Ask Your Question

Spooky's profile - activity

2019-08-20 22:44:55 +0000 received badge  Critic (source)
2019-08-20 21:10:02 +0000 commented answer Why is there traffic from and to an external IP address in my network?

Scope 239.x.x.x is like RFC1918 of the multicast world. It may be used by any provider and does not have to be unique. S

2019-08-20 20:53:38 +0000 commented answer Can I set default *Find Packet...* settings?

I didn't read the question the same way you did. I can see your point. Honestly, I was just trying to help.

2019-08-20 01:34:02 +0000 answered a question Ping failure in VPN network

Hi, What the capture shows is that you are not receiving IP traffic at all from remote hosts. You are seeing retransmi

2019-08-20 01:04:39 +0000 received badge  Rapid Responder (source)
2019-08-20 01:04:39 +0000 answered a question Can I set default *Find Packet...* settings?

Hi War Machine, I like Find Packet too because of the way it allows you to jump from one matching packet to the next.

2019-08-15 21:32:36 +0000 answered a question Which versions support ASCII dump and ^C-copying in hexdump pane?

Hi, I can assure you that all the volunteers working on Wireshark are not making any changes without good reasons. If

2019-08-15 21:32:36 +0000 received badge  Rapid Responder (source)
2019-08-14 23:58:29 +0000 received badge  Rapid Responder (source)
2019-08-14 23:58:29 +0000 answered a question MAC Address Recording

Hi, I think you want to capture WLAN packets to monitor traffic to your access point. You can set Wireshark to capture

2019-08-13 03:01:13 +0000 answered a question Is it possible to use an arp cache in your profile?

Hi Ross, I did misunderstand. I couldn't think of an exemple where you would need this ARP information cached. As far

2019-08-13 02:54:44 +0000 commented question Unable to capture packets in ESXi Guest

Hi. Have you tried winpcap for kicks? Are you running Wireshark with Admin rights?

2019-08-13 02:45:29 +0000 edited answer Is it possible to use an arp cache in your profile?

Hi Ross, You can put your own ethers file in your Personal Configuration folder. (Help -> About Wireshark -> Fold

2019-08-13 02:45:02 +0000 answered a question Is it possible to use an arp cache in your profile?

Hi Ross, You can put your own ethers file in your Personal Configuration folder. (Help -> About Wireshark -> Fold

2019-08-13 01:52:35 +0000 edited answer Log analysis - suspicious inbound

Hi Arnaud, There are a few reasons you might see this traffic. One reason could be that your computer does initiate a

2019-08-13 01:51:42 +0000 answered a question Log analysis - suspicious inbound

Hi Arnaud, There are a few reason you might see this traffic. One reason could be that your computer does initiate a T

2019-08-08 21:14:16 +0000 commented question Window is huge!

If possible have you tried another (smaller) resolution?

2019-08-08 01:58:59 +0000 commented question Window is huge!

Click on the app window then hold option + shift and drag the mouse to try and resize the window. Also, try looking at r

2019-08-08 01:51:51 +0000 commented question Log analysis - suspicious inbound

Hi, most residential gateway use NAT between the public IP address you get from the ISP and the private IP addresses on

2019-08-08 01:43:29 +0000 answered a question Server Response Time is slow

Hi Musky, I don't see anything "wrong" in the capture but there is a "story" to tell. Since 192.168.136.43 initiates t

2019-08-06 22:33:07 +0000 received badge  Rapid Responder (source)
2019-08-06 22:33:07 +0000 answered a question Server Response Time is slow

Hi Musky3913, Looking at the Window Size value for the first file (in your question) I see 296 bytes at most for 1.1.1.

2019-08-05 22:26:15 +0000 commented question Server Response Time is slow

Do you have more information on where this capture was taken? I don't see Window Scale option in TCP SYN segments. (SYN

2019-08-05 22:04:18 +0000 commented question TCP is 1 Byte: 0x00

You may share images and, better yet, PCAP files on public share like Google Drive, Dropbox, etc.

2019-08-02 02:51:20 +0000 answered a question Why would DHCP Discovery, Request, Offer, ACK repeat

Hi Garry, I'll make this the answer to this post based on your last comments so it can help others as well. First x.x.

