-08-23 12:28:18 +0000 received badge ● Rapid Responder (source)
2025-08-23 12:02:49 +0000 commented question Why does "dumpcap -d" and "Wireshark -> Capture Options -> Compile BPFs" produce different output for the same capture filter?

Somewhat related is your own issue https://gitlab.com/wireshark/wireshark/-/issues/18190 What difference, if any, does