grahamb's profile - overview

● Commentator   × 1

• where is the reference of dtdParse function

● Editor   × 1

• How do I get and display packet data information at a specific byte from the first byte?

● Necromancer   × 1

• What can be done to prevent the new Q&A site from devolving into the old one, particularly with respect to spam accounts?

● Supporter   × 1

• Error while creating a Lua listener in 2.4.2 with filter

● Autobiographer   × 1

● Rapid Responder   × 954

• What is the Markdown syntax supported by AskBot
• How to capture USB packets please?
• How do I get and display packet data information at a specific byte from the first byte?
• How do you search by "question" on the old ask.wireshark.org site?
• DNP3 Group0 Support
• How do I add "child item" to an item in the subtree?
• Which version of WS supports WPA2 decryption?
• Getting error MSB4018 when trying to build wireshark sources
• I've imported an .pem key, but why wireshark recognize it as .p12?
• Count specific frame from the given log
• SOME/IP Plugin under windows
• How to filter out TCP retransmissions
• How can I see traffic between two devices on the same network
• im wanting a wifi device or download
• filtering out protocol, sequence number, and ack using tshark
• Monitoring UDP data on wireshark shows ARP packet
• how to use wireshark?
• Using tshark filters to extract only interesting traffic from 12GB trace
• How do I filter out all other traffic which are not relevant during telneting process?
• where do I find a version of Wireshark that works with the Nordic BLE sniffer plugin
• How do I dissect multiple packets?
• How do I get relative ack number greater than sequence number?
• Not able to build the wireshark
• Error while building wireshark source code using MSbuild
• how to change COL_PROTOCOL with lua code
• Wireshark & SIEM
• suppress(disable or grade out) check for updates and downloads in help menu for Wireshark 2.2.1
• Reason for different update paths?
• how does wireshark dissect the protocol above TCP?
• Trying to figure out what modbus register addresses are being requested in a capture
• why cant I see both sides of a SSDP M-SEARCH interaction?
• USB not working in virtualbox after usbpcap installation
• USB not working in virtualbox after usbpcap installation
• "npcap" "Failed to create the npf service for win7, win8 and win10"
• Can't install Wireshark 2.4.3
• Tshark TCP stream assembly
• Tshark TCP stream assembly
• SSL/TLS Handshake Immediately Fails
• I built wireshark 2.5.0 however there are no dissectors in the epan/dissector directory, there are in the wireshark source directory copied with Git
• How to create and install new own plugin in wireshark for filtering CAN packets in Ubunutu 16.04LTS
• I/O Graph layout
• wireshark.exe procedure entry point not found
• build errors. First time cmake user
• Printer sending RST, ACK to computer continuously without pending job
• Decoding of Tx attenuation field in the Radiotap Header of the data link type 'IEEE802_11_RADIOTAP'?
• Cannot access Ethernet interfaces with Wireshark Portable unless I install full WinPCap?
• Can I filter out ack responses to packets otherwise filetered out?
• Analyzing in Excel
• how can i capture http protocols
• Can wireshark get gopro hero 4 bluetooth pin code? my screen is cracked so i get 2 didgits.?
• How can I add any field in wireshark in order to analyse packet
• -Q -P Tshark flags works fine for text but doesn't work for pcap
• Nice filters
• How do I filter using a range IPv4 addresses?
• Module is not loading in Windows 10
• How do I rewrite the Ethernet II protocol type to 0x8100?
• How can I resolve the issue of not being able to see my computer interfaces?
• Would Like To See Kid's Email/Email Password on Home WiFi
• System Error
• tshark - list of protocols in capture
• Export object in tshark
• How to kill dumpcap.exe - not able to kill it with taskkill running as admin
• Is it possible for Wireshark to SEND a Frame with a custom payload ?
• Decode Microsoft xpress compression
• How can I decode TLS that uses DH?
• How to get printable text of multiple packets at once?
• Can't see encrypted application data in SSL session
• How to run a tshark command on the background in c++
• mixing c/c++ to write a plugin
• writing a modular dissector plugin
• Capture TCP traffic from other machines over WiFi
• unable to decrypt ssl with server private key
• Discovery network device types
• In the latest version of wireshark 2.6.0 we are seeing encrypted alerts when they clearly are not.
• Procedure to build the dev branch
• wlan_mgt.fixed.action_code is showing as an invalid filter on Wireshark 2.6.0
• On Windows, how can I get a list of source IP addresses in network traffic with duplicates removed?
• how to capture udp traffic with a length of 94
• Decrypting Application Data with Private Key File
• How to capture clear text traffic from devices that arent my computer
• Wireshark 2.6.0 not capturing transmitted packets from pc on Windows 10
• How to dissect a VLAN frame based on Ethertype
• Win10 can't set monitor mode on
• Save packet data as hex string
• Get index of DissectorTable from a subdissector
• How to determine which processes are sending CLDAP Protocol to DST Port 389
• how to see the interface details in Wireshark 2.6.1?
• Excercise for school regarding pcap
• CFLOW decode IPFIX sequence number
• How much bandwidth going to streaming services?
• do we have saperate windows for tcp stream
• How do I change this color scheme?
• How can i log the received bandwidth every 1ms of an UDP application?
• Help Manual pages missing after Win7 build
• How can be create a filter for a particular label ?
• Under what source folder is the code to edit the statistics tab of the UI?
• How to change "Packet Bytes" pane color
• install tshark on windows with non admin user
• what is the license for the Wireshark GUI?
• Data is not captured from development board
• Wireshark installed but no Windows 10 shortcuts or Start listing
• tshark not showing diameter data
• CEI 61850 GOOSE
• Ignoring false bytes in tvb
• tshark export to ek json too slow?
• Can I see the history of people using my wifi?
• timestamp diameter after decode as
• time limit for tshark capturing
• Using WireShark to inject data (man-in-middle)
• I want to understand how Wireshark identifies the L7 applications correctly which are not running on standard port?
• How to convert .pcap to text format for twamp without using tshark
• I have seen people talk about BACnet mstp capturing being available in 2.4.4 and higher but can't seem to find it. Do you still need to create the pipe for it or is there an add in available?
• How to create trigger on (4) or more ENIP (UDP) protocol requests from a PLC to an AB842E absolute encoder with no responses or other packets from the AB842E to the PLC?
• .dll has no "plugin_want_major" symbol
• Can Wireshark Portable be used on 64Bit systems?
• Trojan found by VirusTotal scan in WireShark Windows 64 bit installer
• A way to filter AOE requests without responses
• A number is being displayed in the Protocol column
• tshark syntax error
• msvcp120.dll Not Found
• MONGO dissector not applied
• with wireshark can I see the traffic between the site and other IPs addresses or only the traffic between the site and my PC? Can I see the IP addresses where the site sends/receive packets to/from?
• Which is the latest Wireshark version that is supported by Windows 2003 SP2 ?
• Absolute time in tshark
• Problem with GeoIP
