grahamb's profile - activity

I've fixed up the image links so they display correctly.

Can't capture packets in Kali 2020.1 Hi guys, I am writing this post after having been researching over the internet fo

The tshark equivalent is the -z follow,prot,mode,filter[,range] option described in the man page here. You'll probably

Add the -q flag to suppress the "normal" output and then post-process it. See this answer from the old site.

I would think so. Most tools expect the information in the capture file to be correct.

The tshark equivalent is the -z,follow,prot,mode,filter[,range] option described in the man page here. You'll probably

The above command will get you raw data. Redirect it to a file or pipe it to another processor.

TraceWrangler probably uses the IP length field to fix up the frame length metadata in the capture file. I'm not aware

The tshark equivalent is the -z,follow,prot,mode,filter[,range] option described in the man page here. You'll probably

OK, then the capture file should have "1092 bytes on the wire" for that frame to be a valid capture file.

OK, then the capture file should have "1092 bytes on the wire" for that frame.

If you look at the compiled BPF (using the Compile BPFs button in the Capture Options dialog) for each filter you can co

If you look at the compiled BPF (using dftest) for each filter you can compare the result: tcp && ((port 56 &am

If you look at the compiled BPF for each filter you can compare the result: tcp && ((port 56 && host 1.

And in the question I linked @cmaynard has added another answer that uses a Lua post-dissector to add another field with

And in the question I linked @cmaynard has added another answer that uses a Lua post-dissector to add another filed with

Good option Chris, I keep forgetting about post-dissectors. I presume performance would be affected if using larger cap

Tshark -d option to format date doesn't work Tshark's driving me mad! I want to parse a trace and output as csv with he

Oops, yes -t not -d. I've amended the answer. Yes, by "normal" I mean regular column output as opposed to -T fields ou

The -t option only works on "normal" tshark output. When you use -T fields and select a particular time field, i.e. fra

DNS Delay, ICMP message sent from query sender. An image of the issue: 10.1.60.27 = client sending query for google.

From your output: Frame 71: 314 bytes on wire (2512 bits), 314 bytes captured (2512 bits) This tells Wireshark that t

From your output: Frame 71: 314 bytes on wire (2512 bits), 314 bytes captured (2512 bits) This tells Wireshark that t

See the answer to this question which was so similar to yours I thought it was also for Splunk. TLDR; the format for fra

I believe, by using Google and looking at the docs for Splunk (I have never used Splunk), you can specify a time format

I believe, by using Google and looking at the docs for Splunk (I have never used Splunk), you can specify a time format

OK, I mistakenly thought it was a follow on from this question.

It depends on where you put the capture filter in the argument list. See the man page entry for the -f option: This

It depends on where you put the capture filter in the argument list. See the man page entry for the -f option: This

In what way is it not working, does it exclude traffic you want or include traffic you didn't want? Do you have VLAN ta

You would have to recompile Wireshark to do so, currently the format is hard-coded, see abs_time_to_str() in epan\to_str

That's the correct CMake invocation for Wireshark 3.0 which was built with VS2017.

The -d option only works on "normal" tshark output. When you use -T fields and select a particular time field, i.e. fra

Thank you for your observation, you should note that the Wireshark project does not supply winflexbison, that is an exte

I'm not 100% sure about this but from your SSL log: ssl_set_cipher found CIPHER 0x1302 TLS_AES_256_GCM_SHA384 This is

Nope, the changes would be in the Asterisk dissector, it has the DSAP preference which is specific to asterisk and it re

As noted by Guy, your capture uses many different DSAP values so which one(s) should be used for Asterisk? How is this

That's correct for 3.0 which was built with VS2017.

That's the correct build command for Wireshark 3.0, but we'll need to see the full output from the command. Please redi

Looks to me to be the general steps to make a WLAN capture, ascertain channel, restart the client connection either by d

I seem to have two streams there, one is from 10.203.205.210 to pmdvportal and looks like RDP traffic and probably isn't