Ross Jacobs's profile - activity

Why not start with the Wireshark User's Guide?

Cheers I've given you some feedback. You should use a debugger like pdb separately or as part of a tool like PyCharm.

Cheers I've given you some feedback. You should use a debugger like pdb separately or as part of a tool like PyCharm.

Does the Windows outlook office365 client support the $SSLKEYLOGFILE variable? If the client does not support it (as I w

Does the Windows outlook office365 client support the $SSLKEYLOGFILE variable?

Does the Windows outlook office365 client support the $SSHKEYLOGFILE variable?

Good work writing the script! Please make another post with this script (It looks like you're getting a scapy error). As

Cheers @bubbasnmp

The question is "Where is it documented?" This technically answers the question because you show where it's documented,

I already have. You need to write your own script to do so. You might find this pacp deconstruction helpful: http://www.

All the IBM MQ infos! Similar post asking about Websphere MQ Wireshark MQ display filter reference capture 1, via bug

All the IBM MQ infos! Similar post asking about Websphere MQ Wireshark MQ display filter reference capture 1, via bug

As in your previous linked post, you will need to write a short script to convert this to a packet capture. Like as not,

Where is tshark -T jsonraw documented? Problem I am trying to understand how to use jsonraw as an option, as I saw it o

Hi Billy, As you can see with bubbasnmp's answer, the files: option requires a number, not a path. A valid command migh

Hi Billy, As you can see with bubbasnmp's answer, the files: option requires a number, not a path. A valid command migh

@Anders - I agree that this is the general solution, it sounds like he wants to a pcap created dynamically for each IP a

What are you actually trying to do here? If you want a record of all traffic to look at later and have sufficient storag

Wireshark does not require .net. Are you sure you are on the right forum?

Hi Prudvi, We need more info. Provide a screenshot (images can be added with or a link to a hosted file). Ideally, y

Description

Documentation says that -H, (which implies -Wn) writes data to pcapng files. With a local hosts file, when I try

bash$ ping 8.8.8.8 &
bash$ tshark -c 10 -f icmp -w temp.pcapng 
bash$ tshark -r temp.pcapng -H hosts -w temp2.pcapng

I see normal traffic with no modifications to display of IP address. Local hosts file looks something like this:

127.0.0.1      localhost
192.168.0.1    this_computer
8.8.8.8        google_dns

I can see that a pcapng Name Resolution Block exists with xxd:

bash$ xxd temp2.pcapng | grep this -B 5 -A 5
00000620: d0fb 763a 3757 76df 4c5d 0000 0000 f362  ..v:7Wv.L].....b
00000630: 0c00 0000 0000 1011 1213 1415 1617 1819  ................
00000640: 1a1b 1c1d 1e1f 2021 2223 2425 2627 2829  ...... !"#$%&'()
00000650: 2a2b 2c2d 2e2f 3031 3233 3435 3637 0000  *+,-./01234567..
00000660: 8400 0000 0400 0000 3c00 0000 0100 1200  ........<.......
00000670: c0a8 01f6 7468 6973 5f63 6f6d 7075 7465  ....this_compute
00000680: 7200 0000 0100 0f00 0808 0808 676f 6f67  r...........goog
00000690: 6c65 5f64 6e73 0000 0000 0000 3c00 0000  le_dns......<...

Question

When I use tshark -r temp2.pcapng -NNn I see IP to name mappings (names I see are mbp.attlocal.net and dns.google). Using both Wireshark and tshark -r temp2.pcapng -Nd, I do not see "this_computer" or "google_dns" in place of IP addresses. How can I see the data stored in the Name Resolution Block with tshark?

Hi Sake, If this is your baby, can you add text to the manpage and --help? The example that Graham provided with number

I am looking at the documentation for tshark -b, and it's unclear to me what the difference is between "interval" and "duration". Both are in seconds and at the end of NUM seconds, the file rotates.

For example, what is the difference between these two commands?

tshark -b files:5 -b duration:10 -w file
tshark -b files:5 -b interval:10 -w file

In both cases, I see the filename endings change and increase by 10 about every 10s that look something like this:

bash:/tmp/duration-test$ ls -1
file_00003_20190808003713
file_00004_20190808003723
file_00005_20190808003733
file_00006_20190808003743
file_00007_20190808003753

You had me at no :)

According to the docs, it looks like the system provides arp translations. Is it possible to access this via a profile file (to save/load for a specific capture)?

Hi JFD, I think you may be misunderstanding the question. ARP and ethers entries are different. Per the documentation,

This is a good answer. To add to this, most firewalls are "stateful" - they will maintain a list of active TCP/UDP conne