alohawireshark's profile - activity

Missing data patterns and inferences I'm a data scientist new to Wireshark/networking data. I pulled some fields from a

I have a 130 MB .pcap file. I tried running the following command:

tshark -r C:\Users\asdf\Desktop\tls_research\4_4_2020.pcap -T fields ^
-e tls_resumed ^
-E header=y -E separator=, -E quote=d -E occurrence=a > C:\Users\asdf\Desktop\tls_research\4_4_2020_10April2020.csv

But I get the error message:

tshark: Some fields aren't valid:
        tls_resumed

I know this field should exist based on the official documentation: https://www.wireshark.org/docs/dfref/...

So how do I proceed if I want the information contained within this field? Is the documentation outdated? Is this a data collection issue? Are there one or more other fields I can use instead? I am attempting to stitch together multiple packets into a single "conversation."

that would do this trick. i guess this is a very bad question -- just a typo. i will delete it. thanks!

tshark: tls.resumed field isn't valid I have a 130 MB .pcap file. I tried running the following command: tshark -r C:\U

thank you. your answer was helpful as well. i lack the reputation to upvote it though.

Is there an explanation or mapping of TCP flags (tcp.flags.str) somewhere? I have Googled and searched the RFCs without luck. I am a data scientist without a networking background, working with networking data.

For example, what does xc2 mean in the following?

<field name="tcp.flags.str" showname="TCP Flags: \xc2\xb7\xc2\xb7\xc2\xb7\xc2\xb7\xc2\xb7\xc2\xb7\xc2\xb7A\xc2\xb7\xc2\xb7\xc2\xb7\xc2\xb7" size="2" pos="46" show="\xc2\xb7\xc2\xb7\xc2\xb7\xc2\xb7\xc2\xb7\xc2\xb7\xc2\xb7A\xc2\xb7\xc2\xb7\xc2\xb7\xc2\xb7" value="5010"/>

tcp.flags.str explanation Is there an explanation or mapping of TCP flags (tcp.flags.str) somewhere? I have Googled and

why is tshark printing output to console? I have some tshark command that is printing the output to console instead of s

Wireshark/tshark: calculating Windows 10 desktop uptime I'm interesting in tracking/calculating the uptime of a Windows

Wireshark/tshark: calculating Windows 10 desktop uptime I'm interesting in tracking/calculating the uptime of a Windows

Hi. The reason I ask is because my .pcap file doesn’t contain a TSVal or TSecr or tcp.options.timestamp.tsecr field, whe

Wireshark equivalent of TSecr? Does Wireshark capture the equivalent of TSecr or provide the information needed to calcu

I am a data scientist analyzing packet data from Wireshark but I do not have a networking background. It's been a laborious process of Googling each filter from the tsharkoutput to build an intuitive understanding of each field, two fields just to illustrate my point: "ip.flags.rb" or "ip.flags." While the shorthand of such fields may have more meaning to an experienced network engineer, most is lost on me. I have reviewed the Wireshark documentation (https://www.wireshark.org/docs/dfref/...) and the definitions are:

ip.flags            Flags   Unsigned integer, 2 bytes   1.0.0 to 3.2.2
ip.flags.rb Reserved bit    Boolean                     1.0.0 to 3.2.2

Such a definition doesn't answer critical questions like, "what is the range of integers for ip.flags and what would be the significance of each? Or, "what is the significance of a 1 for ip.flags.rb as opposed to a 0, i.e. why might it matter if a bit is reserved or not?"

My question is, is there a cheat sheet for newbies/non-network engineers with such information? Thus far, it seems like in-depth explanations can occasionally be found in the Wireshark documentation, albeit spread across many chapters. I can also find discussion of individual fields on forums/blogs, but with 273+ fields to try to understand, I'm wondering if there is a better resource I haven't yet found that is available.

TLS Handshake Ciphersuite: how to extract `showname` string using tshark? I am trying to extract sensible information fr

Wireshark Filter explanations/guide I am a data scientist analyzing packet data from Wireshark but I do not have a netwo

Why do JSON and PDML exports have different data from the same session? I am new to Wireshark. I filtered my captured pa

Thanks Bob. I could test NMAP's uptime calculation using known devices and see how well it performs. However, the popula

it looks like NMAP captures exactly the information I am looking for. Is there a way to get/make an uptime guess from Wi

it looks like NMAP captures exactly the information I am looking for. Is there a way to get/make an uptime guess from Wi

NMAP is actually exactly what I was looking for. Is there a way to get/make an uptime guess from Wireshark packets? We o

NMAP is actually exactly what I was looking for. Is there a way to get/make an uptime guess from Wireshark packets? We o

Sounds like a lot of conditions must be met for boot time information to be captured. I have heard that such information

by boot time, I mean the wall-clock time when the machine booted. and yes, by up-time, i mean how long the machine has b

I am doing a research project in partnership with a company. The company has authoritative DNS servers.

Infer machine boot time/up-time from network packets? Is it possible to infer machine boot time/up-time from network pac

thank you. that is helpful information

thank you. that is helpful information for me to unpack there

How to capture RTP packets? I am trying to find the clock drift information for each of the machines (e.g. my work lapto

How to capture RTP packets? I am trying to figure out the clock drift of the machines using my router/Internet. Based on