• How do I validate wireshark download?
• Wireshark Windows Server 2012 R2 not starting
• Unable to access data in second IOA
• Can Wireshark be virtualized and work properly?
• I want to write a new dissector. Should I use the development source or the latest version source. What's the difference?
• how to test and capture jumbo frame transmission?
• New versions of Wireshark no longer working on unpatched Windows system( api-ms-win-crt-runtime-l1-0.dll )
• tshark view mac address (vendor) name
• Setting a field optional when registering the header? (possible?)
• Support for Dark Theme
• wireshark only shows youtube app packets for smartphones.
• tomcat 8.5 no longer sends OK with HTTP response
• Wireshark download version 2.0.3 missing ".exe".
• Does Wireshark support BGP regular expressions in filters?
• tshark and bash script to log network interfaces
• While compiling Wireshark-v2x several files are missing
• when I open WS it does not show any interfaces, why?
• filter the responses to a matched HTTP requests
• gtp.sai_sac field size limitation
• IS-41 (SS7 CDMA) protocol is flagging unexpected optional parameters as BER errors.
• what is the next Wireshark release date and version number? Please specify if this will be a stable release OR development release.
• wireshark 2.6.5 32 bit version Trojan Virus
• Is there any possibilities to extract pcap files to get 5 tuples then change it into txt file for Statistical Machine Learning?
• GeoIP with Tshark in linux without GUI
• wireless packet capture
• Dissector doesn't do anything
• Register routine, register_tap_listener, register_wtap_module, register_codec_module routines
• Getting a PDF file from printing job
• Getting a PDF file from printing job
• How do I monitor websites visited through my wifi?
• Wireshark not detecting file sets
• Modbus queries / responses
• Showing specific HTTP answers of filtered requests
• remote interface problems
• Can I skip "Finding Local Interfaces"?
• IO Graph in Help/User Guides does not match what Wireshark presents me
• Display filter - "show last 5 minutes of the capture file"
• unknown (for me) traffic
• Wireshark .CSV capable?
• Different protocols are used throughout the different networking layers, how can you observe a request as it is encapsulated at each layer?
• ip source and destination appears to be backwards
• Saving, opening, and viewing a .jpg from an TCP stream over FTP
• long delay to send [FIN, ACK] after receiving the application data
• Show Delta time after sorting by a column
• install two wireshark through command in line silent mode
• Response times = delta times after reordering (sorting) the row values.
• I can not see any traffic when I filter my device's MAC address
• Lua dissector: Field extractor to get the last matched userdata
• SSL TLS1.3 Decryption
• Why do I get an error with this tshark command line on Windows?
• viewing USB packet, display a signed int?
• how make ip filter in tshark????
• How can I filter-out a range of IP Addresses belonging to a given subnet (and not the whole subnet)
• Are elevated privileges required in Wireshark 3.0.0 on Windows?
• tshark - How can I specify a tab as the -E aggregator character? /s becomes a space, but /t becomes a forward slash, a keyboard tab generates a syntax error.
• Enable packet editing function
• SSL Protocol Preferences in Wireshark 3.0
• WSGD Bitfields and byte order
• Running windows 7, my interface card and loopback device disappeared in WS 3 but 3 USBPcaps stil there
• extracting source and destination station addresses?
• dissector length
• SSL in Protocol-list
• does NPCAP on windows7 or windows10 support VMplayer Bridge traffic
• Network drive not showing up in Wireshark File dialog
• How to call dissector for IPv6 next header
• Unable to Install wireshark 3.0.0 in Windows Server 2008 R2
• Loading of plugin fails because of plugin_register symbol
• Merge Hex Dump files
• What are these packets with an Ethertype of 0x0e00?
• how to run wireshark over ssh
• -z conv,ip just reads my file frame by frame with tshark version 3.0.0
• frame 1 [syn] -> frame 2 [rst, ack] on port 25 of remote server
• Change I/O graph units from packets to bits/sec
• how do you install Audiocodes Plugin?
• Outgoing TCP Traffic not captured
• MDaemon Windows Server SSL Certificates
• How to capture traffic of the device (router) I am connected with
• About using Dissectors in other applications
• Cannot use Telephony via CMD
• Microsoft Xpress compression algorithm
• Why can't I install the latest Wireshark on Windows Server?
• Finding a device sending spam emails
• Where can I find Wireshark 2.2?
• Capture filter for vlan tagged packets and non vlan tagged packets of specific ethertype
• Analyzing Packets from Amazon Echo
• Oracle DB request connection packets always identified as malformed
• Wireshark incorrectly interpreting the format of MQTT PUBLISH payload data
• Lua: Error During execution of dialog callback: mpeg_packets_dump.lua:44: zx: Permission denied
• Lua: Error During execution of dialog callback: mpeg_packets_dump.lua:44: zx: Permission denied
• Is it possible to create a dissector for Wireshark in C in Visual Studio 2019 IDE and add it to the wireshark source code?
• I am getting an error "no plugin_version" symbol when I add a dll as plugin and start wireshark. How or where can i find the Plugin versions for custom dll in wireshark? How to solve the error ?
• With a capture filter on a remote interface, where does the filtering occur? Also, how are the packets transmitted?
• SILK playback
• missing capture interface (CTRL + I), where can i find it?
• Source files changed after build
• How can I delete first n number of frames from memory in tshark
• Do we need a pcap header format to display captured packets via named pipes on Wireshark?
• How to capture RTP packets?
• how does wireshark support quic decryption
• smb or smb2 packets are all parsed to tcp
• Diameter 'Answer In'/'Request In' fields not available with tshark/pyshark
• Linking packets in a dissector
• development install issues
• alternative for libwireshark.lib in 64 bit
• Export to text with tshark
• Windows setup (win-setup.ps1) failed
• Trying to add own custom plugin getting this error:"The file contains a character starting at offset 0x11021 that is illegal in the current source character set (codepage 65001)."
• error MSB6006: "cmd.exe " exited with code 1. [C:\Development\wsbuild64\plugins\epan\homematic\homematic.vcxproj]
• decrypt https sessions
• Error: File "C:\Development\wireshark\tools\make-plugin-reg.py", line 78, in <module> 1> contents = file.read()
• How to use extcap with pipes?
• deprecated ssl extension
• How Do I Filter display duplicate IP?
• Tshark commands lines statistics
• Sample packet capture for NGAP and N1 N2
• IO Graph too many data points
• Can I create a subdissector based on CAN ID?
• Decrypt TLS 1.3 with Wireshark
• TLS1.2 handshaking issue, need help, urgent, thanks a ton!
• IE browser PDF loading stops after TLS Server Hello Done
• on Wireshark 3.0, how could I set "limit each packet to"?
• Wireshark 3.02 fails to install vcredist on WIndows 10
• How to package QT DLLs during packaging Wireshark on Windows using NSIS
• (suspected) retransmission
• Network interface switches
• lua_scriptnum:argument
• Why do I get a link error when I call proto_tree_add_format_wsp_text() in my dissector?
• print scope
• can i see a passward for a forgotten device connected to wifi
• SYN,ACK not followed by ACK response (noob question)