2019-07-31 00:20:39 +0000 commented question Why would DHCP Discovery, Request, Offer, ACK repeat

It would be helpful to see the actual PCAP to answer this question better. Timing may be an issue. Please post it onlin

2019-07-31 00:20:23 +0000 commented question Why would DHCP Discovery, Request, Offer, ACK repeat

It would be helpful to see the actual PCAP to answer this question better. Timings may be an issue. Please post it onli

2019-07-31 00:10:34 +0000 answered a question how to filter include or exlude sip reinvite in-dialog message

Hi King Man, The "in-dialog" is added in the Info column by the SIP dissector itself. (See comment on line 2451) Becau

2019-07-30 23:54:41 +0000 answered a question How to get a result of QoS (Troughput, latency, packet loos & jitter) from data capture video streaming in TCP Protocol ?

Hi Kurniawan, First of all, "QoS" is usually at the IP (or VLAN) layer not TCP itself. I'll assume you are talking abo

2019-07-30 23:34:30 +0000 answered a question ARP from different subnet, multiple address for a MAC adress

Hi J, There are a few possible reasons for seeing the same MAC address for IP adresses from different subnets. One pos

2019-07-12 00:25:54 +0000 received badge  Enthusiast
2019-07-11 23:59:34 +0000 received badge  Rapid Responder (source)
2019-07-11 23:59:34 +0000 answered a question How to find what user accessed \\computerName\Folder?

Hi SunMan, If you captured the session setup, you should be able to see the username used to connect to the share. I

2019-07-09 02:41:43 +0000 answered a question How can I change the time to match reality?

Hi Glenn, Time Shift allows you to "shift" the timestamp on captured packets. This is helpful when looking at capture

2019-07-09 02:41:43 +0000 received badge  Rapid Responder (source)
2019-06-25 16:11:50 +0000 answered a question wireshark showing only my UDP not others on

I'm not sure what you are trying to do but a good way to see all IP in a capture is to go to Statistics -> Conversati

2019-06-25 16:05:31 +0000 commented question how to use wireshark with port mirroring

What kind of port mirroring are you using? Can you post a PCAP on a public share? There are certain mirrors that encapsu

2019-06-25 15:36:39 +0000 answered a question Keep-Alive Packets after FIN

Hi Anbu, In both your capture the server closes the TCP connection. Firefox closes the TCP connection with a correct t

2019-06-25 15:36:39 +0000 received badge  Rapid Responder (source)
2019-06-14 22:52:54 +0000 answered a question ERSPAN ID - Adding Information to captured packets

Hi Robert, You can click on almost any fields and make it a column. So try to right-click on the ERSPAN ID field in th

2019-06-14 22:52:54 +0000 received badge  Rapid Responder (source)
2019-06-14 21:40:58 +0000 commented question How to add some field to decode netflow

Hi Bercut, Based on the code for netflow dissector these proprietary fields probably need to be added. The code looks mo

2019-06-13 22:03:21 +0000 commented question How to add some field to decode netflow

Hi, Are you able to see other fields (like SrcAddr, DstAddr, etc.) but not Cisco privates or no fields at all? Are you

2019-06-13 01:58:29 +0000 received badge  Autobiographer
2019-06-13 01:27:28 +0000 received badge  Citizen Patrol (source)
2019-06-11 22:07:58 +0000 answered a question How to get packet loss average

Hi, Wireshark is probably not the tool you are looking for. You could set up a capture point on your network and then

2019-06-11 21:53:57 +0000 received badge  Rapid Responder (source)
2019-06-11 21:53:57 +0000 answered a question How to log attempts of attack - before machine is crashing ?

Hi Penguin1024, You may run Wireshark in the background of your Linux distro but it may end up capturing a lot of traff

2019-06-11 21:31:23 +0000 commented answer how do i access data from a specific date and time frame?

Glad I could help! Please mark the answer as correct (click the checkmark) so others may benefit from it in the future.

2019-06-10 21:55:54 +0000 answered a question how do i access data from a specific date and time frame?

Hi I like using the frame.time field for this. You should see this field under Frame in the Packet details pane if you