Jedi's profile - activity

Both the Windows computer and the Ubuntu computer have [] brackets around the word timestamps but the Ubuntu computer ha

I have Wireshark Version 4.2.2 on Windows 10.

It is my understanding that Timestamps go into the TCP options section of the header. According to what I have read TCP headers containing this option increase by 10 bytes (8 bytes for the two timestamp values and 2 bytes to indicate the option value and length). But Wireshark is saying the header length is only 20 bytes even though I can see the timestamp values? I tried to add a picture but don't have enough reputation. On my Ubuntu computer Wireshark Version 3.6.2 says the TCP header with timestamps is 32 bytes as it is padded out with two NOP bytes. Why is Wireshark saying the TCP header length is only 20 bytes with timestamps on the Windows computer?

TCP header length 20 bytes with Timestamps I have Wireshark Version 4.2.2 on Windows 10. It is my understanding that Ti

Wow, you cracked it. The traffic is PPPoE. The correct filter is pppoes and yes it worked. I didn't think this problem h

I am running Ubuntu 20.04.

I am capturing using a network tap on a computer that has a separate NIC not configured with an IP address.

When I run a capture using 'host xxx.xxx.xxx.xxx' as a capture filter it does not capture anything even though I know there is traffic to that address. I am assuming this is because there is no traffic destined to or sourced from the NIC I am capturing on?

Is there a capture filter available that could capture traffic to and from a particular IP address in this scenario?

I have fibre. The router is a Ubiquiti Edgerouter which goes to a EdgeSwitch. Plugged into that is a Unifi AC Lite. I th

Ok I have figured out that this problem only occurs if I have the network tap positioned between the wall and the router

Even if I do a capture filter of 'ip' it doesn't capture anything.

The address in question when there is no capture filter is in this format: xxx.xxx.xxx.xxx.dsl.dyn.ihug.co.nz

The source address when there is no capture filter is in this format: xxx.xxx.xxx.xxx.dsl.dyn.ihug.co.nz

Yes I see lots of traffic to and from this particular address when using no capture filter?

Capture filter not capturing anything I am running Ubuntu 20.04. I am capturing using a network tap on a computer that

I am capturing between a computer and a router using a Dualcomm Network Tap.

I have noticed some packets that have a length that exceed the MTU of 1492 set in the router.

I did the capture from the wire for the specific purpose of avoiding the issue of Large Segment Offload.

I do not understand how there can be packets between the NIC and the router that exceed the MTU.

The operating system I am running Wireshark on for the capture is Ubuntu 20.04 using a separate NIC.

In case the NIC was doing Large Receive Offload I tried

sudo ethtool --offload enp3s0 rx off

but it didn't help.

Hi Anders, Thank you for your very useful link. For the record ethtool -K enp3s0 gro off solved my problem. This

Packet length exceeds MSS I am capturing between a computer and a router using a Dualcomm Network Tap. I have noticed

ip multicast works on the linux computers?

Hi Guy, Thank you for your reply. I have noticed this issue only happens with the linux computers. On the Windows comp

When I try and use the "ip broadcast" capture filter it says "netmask not known, so 'ip broadcast' not supported"? I bee