• dumpcap problem with multiple interfaces and filter
• Garbled text issue from unencrypted communication.
• Using tshark to display throughput on a live capture
• ZigBee3 protocol dissector and not correctly recognized cluster 0x0B04 Electrical Measurements
• Packet Bytes window only shows 8 bytes of dump rather than the 16 bytes
• interfaces are not seen after upgrade windows 10 to 1903
• Decrypting encrypted traffic
• Why can't I capture other device's packets on the Wi-Fi network?
• Can't Capture Logins
• Why I can not find my clear text login credentials in Wireshark traffic
• How can I enable Monitor mode within Win10 OS
• Why does my request end in timeout?
• Is there any version of wireshark which support coap over TCP and coap over websockets?
• Wireshark Debug. Where packet data is stored?
• Why is the TLS1.2 Server Hello not recognized?
• decrypt saved capture with private key
• How to access new key files in the SSH preferences.
• How can I capture packets without admin login?
• missing file on Vista install V2.4.5
• I am not able to see F5ethtrailer details on the wireshark version 3.0.3
• Why do Tshark gives two data_rate?
• tcp.nxtseq not incremented on zero len SYN/FIN packets
• How do you pass arguments to subdissectors in Lua?
• Procedure entry point PacketGetMonitorMode could not be located in the DLL
• Newbee question: Unable to use wireshark filter syntax.
• Errors building on Windows
• Wireshark seems to misinterprete some TCP packets
• Is it possible to start a capture's timer when the capture button is clicked?
• What happens in background when I set path to Pre-Master-Secret log file?
• DNP 3 reassemble fragments while sequence number is resetting to 0
• Capture Filter for TLS
• Text part of the hex dump pane isn't showing the packet bytes as ASCII characters
• Capture Filter for TLS
• can anyone explain this?
• view vlan tagging with Win10pcap, not npcap - a good idea?
• How to capture HTTPS traffic to specific domain?
• extraction of all tcp streams with tshark
• How do I install npcap without it making the same mac address on every computer?
• Two-pane layout by default
• Can we append new filter content while pressing customized filter button but not replacing existing filter?
• tshark ring-buffer duration vs interval
• To my knowledge I gained from 2 days working with wireshark, it is used to analyze network traffic and we could use filters to filter them. Is that right? Can we do something more than that using this tool?
• From where does wireshark get the traffic? Where does it reside?
• How does tshark read files with dns entries saved with -H?
• AirPcap and Wireshark 3.03
• Use display filter functions in column definitions
• dvb-s2 example pcap file not interpreted correctly
• build of wireshark using visual studio 16 2019, on windows 8.1 failing.
• Command - Completion Event Association Bug in bthci dissectors
• how to display column with doip user data using field name doip.data
• I can't see the HTTP packets of another computer connected in my own private network
• Unable to display IEEE1722-1 packet in Wireshark 3.0.3
• Why is there traffic from and to an external IP address in my network?
• percentage of each application layer protocol in a pcap file
• "ssl.record.length" is deprecated
• Wireshark not opening "decode as" window
• Do I Need to Turn Off My VPN to See My Activity Stream Correctly?
• where can I get java cookies cadger?
• Is there a way to show non truncated data with tshark without recompiling?
• How to capture the internal Ethernet data packets using npcap driver ?
• I only see my traffic!
• Loopback npcap added in Win10 network
• Can Wireshark perform security scans on android
• Display filter field names in the csv file
• tshark tcp stream Raw data is not output to the end
• Please update Npcap 0.995 in release package
• Dissection of CIP Message Router Response
• Can Wireshark be used as a message duplicator?
• Decoding HDCP2 packets
• MSVC 2017 wireshark project. ALL_BUILD Access denied
• Cannot filter on single IP
• Why is TLS Decryption is MUCH slower on Windows 10 than MacOS?
• get_foo_message_len - What should this function return?
• Is there a way to configure custom installation settings via command line/silently?
• How can I capture web traffic on my local network?
• I want to get the IP addresses list in the response returned by bitcoin.addr command
• Where can i find the wireshark 2.6.11 developers guide?
• msbuild /m /p:Configuration=RelWithDebInfo Wireshark.sln fails
• new update breaks virtual desktop
• wireshark supports quic version 46?
• TCP reassembly - How do you determine the PDU length when there is no length field?
• How to extract certificate from SSL session setup trace
• what does this info mean?
• RX and TX packets identification
• TCP much larger than 1460 bytes?
• check if login mail is successful
• HOW do I use this? What can it do? How do I read/make sense of its output?
• MacOS Server SMTP Negotiation Issues
• extcap - using external driver
• admin only mode
• Missing "Certificate" TLS record
• Can someone confirm the decoding of All sub-options of DHCP option under Profinet-DCP?
• How to configure wire shark to use as zigbee sniffer
• how to download latest wireshark version dynamically?
• How to build and install tshark without Wireshark?
• Antivirus NDIS filter driver
• How to fix dumpcap.exe not found? Windows 10 Enterprise LTSC
• Intercept HTTP requests / responses and add custom header
• Homeplug AV
• how can one Sniff a SMTP session from HELO to QUIT
• Inspect SIP inside OpenVPN pcap (with key)
• Error when trying to start capture
• Can Wireshark 3.x run with WinPCap 4.1.3?
• I am not able to find the correct/wrong "frame check sequence" in wireshark v3.0.2. All it show is [unverified]. How do i find the wlan.fcs.status==1 in this version?
• How to write a dump file without package bytes (only lines of text-package list), and that at the same time it was possible to read this file in real time?
• How to convert multiple .packet or .pcap files to a single csv file.
• what will happen if the client receives syn ack retransmission when it is in fin-wait-1
• How to fix: Adapter for loopback traffic capture.
• tshark api to generate json from pcap
• decrypting ssl traffic
• Export filtered packets
• How do I extract the hex section from a pcap file?
• random data going to broadcast
• Installation on Win 10 failed
• SML dissector doesn't work
• wire shark only showing Adapter for loop back traffic capture
• Why is wireshark not detecting my network adapter?
• I captured what I believe is an unpatchable attack
• How to find mapping for dissector?
• What does a TCP zero window message implies?
• Wireshark Supported Language?
• Network Time Security (NTS) dissector
• Call analysis capabilities
• How to use the ethers file
• All downloads from the site are getting 403 Forbidden from Cloudfare
• I need to know about the latest wireshark version and user guide?
• Find in files
• Need to apply filter on zigbee packets through command line
• How to find out problem in Ethernet Frame
• Compromised, How and Where to look for the info/proof to nail the suspect.
• Extract http objects to files with python
• Continuously observing [TCP Previous segment not captured] , Ignored Unknown Record
• How to store raw hexdump as a pcap file?
• opening .tar packet capture files from Grandstream products
• Dissector bug info: field casn1xxxprotocol is not of type FT_NONE
• What is Ftp Request FEAT and Response 211 Features
