Ask Your Question

grahamb's profile - activity

2022-08-11 08:15:35 +0000 edited question SharkFest YouTube Query - TCP Stacks

Sharfest YouTube Query - TCP Stacks I was watching a Chris Greer video and he often refers to stacks albeit IP or TCP or

2022-08-10 14:43:45 +0000 answered a question how to build specific protocol version dissector

You aren't giving any clues as to why you you think you need to copy the dissector from 2.9.0 to 3.6.4 or can't build th

2022-08-10 14:43:45 +0000 received badge  Rapid Responder (source)
2022-08-09 13:27:06 +0000 commented answer Matlab mex-file UDP capture stops working after WireShark upgrade [solved]

As WinPcap is obsolete and unsupported note that any future change to Wireshark or the OS you're running Wiireshark\Win

2022-08-09 13:26:37 +0000 commented answer Matlab mex-file UDP capture stops working after WireShark upgrade [solved]

As WinPcap is obsolete and unsupported note that any future change to Wireshark or the OS you're running Wiireshark\Win

2022-08-09 08:01:21 +0000 commented question Read Values sent from Phone to Bluetooth light

The HomeAssistant forums might be a better place for this. The likelihood is that someone there has come across this de

2022-08-07 19:33:50 +0000 commented answer windows wireshark build error:CAN NOT FIND GLIB2

Try deleting your build directory and re-running the CMake generation step as per the Developers Guide. Note the troubl

2022-08-07 19:29:36 +0000 edited answer windows wireshark build error:CAN NOT FIND GLIB2

how to solve it? Working in C:\Development\wireshark-win64-libs Current library manifest not found. Refreshing. Downloa

2022-08-06 13:26:25 +0000 edited question Global Protect VPN Client - 3day bridge running Sev-A

Global Protect VPN Client - 3day bridge running Sev-A Users recently migrated FROM Cisco Anyconnect VPN client -TO- Palo

2022-08-06 13:19:42 +0000 commented question Malformed some/ip packets

Sharing a capture file that demonstrates the issue will help to diagnose the issue/ Use a public share and post a link

2022-08-05 13:12:14 +0000 commented question Translate the data sent

You can upload screenshots and even better captures to a public shared host and then add links to the items by editing y

2022-08-04 09:05:20 +0000 edited question smb v/very slow - help setting analysis steps in priority order

smb v/very slow - help setting analysis steps in priority order Currently 500mb file taking over 2hrs to transfer over 1

2022-08-04 09:03:27 +0000 commented question I am working in Wireshark book edition 2. I need help with 8.1 lab 42.

By default, the ancillary programs in the Wireshark suite such as capinfos and editcap are NOT on the Windows path, so t

2022-08-04 09:01:21 +0000 edited question I am working in Wireshark book edition 2. I need help with 8.1 lab 42.

I am working in Wireshark book edition 2. I need help with 8.1 lab 42. lab 42: Split a File and Work with Filtered File

2022-07-28 16:00:37 +0000 commented question Hash Values of PDB Files and whatabout the error today (2022.07.28) on subdomains of wireshark.org ?

There's no need to hash the pdb files as there's a built-in hash between the pdb and binary, use the MS symchk tool to

2022-07-28 15:40:04 +0000 commented question Display filter in 3.7.1 receives invalid syntax

Created #18227 as a GitLab issue.

2022-07-28 13:38:05 +0000 commented answer Interfaces not available after upgrading to 3.6.7

This would seem to be an npcap support issue, so their GitHub issues page is your next port of call.

2022-07-28 11:31:52 +0000 answered a question Interfaces not available after upgrading to 3.6.7

WinPcap is obsolete and should not be used. Usually a reinstall of the latest version of npcap is the best solution to

2022-07-28 11:31:52 +0000 received badge  Rapid Responder (source)
2022-07-27 08:08:21 +0000 commented question Display filter in 3.7.1 receives invalid syntax

Probably best to raise an issue at GitLab for this, there have been a lot of changes in the filtering code that this mig

2022-07-25 12:52:36 +0000 edited question Filter on mac and ip address

Filter on mac and ip address Hi all, I'm pretty new to Wireshark, I'm trying to filter out all packet for a specific ip

2022-07-25 11:07:03 +0000 edited answer Why would ipv6 Loopback Adapter traffic be active?

Why would ipv6 Loopback Adapter traffic be active in Wireshark when I have the IPv6 disabled on my Windows 10 laptop

2022-07-24 10:58:29 +0000 commented answer Why is Port (5037) Active on Loopback?

