SYN-bit's profile - activity

Thanks Sys-Bit Its pretty much what I thought also that something in the application stack is resetting the session. T

From analyzing the image (BTW, it is much easier to analyze network packets using a capture file, then we can use our fa

Another route if you want to save a selection of http requests/responses (and other packets that might have been reassem

You can create a filter button for the frame.number in {${frame.number} ${http.response_in}} filter (click on the + next

Capturing packets from other systems is not as straightforward as just starting a capture. Have a look at the following

Combining @chuckc's method and my method: select the http request you would like to export combined with its response a

Nice filter Chuck, I like your usage of ${} macros inside of the set filter.

If you take HTTP.cap as an example, then filter on http, you will see the http request in frame 4 and the http response

If you take HTTP.cap as an example, then filter on http, you will see the http request in frame 4 and the http response

If you take HTTP.cap as an example, then filter on http, you will see the http request in frame 4 and the http response

Are there many clients doing SOAP requests to the remote service? Which device is doing the NAT and are you able to make

decrypt tls 1.2 issue (Windows Server 2019 + Wireshark v3.4.8-0-g3e1ffae201b8 ) Trying to use the environment variable

In your picture in frame 57, it is not yet known by the endpoints which version of TLS will be used, as they are just en

In TLSv1.3, there is a new extension that negotiates the TLS version. It reuses the TLSv1.2 version on the handshake mes

Good to hear I was on the right track! Thanks for pointing out my typo, I corrected it :-)

If I understand you correctly, you place a network TAP between a system and the switch/router it was connected to and co

If I understand you correctly, you place a network TAP between a system and the switch/router it was connected to and co

Good find! Were you able to do the downgrade? And did it help? I have an EdgeRouter X, I might try to reproduce the issu

Thanks for the second pcap file. Since you mentioned that it does not work over the site-to-site vpn and that that behav

Another thing, this trace shows only the transfer of "/NetMedicalLogin.png", I assume this picture was referenced in an

Although at first glance it looks like a MTU problem, it isn't. The "full" sized frames are indeed received at the clien

The reason for Wireshark to mark a packet as a "Spurious Retransmission" is that it sees a retransmission of a TCP segme

@MichaelP Did you select the right interface before typing in the capture filter? As capture filters are Link-layer spec

The ClientCertificate is spread over frames 10, 11 and 12. In order for Wireshark to display the certificate, it needs t

If the packets are PPPoE encapsulated, you need to use the filter pppoes and port 5060. This is because the BPF filter e

Thank you for the status update with the good news. Glad you were able to fix it and that my observations helped out. B

The RTT of a connection could be calculated if there is a protocol present that will give a good indication. Like a 3-wa

In a RSA key exchange (indicated by your ciphersuite), the pre-master-secret (which is used to create the data-encryptio

One thing I noticed in the pcap is that the provider does not send a ptime parameter in it's SDP packet. Only a maxptime

Thanks for sharing the pcap, it's interesting to see the behavior. Also it seems to take 1 RTCP packet with quite a bit

It seems the RTCP packet at the start of the 40ms ptime interval is indicating ~11% packet loss experienced by the exter

Without the signalling and RTP seq+timestamps it's hard to say for sure. But it looks like a different packetization tim

Glad it solved (part) of your challenge :-)

Glad it solved (part) if your challenge :-)

Not the solution for your reuqest, but maybe a good workaround, if you search for a string in the packet-details, the st

A RTO (retransmission timeout) of 6 seconds is really really high. 3 seconds used to be a generally used value like 10+

The client side capture is a bit confusing to read. Wireshark displays TCP ACKed unseen segment and TCP spurious Re

From the captured packets, I think there is a bug in de TCP/IP stack of device-2. I assume the span port was mirroring t