• Hi , I am trying to filter sip traffic using tshark with capture filter option and specific sip from header field value.
• Access denied in command prompt
• Installing wireshark on virtualmachine win7, error23
• I'd like to find an end-point device that generates an error
• How do I filter/capture/read packets of one protocol embedded in another?
• RSC getting disabled after starting wireshark in Windows server 2019.
• I can't capture switched TCP traffic
• how to build source code of wire shark using visual studio 2019? i have cloned the source code from repository(branch default:remote HEAD)
• Can we freely distribute customized wireshark windows installer with npcap?
• Why do I keep getting the error, "No interfaces found"?
• How doing the diff between two pcap file and store de results
• Dissection Ethernet/DVB-S2
• Wireshark(3.2.0) displaying the 6lowpan source link-local address incorrect
• How do I track all the websites visited on my home wifi network?
• Are there any chance for wireshark to determine 802.15.4 protocols incorrectly?
• How to examine traffic to 1 specific server?
• TShark CSV export problem
• Recording users and exporting in real time
• Restrict Wireshark delivery with default-filter
• Conversion of data through tshark
• it's ok to sizeof(nspr_hd_v20_t) or it should be sizeof(nspr_pktracefull_v20_t) ?
• How to removing all filters?
• Is posssible decoding stream TLSv1.2?
• Unable to parse Mpeg-ts properties
• where can I report a bug in RDM DEFAULT_SLOT_VALUE ?
• New to WireShark: How do I get traffic on local Area Connection?
• problem compiling wireshark under Windows
• USB serial COM capture not working
• Need to upgrade wireshark version on redhat
• How to add a vendor to the Diameter dictionary
• can i find out who makes a product by using the mac address
• Monitor packets between two devices (WiFi)
• Sniffing specific application traffics.
• With Wireshark 3.2 on Windows with Npcap, the only interface is the loopback interface
• Decoder does not work using "Importing from Hex Dump"
• how to follow process on Windows
• HTTP 302 FOUND
• how to decrypt TLS v1.2 Diffie-Hellman
• Need help on filtering
• Can I remotely use wireshark?
• how to find the OS of the target machine in a pcap?
• Not seeing an HTTP response to an HTTP GET
• Why are only loopback and usb capture interfaces shown on Windows?
• No Response found on ICMP Request
• Adding a custom dissector to wireshark
• Why am I not seeing the Ethernet interface on my Windows machine?
• Wireshark 3.2.1 fails installation on Windows on "vcredist_x64.exe"
• Invalid tcp handshake behaviour
• Client-server communication on localhost not showing up
• To "Analyze TCP sequence numbers" or not to analyze?
• Is there an SDK to write dissectors?
• Getting a lot of Who has 10.0.30.30? Tell 10.0.30.1
• how do you go about analysing wireshark logs please
• Payload of packets generated by text2pcap doesn't appear as L7 payload
• Could ESP be added as a Conversation Type?
• Is it possible to read the content of any of the web sessions?
• How to activate promiscous mode
• at any particular time multiple transactions are getting captured in single packets.How to separate them in separate packets?
• Extract specific byte offset using tshark
• No interface available for capture on Win server 2008 R2
• Does tshark currently support QUIC packet analysis ?
• Stuck on startup can't see/use interfaces
• Why you needed to use `sudo’ when executing Wireshark? (what would happen if you did not use `sudo’).
• Unable to compile wireshark plugin on windows 10
• tshark does not filter packets inside docker container
• New to Wireshark and attempting to snoop USB
• Can I use an existing .exe as a plugin
• Exporting PDUs fails on a different port
• Wireshark Filter explanations/guide
• data column
• How do I use wireshark with rainbow six siege
• packet capture to CSV
• tcp.flags.str explanation
• how to write a namedpipe for wireshark?
• How to automate following TLS streams?
• TLS decryption between an application and a website
• New to wireshark, need help, software fails to livestream to Facebook.
• How to read a pcap file packet per packet
• How to decode protobuf by wireshark
• i can"t install wireshark on my windows 10 it say the visual c++ redistributable installer failed with error 1618 please make sure you have KB2999226
• How to combine two filter in tshark
• Where do I mistake when trying to decrypt my own tls1.2 traffic with Wireshark?
• How to make a usermod for usermod -a -G wireshark _your_username_ to work
• Does Wireshark has ISO9001 certificate?
• Is it planned to integrate lua 5.3 instead of lua 5.2.4 into wireshark ?
• Why Wireshark don't annotate all reassembled packets with "tcp segment of a reassembled pdu"
• Not able to compile packet-pkcs12-template.c
• Is MSS value of servers always fixe
• Can a capture be saved in files on multiple drives?
• proto_tree_add_format_text in plugins
• How do I get my PC to reflect/send back Ethernet pkts it receives?
• If Wireshark is licensed under GPL2, does NpCap licensing even come into play for distribution?
• No tcp-syn packet or tcp-fin packets.
• Printer Error
• The output formats in Wireshark 3.0.x and Wireshark 3.2.x for decimals differ
• Decoding Modbus TCP on different port number
• Wireshark doesn't capture all packets
• dissector print format ?
• Can I Capture Mesh Network Traffic?
• google address appears from Wireshark manufacturer database
• Does wireshark account for Adjusted host files?
• How to get default view back
• {RST, ACK} ports 61820 >28130
• I can't decrypt my TLS traffic
• winflexbison installer has malware?
• Tshark -d option to format date doesn't work with -T fields
• Tshark frame.time format
• Command Line port filter
• Change frame/tcp length on sliced packets
• BPF boolean logic
• extract file from FTP stream with tshark
• Is it possible to directly dissect a hex data instead of a packet?
• Tshark crashes if I run it after changing the default interface (in Wireshark)
• tcp.delta times on graph
• Is it possible to get an even older version of wireshark for my mac?
• install to write plug-in dissector
• How to decrypt the "SSL" or "TLS" traffic in wireshark?
• TCP reassembly > How does Wireshark handle missing segments?
• Where do I find 3rdparty libraries/packages used by wireshark
• the capture file appears to be damaged or corrupt
• ANONSVN not responding
• How can I see what devices connect to what websites?
• calculate md5 for each packet and output to new file with updated field
• Handshake Modbus/TCP
• Dissector for RFC 8505
• How to plot 'Time delta from previous captured frame' in statistics
• How do I watch traffic to and from exactmetrics.com on my Mac. Newbie
• Read Header packet
• Enhancing export objects for TSHARK
• Decrypting ISAKMP phase 1 packets 5 and 6
• Dissector bug, protocol AMQP
• IEC-104 (IEC 60870-5-104) protocol specifications
• unregister the dissector/protocol to build tshark
• Dissector stability guarantees
• Finding out the cause for a connection reset
• Tshark filter IP and Port + save in pcapng format
• Inconsistent g_snprintf behaviour (Wireshark 3.2.5)
• Wireshark capture problem when connected to VPN (PPTP)
• What capture filter will test whether the DSCP value in the IPv4 header is in a particular range?
• Capture Filter for FRAMES
• Is it possible to detect what is blocking port 80
• Data packets from mobile device not captured?
• How do I extract the right information of a pcap file with pcap2matlab?
• Find the server Elliptic curve
