johnthacker's profile - activity

Yes, ti will automatically be in the released Wireshark 4.4 packages for Windows now. I do not necessarily expect it to

It should be added for the released packages for 4.4 when that is out. https://gitlab.com/wireshark/wireshark/-/issues/1

AMR support depends on an external library. The current Windows and macOS packages are built without the library, so the

AMR support depends on an external library. The current Windows and macOS packages are built without the library, so the

Yes, this must be the result of taking the packet dissections in text, and running some regex or other text processing o

You're referring to the Flow Graph when you say "horizontal communication line", correct? That is a known issue that pro

It's an RPM spec file issue. If you installed it outside an RPM, then the dependencies in the spec file won't be satisfi

It's an RPM spec file issue. If you installed it outside an RPM, then the spec file won't report it as working. RHEL 8

What version of Wireshark are you using? On Windows, the size of the Menu items are controlled by the windows scaling se

The client hardware address field ('chaddr') in DHCP is a fixed 16 octets. The hlen field indicates the length of the ha

It will be a little bit more user-friendly in 4.4.0: https://gitlab.com/wireshark/wireshark/-/commit/09e9b352d047ad1ae6c

https://www.wireshark.org/docs/wsug_html/#_microsoft_windows mentions the server versions, as the other page doesn't for

That looks like a bug, there should be an issue. Note that the GTPv2 spec is different, as it specifically indicates a v

No, there is a maximum number of packets that will be displayed in the minimap. For large capture files it will have man

@SYN-bit, you are right. For ICMP packets and others where in_error_pkt is set, we could avoid setting the port the way

From the User's Guide: The packet list has an Intelligent Scrollbar which shows a miniature map of nearby packets. E

This is not unique to ICMP. Some protocol layers set addresses, some set ports. The ones that set addresses do not, as a

Am I getting it right that I need to write this socks_udp_dissector myself and there is no available implementation?

It's a bug - the UDP conversation is getting added using the source and destination addresses of frame 14 (which has the

It's a bug - the UDP conversation is getting added using the source and destination addresses of frame 14 (which has the

It's a bug - the UDP conversation is getting added using the source and destination addresses of frame 14 (which has the

This MR possibly helps this, because it was definitely not correct to directly manipulate the preference pointer outside

The advice in the Wiki about "How to Dissect Anything" is your best bet here. There is no link-layer type used in pcap

Good point, that is an option, ever since 4.0.

The advice in the Wiki about "How to Dissect Anything" is your best bet here. There is no link-layer type used in pcap

If you're happy with "the packets that contain IPv6 or IPv6, as a pcap, starting at the IP layer with Raw IP encapsulati

From tshark, the command is tshark -U IP -r Sniffer.pcap -w sniffer_ip.pcapng -o wlan:enable_decryption:TRUE -o 'uat:80

If you're happy with "the packets that contain IPv6 or IPv6, as a pcap, starting at the IP layer with Raw IP encapsulati

From this commit, mentioned in the 4.2.0 release notes: The "init.lua" file is now loaded from any of the Lua plugin

Somewhat related to https://gitlab.com/wireshark/wireshark/-/issues/19613 Two worthy enhancements: 1) Export PDUs for

It is a new feature that just landed in the git repository and will be available in 4.4.0, but is not in a released vers

Sounds like the issue fixed by this commit. It is probably related to the androiddump extcap, which uses Bluetooth, try

This is issue #19076 and I don't believe that exactly what you're asking for is possible in current releases, though it

This is issue #19076. I have an open merge request that would allow you to enter something like: tshark -o 'gui.column

It might help if you were a little more precise about what you want it to return. Can I assume that the hexdump output i

It might help if you were a little more precise about what you want it to return. Can I assume that the hexdump output i

One option is to capture on eth0 and eth1 simultaneously as separate interfaces, instead of capturing on the bridge inte

Yes. If you want to add an item and retrieve the value of the item simultaneously, there are functions like proto_tree_a