Stuart Kendrick's profile - activity

FASP protocol specification Anyone have FASP experience? This is the protocol which the Aspera client & server use

I see. So since the IP Ident field is not required for frames flagged as Don't Fragment, some stacks set it to an arbit

OS X Monterey / IP ID 0x0000 I'm analyzing a pcap capturing everything that an OS X box (running some recent flavor of M

OS X Monterey / IP ID 0x0000 I'm analyzing a pcap capturing everything that an OS X box (running some recent flavor of M

OK, turns out that the NAS box supports SMB Multichannel, and I'm seeing it action. I will turn my attention to the NAS

Different IP addresses (e.g. a.b.c.d for the 10G interface, a.b.c.f for the 1G interface, per my nomenclature above)

SMB client changing from one server interface to another I'm poring over a number of Windows 10 to SMB Server pcaps and

SMB client changing from one server interface to another I'm poring over a number of Windows 10 to SMB Server pcaps and

SMB client changing from one server interface to another I'm poring over a number of Windows 10 to SMB Server pcaps and

SMB client changing from one server interface to another I'm poring over a number of Windows 10 to SMB Server pcaps and

SMB client changing from one server interface to another I'm poring over a number of Windows 10 to SMB Server pcaps and

OK, so stopping the AVG anti-malware service eliminates these UDP encrypted frames and the Client then issues its first

OK, I've tried several browsers (FF, IE, Chrome); they each display the same pattern:http://www.skendric.com/dns/What-ar

Hi Chris, ipconfig /displaydns shows no sign of these addresses, and disabling the other Ethernet NICs in the box did n

What protocols do hosts use to perform host-name to IP address resolution I am puzzled by how a client is finding the IP

I am filtering on 74:da:38:f0:8f:39, which I suppose excludes Beacons & Probe Responses OK, so what I'm learning he

Decoding IP payload in Unencrypted WiFi Packet I'm capturing on an Open SSID, predicting that I would be see the IP payl

Understanding the Identity Protection phase of the ISAKMP Exchange I want to better understand the Identity Protection p

I don't understand the output I get when I try to sum tcp.time_delta in a trace

    C:\Temp>tshark -r P-Inside-sliced.pcapng -o tcp.calculate_timestamps:TRUE -Y tcp.dstport==443 -qz io,stat,0,SUM(tcp.time_delta)tcp.time_delta

============================================
| IO Statistics                            |
|                                          |
| Duration: 18.2 secs                      |
| Interval: 18.2 secs                      |
|                                          |
| Col 1: SUM(tcp.time_delta)tcp.time_delta |
|------------------------------------------|
|              |1           |              |
| Interval     |     SUM    |              |
|---------------------------|              |
|  0.0 <> 18.2 | 106.856631 |              |
============================================

C:\Temp>

The believe that the Total Time encompassed in this trace is 18.2s ... but then, how can the Sum of tcp.time_delta be ~106s?

And further, if I sum tcp_time.delta in the other direction (notice the change from tcp.dstport to tcp.srcport) ... I would have predicted that the SUM would be some other number ... not ~106s again

    C:\Temp>tshark -r P-Inside-sliced.pcapng -o tcp.calculate_timestamps:TRUE -Y tcp.srcport==443 -qz io,stat,0,SUM(tcp.time_delta)tcp.time_delta

============================================
| IO Statistics                            |
|                                          |
| Duration: 18.2 secs                      |
| Interval: 18.2 secs                      |
|                                          |
| Col 1: SUM(tcp.time_delta)tcp.time_delta |
|------------------------------------------|
|              |1           |              |
| Interval     |     SUM    |              |
|---------------------------|              |
|  0.0 <> 18.2 | 106.856631 |              |
============================================

C:\Temp>

See http://www.skendric.com/ask_wireshark for the pcaps

BTW: I have taken two pcaps, one from just inside a particular network device, the other from just outside same device, and I'm trying to use this technique to measure the device's impact on performance

--sk

Ahh, got it -- thank you

stumbling over the use of io,stat,0,SUM I don't understand the output I get when I try to sum tcp.time_delta in a trace

stumbling over use of io,stat,0,SUM... I would like to use tshark to SUM tcp.delta_time in a pcap. But clearly I'm fumb

Thank you Chuck

How to change date format in IO Graphs When I check the 'Time of Day' box in IO Graphs, I see time in HH:MM:SS ... and D

How does 'Follow TCP Stream' work How does this feature work? Occurs to me that perhaps it tracks source / destination

How does 'Follow TCP Stream' work How does this feature work? Occurs to me that perhaps it tracks source / destination