• Why is my TCP Header Seen as "Data (20 Bytes)"?
• http message not visible but tcp is
• Are there some issues on IEEE802.15.4 IEs dissection necessary for WISUN standard based on IEEE802.1x and IEEE802.11?
• Is it still possible to make a dissector plugin for Wireshark in python ?
• TLS record layer and Handshake protocol
• 2way SSL is set in IIS, in browser a client certificate is required, but when i capture the traffic in wireshark i see the handshake type is '11'
• How to avoid ICMP "Destination Protocol Unreachable" with ERSPAN to WIndows 10
• How to use WinPcap_silent
• Need help on Git over SSH or HTTPS
• IS SSTP-dissector broken or can I simply not select it?
• Mentor or Guide needed for Python code to run extcap programs outside Wireshark
• Can Wireshark convert sflow packets to "normal" traffic
• Which version do I download for iPhone 6s
• Is there an openwire dissector
• Process of adding protocol decodes in wireshark.
• How to decode DVI4 8K Payload in Wireshark?
• Format column display
• Wireshark Win64 3.2.5 silent install
• Trying to Understand Protocol Hierarchy Statistics
• Unable to connect to internet through ethernet
• Why are all remote MAC addresses HonHaiPr_85:c9:be (94:39:e5:85:c9:be)
• How to capture DNP over TCP or IP?
• Data change after saving
• Decoding Dynamic Payloads.
• WireShark just does not see my Wintun Userspace Tunnel vpn interface
• MCPTT SDP doesn't decoded
• NTPv4 Autokey protocol: pcap does not meet the standard
• What does a Malformed packet mean in BacNet MSTP? Has Anybody else seen this?
• How do you know that Npcap is installed
• Can I call any other executable/program from wireshark?
• Is there a place I can get an executable Wireshark for Debian?
• Column format
• Column format
• I want to capture only Wi-Fi traffic to and from my PC, not other PCs
• Capture traffic for certain device
• Wireshark to filter out several websites
• Can Wireshark help you to trace what webpages an android device surf?
• How to display the interface name on trace
• Content-Length vs Packet Length
• How can I reassemble OPC data PDUs in wireshark? am
• How to find the program that was executed to compromise the user?
• Get IP/host informations of an app.
• exporting of full dissections
• How to add a core developer to a merge request?
• 3.2.7 error message
• By which of the following methods Wireshark detects TCP Retransmissions?
• capture serial data using USBPcap
• which wireshark filter shall i use to check if some ip is blocked at the server end
• Wireshark with packet visualizer beta search
• How stable is the development build?
• Can't find correct ips.
• After several hours of operation on Windows 10, wireshark stops with "The network adapter on which the capture was being done is no longer running"
• After several hours of operation on Windows 10, wireshark stops with "The network adapter on which the capture was being done is no longer running"
• RDP attacks
• How to deprecate a dissector
• I am beginner here kindly help me out on how can i start contributing to this open source.
• Filter and add extra fields in the pcap
• Can you download WIRESHARK on a chromebook?
• How can I obtain my RSA Private Key?
• How do I decrypt java TLS traffic?
• No server reply to client SYN TCP connection request
• How do I post the contents of the Wireshark -> Help -> About Wireshark dialog as text?
• Is there a simple way to plot the values within a packet vs. Time
• Unable to decrypt TLS using (Pre)-Master-Secret log and/or RSA Keys
• IPv6 after MPLS not being decoded
• Cannot see SSH Remote Capture option
• WiresharkPortable 3.4.0 suspected of malware?
• TCP client to server data to NSS listener, NBT (NetBIOS over TCP)
• can i activate monitor mode on a ethernet cable
• Dealing with Fragmentation/Reassembly
• How can I delete excess interfaces?
• How do I know what the upper layer protocol is above TCP or UDP?
• NPCAP Install failure 0x8007007e
• Segmentation fault (core dumped)
• Frame Length that is greater than IP Total Length plus Ethernet Header
• How to create a tree with two subtrees in a plugin dissector (c)?
• windows wireshark build error:CAN NOT FIND GLIB2
• endpoints IPv4 tab no coordinates
• splitting pcap file with editcap
• How can I view an HTTP request and response as plain text?
• How can I filter for traffic only a specific port?
• Capture wireless traffic
• make wireshark.exe return json via cmd
• Are these DHCP requests and responses OK
• what is the best way to clean up in extcap?
• How to install the development header file from source ?
• One Entry per Source-IP/Dest-Port
• Modbus/TCP decoding "func 3" seems wrong
• Please add support for the following AVP: TCP-Source-Port
• How can i create own errors in wireshark dissector
• No internet until I open Wireshark
• Problem with extcap preferences in TShark (Wireshark) 3.4.2
• How to disable CLI "Update list of packets in real time" option
• How can I use the ssh key log file?
• npcap install query
• show tcp streams which don't include string
• Can i add Packet colorization in my Wireshark Dissector Plugin (c)
• Wireshark is telling me to run this comand "sudo usermod -a -G wireshark {your username}". What username does it mean?
• decrypting traffic on my own hotspot
• enhancement req: grpc dissector content type and header path as private info
• Decrypting QUIC packets on Wireshark
• Capturing handshake between a SIP handset & PBX
• How Do I Change WS Screen Colors ?
• Capture session could not be initiated on interface
• Is it possible to load an xml file to a custom plugin c dissector?
• Is it possible to install LUA plugins as part of a Wireshark installer
• Where can I download source code for DECT dissectors from Dosch and Amand?
• cant capture smartphone packets
• Hi ... can Wireshark work with the 6 GHz spectrum with a WiFi 6E AX210 PCIE WiFi Card?
• capture for phone packets
• Building on Debian 10 - gcrypt not found?
• wireshark is not showing http nor https for a specific IP
• How do I go about adding a new protocol
• How to install Npcap for wireshark on a galaxy S book with a 64-bit ARM that emulates a 32 bit x86 processor?
• How to capture traffic at Windows Filter Driver level
• extracting UDP stream as ascii
• Hi. Wireshark doesn´t work for VPN interface. I have the last version Wireshark and W10 64 bits. Thank you
• Getting an ip on my wifi from china?
• How to find what cipher TLS1.2 is using
• Wireshark isn't letting me change the parameters I specified for sshdump
• Manually configuring Service Port names on Windows?
• Is it possible to add variable values to the expert info?
• How do I start a capture in Wireshark via the command line?
• Why are their differences in the Ethernet II frame?
• Mac Address and Network Interface
• How to debug Wireshark crash
• how to build plugin dll separately in linux ENV
• What the reason for the existence of these 0s in the packet byte pane?
• Is it possible to put data from several frames in one tvbuff_t buffer?
• Need to print time in human readable format
• Check individual bits
• How can I call one dissector from another
• How to view the packet diagram
• why has traffic doubled?
• Any way for clean packets from TZSP
• How do I find two consecutive frames from the same IP source address
• Host conversations - IP or TCP
• Do you have a hash of your install files?
• How could I potentially export the actual binary file from a POST request?
• Windows 10 - no interfaces found
• Sniffing COM Ports with Wireshark
• capture interface not displayed
