SYN-bit's profile - activity

Right-clicking on the filter button gives you all of these options (and more!) already. Would your suggestion add someth

Were you able to test this? What was the result?

The only thing I can think of that is changed to the system when a capture is running is that the interface(s) on which

Thank you!

Glad it helped, welcome to the wonderful world of packet analysis!

Thanks for reporting this issue, however, we keep track of bugs and/or enhancement requests on gitlab. Could you add thi

We keep track of bugs and/or enhancement requests on gitlab. Could you add this as an enhancement request on https://git

Thanks for providing the packet capture. The traffic to your server is using port 8088 which is not listed as an https p

The easiest way to go back to the default settings is to go to "Edit -> Configuration Profiles". Select "Default" and

Without any information to go on besides "Dycryption for my local site does not work" and "decryption for some other sid

Without any information to go on besides "Dycryption for my local site does not work" and "decryption for some other sid

There might be other tools out there, but I think this is the best Wireshark can do for "easy" SACK analysis. The rest n

Hi Niels, did you check the TCP streamgraph (tcptrace version)? It shows SACK blocks in red lines and they align to the

Do both AS400s follow the same path to the Internet (and then to the FTP server)? You mentioned one is a virtual server,

I would follow a few steps, but please note that I do not have any specific AS400 experience. Also, I do not know anythi

I would appreciate comments by SYN-bit or anyone else that's knowledgeable. On the iSeries/AS400, IBM support told me

You can use sshdump to do that, it's in the installer under "tools", AFAIK it is not installed by default, so you will h

Yup, manual calculation, seems to be something a field we could add to the TCP dissector. But it is tricky when there ar

The MTU size is not directly visible in network packets, as it is a setting off the network interface. But the TCP MSS i

Looks like the old AS400 was tweaked to use an MTU of 1492 instead of the standard 1500. The new AS400 is using an MTU o

I did a quick check on a TCP delta time of >10 seconds, but that does not show anything. So it is not just a simple l

Thanks for the files, great that you used tracewrangler to anonimize them. Unfortunaly I think the clue in this case wou

Welcome to the wonderful world of Packet Analysis :-) Yes, we don't have files sharing enabled to prevent all kinds of

Nice to see you're jumping on the packet analysis bandwagon. It's impossible to do a troubleshooting course in one answe

Do you by any chance have selected a non-zero value for occurrence in the column definition? As your column only shows o

Another thing I noticed is that the embedded device is sending a window size of 2048 bytes max. The client is sending ht

It looks like all checksum error messages are indeed caused by checksum offloading.The partial checksum calculation is d

Oops, Wireshark and Tshark do not use the same profile by default, so yes, if you are using a non-default profile in Wir

I suspect that somehow your Wireshark is using a different profile than your tshark (normally tshark should be using the

First the lowhanging fruit, is the window size too small, not scaled enough? For this to calculate, you need the used wi

Assuming there is timeout for retransmitting a block when no ACK is received, you could use a filter like tftp and udp.t

The meaning of any checksum, whether it is at the UDP layer or any other layer is to detect errors in the data. When dat

I'm no Azure administrator, but in the linked document I do not see any reference to have the zone locally configured as

It’s not DNS There’s no way it’s DNS It was DNS Good find, glad you were able to solve it, does make one wonder why the

Are you sure it is truncated, there could be reassembly of IP fragments at work? Also, is the "truncated" flag set in th

Interesting case, must be something like that. @Mick b Are you able to share (part) of the file or would that expose sen