grahamb's profile - activity

please help me to analyze the network in my place i use remote desktop for my work. but lately when i ping my pc i often

couldn't attach dumpcap to my own defined device Hello out there, a while ago I defined my own device with a kernel modu

What do you mean by "missing MACs"? How have you determined the MAC address is missing?

This should be a separate question

The dissector for websocket is here, maybe the function websocket_uncompress() helps. Note that zlib is a "stream" comp

The recent npcap installers, for some time, don't have an option to install the loopback adaptor, it's automagically ins

FYI, see https://gitlab.com/wireshark/wireshark/-/issues/18071

Wireshark itself doesn't provide this capability. you'll need to use an external application, e.g. a script language, to

You should be able to capture the SMTP traffic by installing and using Wireshark on the system that's using Thunderbird.

Same notebook - same server to contact - different behavior – different setting parameter [conversation completeness] Hi

Wireshark will happily reassemble fragmented IP packets, but it MUST see ALL the fragments to complete reassembly. Usin

If the IP fragments had been reassembled then wouldn't they show up as SIP?

how to decapsulate sdh using editcap Getting error: cannot write pcapng file. I am using: editcap -T sdh --F pcapng

Seems to be very similar to this question. As the IP reassembly doesn't appear to have completed there will be no attem

How to let tshark reassemble the fragments on GRE? I have captured on pcap with gre traffic. and could filter out the gr

I think you mean you can't post it here because of our anti-spam measures. You can share it on a public share, e.g. Goo

Works for me, although I'm not able to test with your capture file unless you share it. I used the capture file attache

A -o flag only changes the settings for that script run, not your saved preferences. You can check this by looking at t

A -o flag only changes the settings for that script run, not your saved preferences. You can check this be checking the

Thank you so much. I have one more question. I don't want to change general settings of tshark so can i change this opti

tshark -G fields will display all fields that may be used in display filters. To then only see http fields, use your sh

All Wireshark preference settings can also be set via tshark options using the -o <setting name>:<value> fla

There's no reply at all in the capture, all the packets are from app01.contoso.com:44531 to 10.11.12.20:1002. The traff

Works for me (Win 10), can you show the full output from tshark -v?

tshark command: failed to start process, how to debug this error? I am using the command line to look through packets in

Does tshark -v show the version info?

Not a Wireshark question, although I'm not sure where to redirect you, maybe a Windows forum?

ARP Storming??? I am relatively new to Wireshark, recently accepted a new IT position, network seems a bit slow so I did

Unfortunately not on Windows. On Windows, tools such as Process Monitor may help.

@LBee, npcap 1.75 is out, seems to work for me. See the changelog here

Npcap can be installed in "Admin required" mode but unfortunately that is almost unusable with Wireshark as it then requ

Thank you grahamb for your reply. Regarding the first solution ("Admin required") - you are right, that's not going t

Thank you grahamb for your reply. Regarding the first solution ("Admin required") - you are right, that's not going t

Npcap can be installed in "Admin required" mode but unfortunately that is almost unusable with Wireshark as it then requ

Hi Graham Looks like 1.74 Running on 64-bit Windows (22H2), build 22624, with AMD Ryzen 7 2700 Eight-Core Processor (

@Jaap, fixed.

You've probably reverted to an older version of npcap. Wireshark 4.0.5 comes with npcap 1.71 that has the "promiscuous m

OK, like you I have manually installed npcap 1.74 and have the same issue, timestamps in captures are all identical and

OK, like you I have manually installed npcap 1.74 and have the same issue, timestamps in captures are all identical and