• compound filter
• Unknown protocol -- "pn_rt"
• How can I see which URL has been visited with the home network?
• device type or device version trough the protocol header frame
• TCP Dup ACK after reconnection - sequence number problem?
• Humax YouView IP update address
• Wireshark can't capture UDP packet
• How to set promiscuous mode and determine inbound traffic
• How do I arrange to capture only packets of interest?
• Undissecting tcp2123/tcp2152 currently dissected as GTP
• How to find router password with wireshark?
• How do I compare 2 PCAP files in Wireshark?
• Suspicious activity in my network
• search packet
• How can I create plugins for wireshark version 3.4?
• Modbus tcp communication fault finding
• How do I get help with and/or report a dissector problem?
• How to capture traffic from Nintendo Switch?
• Wireshark version for windows XP operating system
• Is this a Wireshark bug?
• Error compiling Wireshark with Visual Studio 2019: Previous IPDB not found return to full compilation
• Related packet symbols in Lua dissector
• What is the best version of Wireshark to download for WSL2?
• Hi, my machine is little endian and in wireshark code everywhere I am using "ENC_BIG_ENDIAN". Will it affect the execution?
• DNP3 - filtering and displaying a specific point number?
• Cloud Capture
• Wireshark (Win 10) No longer finds all interfaces (only USBPcap)
• How to reduce the load while analysing big file?
• Create apk package for alpine
• Rookie wireshark question
• OPC classic
• How to use Editcap on Windows?
• How should I correctly use "Resolving names"?
• is it possible to download Wireshark on a MacBook M1, or parallels windows ARM64? If so please share how to do this.
• Dumpcap/tshark hint on how to use -b filter
• ip host host.example.com
• Captured USBPCAP1 Integrated Laptop Web Cam Device-How do I find out who this is?
• PTPv2 Error and RHEL Update issue
• Is This A MitM Attack?
• Possible to re-connect to a remote host using previously recorded SSH traffic?
• How to resolve a large list of IP addresses?
• IEC61850 Edition 2-1 Sampled Value Message with Grandmaster (Clock) ID
• When I use the "bytes sent since last PSH flag"?
• How Do I Change the Wireshark Colors on Kali Linux ?
• Wireshark not show inbound traffic on public IP server
• dot dot dot at the end of the frame
• Is a particular way one needs to setup up a network in order to capture VOIP streams from IP phones?
• Is it possible to put two different packages together within one line/tree on the main display?
• Filtering odd-length binary data
• Reassemble packages afterwards
• capture filter of GRE
• Error message msvcp140.dll
• How to capture packets between 2 IP’s
• What does exactly mean 'Length' in AH Header (wireshark)?
• Dissector bug, protocol GPRS-LLC
• Automation of packet analysis
• Is there a way to find out SSID of a hidden network?
• How to determine geolocation of access point based on wireshark capture
• How to filter tcp connection finish (FIN) initiated by certain IP
• Is it possible to use ssh dissector to decrypt traffic?
• Expired Cert for Insecure NPCAP Admin-Only mode install
• Inter-Frame references using Conversations and Request/Response
• How to enable the eCPRI packet
• Why are packets captured on "\Device\NPF_Loopback" shown with a red background?
• Does the DRDA dissector support TLS Decryption?
• Can't decrypt 802.11ax udp packets with wpa2
• Can the time column represent the transmission time?
• Difference in used cipher suites
• No response to field -e "ip.checksum_calculated"
• Malformed packet LBMSRS_2
• Export selected http works strange - got another tcp packets
• Can I embed wireshark's OUI lookup in my website?
• How would I find/which URI has an embedded ActiveX control??
• Capturing http traffic
• Switch: nsis_package_prep.vcxproj
• Sniff HTTPS request and decrypt it on my wifi network
• Converting floating-point MMS
• What is Wireshark showing me with a TCP/IP block
• Windows 11 install fails
• intrusion to laptop
• finding communicating devices on network
• tshark unable to cope with fragmented/segmented messages?
• There used to be an option to enable heuristic detection for dnp3 packets. It seems to be missing as of 3.4.9. Has it been removed?
• In what version of Wireshark will the { 0x91, "Destination FQDN" } be implemented?
• Capture Setup for Home Network - Help! (beginner)
• How can I capture traffic continuously, with multiple interfaces on multiple nics?
• Visual C++ Redistributable installer failed
• Communication keeps on restarting between Source and Client, noticed RST, ACK.
• Does Wireshark support L4S protocol
• Does Wireshark use the Telerik UI ASP.NET AJAX controls suite?
• How to get all the domains which use DNS query?
• Add values to a tree that aren't part of the tvb buffer
• Printing captured packets in CSV file
• Use wireshark to scrape data stream used by ToS
• Usage of capinfos metadata
• does wireshark need to be open to log the packets through a wireless network
• Can you manually create a broadcast paket?
• Can someone confirm that Wireshark is NOT vulnerable to log4j/log4shell?
• code.wireshark.org gives 500 (Internal Server Error)
• Dell Latitude 3580 is dead after Wireshark first start
• CSV Export - Missing repeated fields
• TCP Connection disconnect
• How to check why a website is not able to have connection...Please help
• macOS crash setting protobuf search path
• Modbus TCP response timing
• Need to Store the Protocol Heirarchy, Endpoint statistics, Conversation statistics, and http statistics in Json format using Tshark
• Build Wireshark on other IDE other than MS Visual Studio
• can not decrypt zigbee packets using TI Smart Sniffer Agent 2
• Help with TLS1.2 connection issue
• Statistics > Endpoints, how can I show the ports being used?
• Wireshark homelab setup
• Can I download Wireshark on my macOS Monterey V12.0.1?
• Audible alarm on wireshark
• Wireshark no longer displays packets as they are being captured, and "Packets <n>" in footer remains 0
• Why would I get a Cisco and HewlettP as Private IP address on Random Pkt Gen.
• determine the cause of huge packet delay
• How to just save a few frames?
• Command Sequence Number
• how to decrypt tlsv1.2 trafic from wireshark capture file in wireshark
• how does wireshark to analyze some unknown or proprietary protocol ?
• I want rcvd bytes for each device on a network with six devices
• On Windows, how do you stop the monitoring host from generating packets?
• Help to sniff a virus rasomware attack
• can't find msvcp140_1.dll
• Displaying more detail in Packet Detail Window
• Timeout occurring quite regularly
• Why Is a Cadant router showing up on Wireshark
• on you tube I keeping getting "protected payload (kp0)" on wireshark list
• Filter TLS with no Server Hello
• seems like i am missing cjson files for suriwire
• how to activate the suriwire in wireshark?
• Wireshark 3.6.3 doesn't have OPC Protocol
• MAPI filter and dissector documentation?
• MAPI dissector - extend or create?
• Npcap is installed but Wireshark says unable to load on ARM64
• Who use wireshark ?
• Getting fin after push
• Win7 no Interfaces except USBPcap
• Cannot capture non-local packets on MacOS
• Wireshark 3.6.4 on Windows 10 (64 bit) install error.
• How do I install specific version of tshark
• Extracting RTP stats from pcap files using Tshark and using absolute timestamp in epoch
• How can a 13 bit number represent 16 bit number?Or why is fragmentation offset multiple of 8?
• How to Filter for Apple Internet Services Shell Streams64
