Ask Your Question

kaos's profile - activity

2020-03-07 10:46:47 +0000 asked a question tshark default output format differs between versions

tshark default output format differs between versions default output format on Windows (tshark 3.2.2): 14 2020-03-07

2020-02-04 19:10:30 +0000 received badge  Rapid Responder (source)
2020-02-04 19:10:30 +0000 answered a question Is wireshark available to be used on Android

there are some apps for android to capture network traffic, check https://play.google.com/store/search?q=network%20captu

2020-02-03 01:24:15 +0000 received badge  Self-Learner
2020-02-03 01:24:15 +0000 received badge  Teacher
2020-02-03 00:11:55 +0000 commented question dns.length field/filter shows nothing

I workaround this limitation by calculating ip.len - 28 for DNS-over-UDP and ip.len - 40 for DNS-over-TCP

2020-02-03 00:09:55 +0000 commented answer dns.length field/filter shows nothing

thank you for the clarification bubbasnmp! accepted as answer. Cannot upvote as I have not enough points :-(

2020-02-03 00:08:52 +0000 marked best answer dns.length field/filter shows nothing

according the display filter reference https://www.wireshark.org/docs/dfref/... the field dns.length is the "Length". I assume it's a length of DNS payload ( dns.length=udp.length - 20 (UDP header)). If I type "dns.length" (which means "dns.length is present") or "dns.length > 0" (which means dns.length is greater than 0) in the display filter field there are no matches. I If type "dns", wireshark shows all DNS packets. Other dns fields like "dns.resp.len" work as expected. Tested with both Wireshark versions 3.2.0 and 2.6.14

2020-02-03 00:08:52 +0000 received badge  Scholar (source)
2020-02-02 22:47:13 +0000 answered a question Break a 140MB file to smaller files

even 30MB would be too much for most users because the binary files are being transfered using Base64 encoding which wil

2020-02-02 22:36:29 +0000 answered a question Sniffing specific application traffics.

use Microsoft's Network Monitor or Microsoft Message Analyzer to capture packet for a specified process, save the caputr

2020-02-02 22:27:13 +0000 answered a question how to follow process on Windows

Wireshark can't do that, but Microsoft's Network Monitor or (newer) Microsoft Message Analyzer can match packets to proc

2020-02-02 22:10:28 +0000 received badge  Rapid Responder (source)
2020-02-02 22:10:28 +0000 answered a question No HTTP protocols in Captured Scan

most of large modern web sites switched from plain HTTP to HTTPS during last years, there are not many web sites which s

2020-02-02 21:50:29 +0000 received badge  Rapid Responder
2020-02-02 21:50:29 +0000 answered a question dns.length field/filter shows nothing

I've just consulted source code: if (transport == DNS_TRANSPORT_TCP) { /* Put the length indication into the tree. */

2020-02-02 21:37:51 +0000 asked a question dns.length field/filter shows nothing

dns.length field/filter shows nothing according the display filter reference https://www.wireshark.org/docs/dfref/d/dns.