Two pedantic comments: The Ask editor has a keyboard shortcut for pre-formatted text, Ctrl + K. I would argue that por

2022-07-23 08:24:26 +0000 commented question Why is Port (5037) Active on Loopback?

Still just a standard tcp connection attempt with a SYN in frame 1 and a RST in frame 2, probably because there's nothin

2022-07-23 08:20:18 +0000 edited question Why is Port (5037) Active on Loopback?

Why is Port (5037) Active on Loopback? I start up the Loopback Adapter on Wireshark, then I will start another Wireshark

2022-07-23 08:13:08 +0000 commented question Can I Contact An Administrator To Ask A Question?

There's no support on Ask for "private" questions. There are various tools that can anonymise captures to remove privat

2022-07-21 16:06:06 +0000 commented question finding video information

They will likely be inside the encrypted data. Why do you think they would be transmitted in plain text?

2022-07-21 14:48:57 +0000 commented question finding video information

The data is likely to be encrypted, e.g. via TLS, so you'll have to get access to the decrypted data first.

2022-07-21 07:54:24 +0000 commented answer display filter for ip & port combination

You asked for something like tcp.endpoint == 8.8.8.8:53 which implies ip.src and ip.dst are equivalent and similarly for

2022-07-20 20:24:39 +0000 commented answer display filter for ip & port combination

ip.addr and tcp.port can be used in combination, e.g. (ip.addr == 1.2.3.4) && (tcp.port == 12345)

2022-07-20 19:00:50 +0000 received badge  Rapid Responder (source)
2022-07-20 19:00:50 +0000 answered a question What versions of Wireshark are compatible with Windows 11

I don't think a definitive answer exists as no-one has gone back to test older versions of Wireshark running under Windo

2022-07-20 18:53:46 +0000 answered a question Configuring Wireshark to ID Local Apps Downloading Thru svchost

Wireshark cannot currently do this, but such capture can be made using the built-in Windows capture tool PktMon. The to

2022-07-20 18:53:46 +0000 received badge  Rapid Responder (source)
2022-07-20 18:26:18 +0000 commented question Interpretting packet data

Possibly the mail server is performing a DNS lookup (or something else) on the connecting client and this is stalling th

2022-07-20 18:22:54 +0000 received badge  Rapid Responder (source)
2022-07-20 18:22:54 +0000 answered a question display filter for ip & port combination

There are filters for both ip address (ip.addr) and tcp port (tcp.port) that will filter both "directions" for the respe

2022-07-15 07:54:50 +0000 answered a question How can I install tshark on ubuntu so I can use it on the command line?

Your question is confusing as you seem to be mixing OS's with discussion of "ubuntu" "apt" and "cmd", the latter is usua

2022-07-15 07:54:50 +0000 received badge  Rapid Responder (source)
2022-07-14 17:01:49 +0000 commented answer gRPC Configuration

The Wireshark project doesn't provide any Linux packages, that's left to the respective package managers. The complexit

2022-07-14 16:44:30 +0000 commented question No "Client Key Exchange" in Client to Server comms

If it is the client closing the connection, then client logs, either OS (i.e. event viewer) or application logs might be

2022-07-14 15:57:42 +0000 commented answer gRPC Configuration

You're still running the very old 2.6.2 version though? That version fell out of support in Oct. 2020 and I'm not certa

2022-07-14 15:48:54 +0000 commented question No "Client Key Exchange" in Client to Server comms

Your bullet list doesn't indicate the direction (src, dst) of the messages, but I would guess that it's the client closi

2022-07-14 15:31:43 +0000 commented answer gRPC Configuration

You're still running the very old 2.6.2 version though?

2022-07-14 15:31:23 +0000 commented answer gRPC Configuration

Also, I solved my GUI installation issues, so I no longer need to accomplish this using only the command line. I've trie

2022-07-14 15:30:45 +0000 commented answer gRPC Configuration

RHEL 8 and 'wireshark --version' output: Wireshark 2.6.2 (v2.6.2) Copyright 1998-2018 Gerald Combs <[email protected]

2022-07-14 15:30:24 +0000 commented answer gRPC Configuration

When I check my /home/<username>/.config/wireshark/preferences file, I don't have a field called protobuf_search_p

2022-07-14 15:29:38 +0000 commented answer gRPC Configuration

When I check my /home/<username>/.config/wireshark/preferences file, I don't have a field called protobuf_search_p

2022-07-14 07:53:20 +0000 commented answer Help needed converting text file from FortiGate to pcap

I didn't manage to get this script to work. I always get a message stating "awk: line 1: syntax error at or near ,". A

2022-07-10 15:04:52 +0000 received badge  Rapid Responder (source)