SYN-bit's profile - activity

Also for the IIS server, see if the ARP requests are following DNS requests pointing to the requested IP addresses in th

The UDP payload does not resemble something the FTP protocol would produce. Was the payload anonimized? Regarding encap

A 'disconnection problem' is a very open problem description, as there are quite a few sessions in your capture, what ki

@YasithHashen Unfortunately I can't view your capture on cloudshark, did you mark it as public?

ARP discovery packets are broadcast but ARP renewal packets are unicast.

@cmaynard Thank you for expanding on this. You are absolutely right in having to take into account different versions a

I've figured out what is the issue: The PC sees GRE / ERSPAN. OK, that means the offsets of where to find the port

What kind of encapsulation is used to encapsulate the TCP-FTP packets in UDP packets (assuming you mean FTP-over-TCP whe

You can split the filter into the two elements, command and parameter. That way you can see all "EHLO" command lines tha

Good to hear it has been resolved, took some time to convince them apparently...

@EssexGeoff Thanks for the pcap file. There is nothing wrong with the file, as it is showing data in the source/destinat

Did you slice the packets to only 34 bytes or less? What do you see? Can you share a pcap file? It's really hard to see

Yes, Web-proxies can be configured to optimize by multiplexing client requests over existing serverside requests. On the

You can see where wireshark looks for your settings by going to "Wireshark" -> "About Wireshark" and then open the "F

@JasMan, yes, "temporary" has a very elastic meaning :-)

@jasman Has the issue been resolved? And if so, what was the root-cause of the issue?

What is the sustained and burst bandwidth that you need to capture? How much storage will you need, based on the average

Is there information in the info column that is not available in any field? Then you're out-of-luck regarding filtering.

You can display stun packets with the filter: stun or classicstun (there are two versions of the stun protocol)

Thanks SYN-bit, your analysis is spot on. Here are the errors I'm seeing when I go to Statistics: 11 Ethertype: Bad che

Here is another capture. This machine was connected to LAN, no WiFi or any other connectivity: https://www.drop

Interesting, so THEY are sending data in the FIN to you and only when THEY do than, the session is not properly closed.

Just to verify, does this session closure cause problems? As all data does get acked. The only thing that does not get a

SIP endpoints (User-Agents) need a constant stream of RTP to play the audio. Usually RTP packets are send each 20ms (as

Setting the TCP FIN flag just means you are done sending data. That is usually done in a separate packet with no data, b

OK, with the AV disabled it works, then I would say you'll need to file a bug-report to the AV vendor. Glad you were abl

So if I understand your problem correctly, when only serving incoming connections, the server is doing great. Once you s

@grahamb In the packet details, the src is a RFC1918 address and is also not resolved in the dst column. It would indee

I suspect you have the "Src addr (unresolved)" in your column definition instead of "Source Address"?

In frame 117548, the client responds to the RST in frame 117547. From the ACK (13685090) it can be deducted that the cli

Hi @vicky71 in the screenshot you selected Data under UDP under IPv4 under Ethernet under Frame, so it makes sense that

Thanks for the kind words @chuckc tshark -G fields will give you an overview of the (thousands) of available fields. Yo

Thanks for the kind words @chuckc tshark -G will give you an overview of the (thousands) of available fields. You could

You're welcome, glad I could help!

You're welcom, glad I could help!

The most logical explanation is that you changed the layout preferences. Go to Wireshark -> Preferences -> Appeara

Are you able to capture on the PBX? That way you can see how the RTP comes in from the SMS-gateway and how it is forward

Have a look at the Wireshark Wiki page about capturing on Ethernet networks. On a low budget, I like to use a NetGear G

Who is sending the RST and how much delay is there between the last "Session Setup Response"? Also, a pcap file really