grahamb's profile - activity

As the "answer" has now been moved to a comment, there is no checkmark for "accepting" it. I'll try to clean it up.

Such minor changes don't normally get announced, the closest we have to that for fields is the Display Filter Reference.

Such minor changes don't normally get announced, the closets we have to that is the Display Filter Reference. Maybe we

Change 31184 added a field http.response_for.uri that contains as much of the request URI as is available. This could b

The Modbus dissector does just the same as a Modbus master when communicating with a slave, it assumes that a response m

We don't generally close questions when they are answered. Instead, please accept the answer (even if it's your own ans

So it appears your issue wasn't with extracting the 6 byte value as a uint64, but rather adding it to the tree.

And we've now come to the limit of my Lua knowledge. Hopefully someone else will be able to help.

From the menu File -> Export Objects -> HTTP ..., then hopefully your file will be listed in the dialog and you ca

You have a "::" on the range object, have you tried a single ":"?

Have you compared the files in binary mode, i.e. byte for byte? An editor, and Wireshark for that matter, display binar

Caution, I only know enough Lua to be dangerous, but can't you use a tvbrange:uint64() with the 6 byte range, to retriev

Caution, I only know enough Lua to be dangerous, but can't you use a tvbrange:uint64() with the 6 byte range, to retriev

That kind of question is off-topic for this site, Wireshark is a network packet analysis tool, not a malware analysis to

Using files created with a ring buffer capture option (-b) seems to work with a file set. Such files are saved in the f

I missed the fact that in your question you stated that you were trying to use the client key. That won't work, you nee

Can you rephrase your question, it doesn't seem to make any sense? Are you saying that you want to use Wireshark to ext

IMHO the best way is definitely to capture the information from the wifi router. Depending on the router, this informat

While this answer informs on how to view the endpoints from an existing capture, it doesn't tell the user how to make su

Interesting result, RFC 5246 (for TLS 1.2 which you seem to be using) says this about the list of certificates: certifi

Change 31184 adds the request URI to the response.

Unfortunately your anonymised capture doesn't have the tcp payload data for any of the frames so we can't tell what the

Downloaded OK. Looks as though your TW session has erased all the data of the TCP payload, that's why http isn't showin

Personally I still suspect the client, as everything else is happy with the server config and the client sends the alert

Thanks for the openssl tip. openssl s_client -connect my.domain.com:5172 -tls1_2 -showcerts CONNECTED(00000003) depth=

And that worked in Linux?

BTW, please stop posting comments as "Answers".

Unless you can find a PJL to PDF converter I think that's a no.

As is usual, solving issues via screenshot is difficult and frustrating because it's the info in the capture that we can

We'll need your Wireshark TLS debug log, set in the TLS dissector preferences.

Looks like an issue in the client then.

I think you'll have to debug the client, is it a browser? If so have you tried another? Can you use openssl s_client .

Is the TLS encryption using an RSA scheme? What is the cipher suite selected by the server?

As is often the case, troubleshooting by screenshot of a a few columns from a capture is a frustrating exercise. Can yo

It's not a PDF, instead it's a printer job using HP Printer Job Language (PJL).

Unfortunately I think the answer lies in the capture.

It's likely to be something in your capture setup as Wireshark won't just "invent" packets. Can you describe your captu

So you've successfully built the .so and now you're trying to add it to an "installed" version of Wireshark?

Something is up with your source tree as you should have that file, how did you get your sources, a git checkout (prefer

Something is up with your source tree, how did you get it, a git checkout (preferred) or a tarball? The file from our g

Section 9.2.1 in the guide has the registration routine, proto_register_foo(), have you somehow omitted that from your s

Register Routine, Register_tap_listener, Register_wtap_module, Register_codec_module routines I've followed chapter 9 to

As I did that presentation I can say, yes I did! Looking back at the slide deck, slide 18 (C dissector installation) ha