grahamb's profile - activity

Wireshark is a packet analyser and that means it must have visibility of those packets in a capture file. If a capture

See a similar question from a few days ago: https://ask.wireshark.org/question/35911/oui-lookup-tool-not-working/

Yes. Select all the interfaces required, add any capture filter you need and start the capture.

it is possible the -platform windows:darkmode:=1 parameter works with 4.4.1 even loading the Wireshark via doubleclick

Reported to the infra team via Discord.

Or fix your errant security "solution" that misidentifies files by their extension.

Hi Chuck, This code throws the error on my installation of 3.6.2-2: local my_proto = Proto("my_dissector", "My Dissect

Duplicated packets is often caused by your capture setup. Can you make some sort of diagram showing the endpoints and y

Duplicated packets is often caused by your capture setup. Can you make some sort of diagram showing the endpoints and y

Duplicated packets is often caused by your capture setup. Can you make some sort of diagram showing the endpoints and y

How is the capture point related to the RTP endpoints?

Not a Wireshark question

What's your capture environment?

Wireshark, via the packet dissection, will tell you what happened, but not the why. You'll need to look at any applicat

Wireshark, via the packet dissection, will tell you what happened, but not the why. You'll need to look at any applicat

Set it up as per the link I posted?

Should do. See the wiki page on Ethernet monitor mode capture

That's the way Windows works :-) The Wireshark Wiki page on Loopback Capture suggests (under Other Alternatives) that y

That's the way Windows works :-) The Wireshark Wiki page on Loopback Capture suggests (under Other Alternatives) that y

That's the way Windows works :-) The Wireshark Wiki page on Loopback Adaptor suggests (under Other Alternatives) that y

I'm fairly certain the unicast traffic between the processes will only show up on the loopback adaptor then.

I'm a bit confused, can you confirm both MQTT and Node Red are on the same machine and if so what the OS is on that mach

I think that would be helpful. Note that the extension added should be that selected in the "Output format" radio butto

Crashes when selecting endpoints or conversations When I launch wireshark, I go to the statistics tab and click endpoint

Apparently the user wasn't actually selecting the Certificate [...]: 30 item in the packet list, for reasons unknown th

Works perfectly for me, using 4.4.0 on Windows 10. Select the "Certificate" item in the packet details list and right-c

Works perfectly for me, using 4.4.0 on Windows 10. Select the "Certificate" item in the packet details list and right-c

When the connection is initiated the other way, .242 → .134, the Windows system doesn't accept it (with a SYN, ACK) but

One thing I've noticed is that whenever there is a connection reset (RST), the SYN, ECE, and CWR flags are set from the

One thing I've noticed is that whenever there is a connection reset (RST), the SYN, ECE, and CWR flags are set from the

The RST is coming from .242, so likely no listener. You'll need to look at the device itself to see what's going on and

Can someone please help me with the reason behind the connection reset from the destination? Some traffic: 1 2024-10-

From the very scarce info you have given it's likely there is no server listening on port 2111

Can someone please help me with the reason behind the connection reset from the destination? Packet excerpt: 10.60.23.1

@Gabriele Zattara, I converted my comment to an answer, if that solves your issue please accept it by clicking the check

Ah, tested again, if you supply the extension in the filename then that is used, e.g. C:\Temp\wrb.pcapng.

Is the destination on the local subnet? If yes, that will rely on arp to resolve the destination IP to a MAC address to

No problem, just helps to keep us all discussing the same thing. What's your OS and Wireshark version? I think this is

For future reference, the option to split packets by duration etc. is named "ring buffer". I presume it's some form of

I guess someone with enough motivation could also sponsor this work for JAMF

Unfortunately it would seem your system, as far as the x64 VC redist is concerned, is "hosed". The next actions are muc

Good idea... but alas: winget uninstall Microsoft.VCRedist.2015+.x64 -v 14.27.29016.0 Found Microsoft Visual C++ 2015-2

Tried this: winget upgrade Microsoft.VCRedist.2015+.x64 Error..same error I have been getting. The feature you are tr

Tried this: winget upgrade Microsoft.VCRedist.2015+.x64 Error..same error I have been getting. The feature you are tr

You could try using winget to uninstall the VC redist packages, a bit risky because plenty of other stuff relies on them

The wrapping isn't helpful but even with my formatting changes you should be able to see that you have old versions inst