• Intel MacOS Monterey can't use monitor mode to capture any packets on WiFi
• Is there any way to export files using tshark in csv format?
• Ethernet and wireless card does not show up in wireshark Version 3.6.5
• How could I find some development codes such as config. h, epan/packet.h, plugins/epan/gryphon)
• GUI required? Use on headless Ubuntu Server via SSH?
• Why Is There HTTP traffic?
• Unexplained data usage > Wireshark > Ethernet / NIC config >
• Wireshark Not Automatically Recognizing Some Modbus Traffic
• there say `Change Cipher Spec`? why it do not use `Choose Cipher Suite`?
• Where are display filters implemented in the Wireshark code?
• http-google101.pcapng.
• Rust Dissector Support
• Query On Wireshark Filter with two protocol
• 2 packet comments to a frame
• How can I install tshark on ubuntu so I can use it on the command line?
• display filter for ip & port combination
• Configuring Wireshark to ID Local Apps Downloading Thru svchost
• What versions of Wireshark are compatible with Windows 11
• Interfaces not available after upgrading to 3.6.7
• how to build specific protocol version dissector
• Remove packet comments
• Command line packet dissection?
• Popup Notification: CreateDXGIFactory2 could not be located in the dynamic link library dxgi.exe
• Wireshark.sln does not exist
• Npcap 1.60 will not uninstall
• Cannot initiate capture session on a device after having installed 4.0.0
• how to integrate wireshark with python or java?
• i want to get http.response_for.uri in tshark
• Blocage lors du lancement recherche..
• Wireshark 4 compilation on Centos7
• Proportional Font in release 4.0.1?
• Q.850 - error in label for cause 0x7F
• Editcap ignore first 14 bytes of a packet
• Strange connections since some days
• How do I see the bandwidth being used by each device on the network
• Multiple Handshake Messages After the CCS
• How to see modbus seril data coming from field devices to moxa CN2650I-16-2AC/EU terminal server by using wireshark ..thanks
• Minimal example to read and dissect pcapng file
• How to fullfill GPLv2 license when distributing Plugins?
• time not working - always shows boot time of PC
• Is It Possible to Lock an Installed Npcap From Being Used, For Data Security Reasons?
• Can wireshark show the source process of an outgoing packet
• Tcpdump - any experts to explain exactly what the output means?
• Disabling "Reassemble Fragmented IPv4 datagrams" preference in IPv4 protocol for tshark?
• Display Filters in TSHARK
• How to let tshark reassemble the fragments on GRE?
• Is there a simple setup to use Wireshark to track server connections?
• How can i automate my wireshark forensic captures
• Installed Wireshark and Npcap, but the loopback adaptor is not an option on installation.
• web socket decompressing issue
• Timestamps not working
• Pro-bel SW-P-08 Protocol
• Basic noob question
• problem with npcap installation
• Please allow names for values of fields in filters if the values have names
• network interfaces disappeared
• How to set default for new columns being added
• Wireshark, DNS Over HTTPS, and NextDNS
• When installing Wireshark 4.1.0 x64 it fails
• OpCode 45 exists in TCAP layer for Wireshark Version 3.2.7 but does not in Wireshark Version 4.0.5
• How does the Wireshark tool work?
• Can I please get the latest dev build
• UDP src port 9999 & dst port 9999 - what does it mean?
• I've installed latest Npcap and latest Wireshark and I still get "Local interfaces are unavailable..." error
• npcap packet reassembly
• How do I turn on monitor mode in wireshark on windows in the capture options?
• TCP Retransmits over industrial network
• Wiki.wireshark.org seems to be down
• How to Wireshark capture the traffic.
• What are minimum permissions needed to capture traffic in windows?
• how do I change layout and see packet diagram
• Traffic capture between two i.p. addresses
• We do TCP data transmission more than 1500bytes so the packets are sent as tcp segmented packets but not visible in wireshark but in CANoe segmentation visible.what is the reason?
• trying to load a pcapng file
• Getting thousands of errors while linking Wireshark with QT library
• how to use wireshark for beginners
• Hi All, I need download link for text2pcap and Mergecap for linux server.Please help with the same.Thank you .. !!!
• unhelpfully portable
• The program can't start because minizip.dll is missing from your computer. what i have to do?
• Entry Point Not Found - SystemParametersInfoForDpi
• tshark compile and install on OpenWRT environment
• Lua support in 4.2.0 for Windows
• Can i add a 4th pane to layout
• Does (Win10) Wireshark installation invoke certutil.exe for any reason?
• When I download wire shark it says What Causes “The Procedure Entry Point Could Not Be Located in the Dynamic Link Library” Error? why is it giving me this ? I cannot run it at all
• Help don't access to public adresse IP
• Web server works but not proprietary software with IP address.
• HOW DO I ORIGINALLY DEPLOY AND USE WIRESHARK AFTER INSTALLHOW DO
• How To Fix Wireshark Time-It is the wrong time?
• WiresharkPortable64_4.2.3.paf.exe has all the functionality?
• Monitor Mode in MacOS Sonoma
• Wireshark dependency on minimum/specific npcap/winpcap versions?
• bitbake wireshark 4.2.3 stuck at 99%
• I am not able to capture TCP data packets from a specific IP
• We are upgrading wireshark from 2.6.7 to 4.2.3.Need some info on keys and values in decoded data
• How to use Wireshark to find where an application queries for updates?
• What version is supported on windows 2012R2
• CRC, FCS, Checksum errors are not verified by Wireshark
• How to use Wireshark to measure K-12 classroom signal strength
• track sites visited
• 802.1Q VLAN id
• I am trying to capture synchrophasor IEEE C37.118
• Relevant Examples for Display Filter Comparison Operators
• Are there differences between Wireshark and Wireshark Development
• Out of Tree Dissector Build Problems on Windows
• Identify windows process behind short lived ephemeral port
• Help a Newbie! SSH remote capture
• Hello, it would be helpful if i could get some guidance on why this issue coming.
• Can we track network traffic of all the connected devices using wireshark
• Unable to capture packets when two BACnet devices communicate.
• Can someone please help me with the reason behind the connection reset from the destination?
• Please help me export the packet bytes of a tls certificate
• can more than one network interface be used
• Wireshark intercepts only those passwords. which are entered at the moment of connection? those passwords that are saved, sites. which were previously logged in - Wireshark will not be able to get them?
• why is my udp protocol showing up as WireGuard protocol
• Cannot Decrypt SSL/TLS Packets Using Pre-Master Secret Log File
• How concerned should i be about this pls?
• New File Format
• Cannot find arp.duplicate-address-frame
• Decrypt TLS SIP
• Specific npcap that I can re-install?
• Sample capture for learning
• How do I figure out why my PC is sending RST, ACK?
• Possible causes of TCP RST
• Diffie-Hellman/TLS decryption breaks after 'TCP Previous Segment not captured' / 'TCP Out-Of-Order'
• Suggestion for wireshark enhancement?
• Dumpcap hangs while running ring capture
• Can't load plug in lua after version 4.4.0
• I think I don't have the right GUI, I don't know where is wrong.
• Downloading videos
• create a dissector for protobuf
• How to get list of all IP addresses on my network
• Certification Voucher

● Taxonomist   × 1

● Famous Question   × 1

• What is the Markdown syntax supported by AskBot

● Popular Question   × 1

• What is the Markdown syntax supported by AskBot

● Notable Question   × 1

• What is the Markdown syntax supported by AskBot

● Organizer   × 1

• where do I find a version of Wireshark that works with the Nordic BLE sniffer plugin

● Enthusiast   × 1

● Associate Editor   × 1

• No CMAKE_C(XX)_COMPILER could be found

● Critic   × 1

• Help to read this trace

● Citizen Patrol   × 1

• How do i connect my Ps4 To MAC OS

● Teacher   × 1

• How do I add "child item" to an item in the subtree?

● Nice Answer   × 13

• tshark - list of protocols in capture
• SSL in Protocol-list
• Why is the TLS1.2 Server Hello not recognized?
• tshark ring-buffer duration vs interval
• How does tshark read files with dns entries saved with -H?
• I can't see the HTTP packets of another computer connected in my own private network
• "ssl.record.length" is deprecated
• I captured what I believe is an unpatchable attack
• If Wireshark is licensed under GPL2, does NpCap licensing even come into play for distribution?
• NTPv4 Autokey protocol: pcap does not meet the standard
• How do I start a capture in Wireshark via the command line?
• capture filter of GRE
• On Windows, how do you stop the monitoring host from generating packets?