Re: [Wireshark-users] some strange cifs request

2007-06-13 Thread zuoheng
Ronnie, thanks. Is it a common behavior for a Windows client or will be triggered by some conditions? /zuoheng ___ Wireshark-users mailing list Wireshark-users@wireshark.org http://www.wireshark.org/mailman/listinfo/wireshark-users

Re: [Wireshark-users] TCP Window Size

2007-06-13 Thread Laura Chappell
Hi Maria, Look in the TCP headers of the packets to see the Window Size field value. In addition, you'll see that information in the Info column (Win=x). Also consider selecting Analyze > Expert Composite Info > Notes - Wireshark has Zero Window and Window Full alerts. Over at www.wiresharkU.

[Wireshark-users] TCP Window Size

2007-06-13 Thread Maria
Hello, While posting messages to a Network user group we were suggested to use wireshark for TCP protocol analysis. We currently have a private network. The network consists of one Dell laptop connected to a Netgear Ethernet 8 port switch and recording device connected to the Ethernet switch. T

[Wireshark-users] hi

2007-06-13 Thread vinoth babu
Hi, iam using wireshark Pc version (Version 0.99.6-SVN-21924 (SVN Rev 21924)) iam trying to decode the OID of the SNMP placket. I copied few mib's in the way of .txt under the mib directory. But still it is not able to decode the OID. Can anypne help me out in decoding the OID or hp

Re: [Wireshark-users] TCP Dup Ack

2007-06-13 Thread Roland Volz
John: A certain number of TCP Dup Acks are common, usually no more than one or three per packet in any particular session. In our case we were seeing sixty or over a hundred for individual packets - this is enough to cause significant errors which brought down large-file-size FTP sessions for o

Re: [Wireshark-users] Comparing packets

2007-06-13 Thread Ed . Staszko
I have found this filter to be useful, in some cases, for removing TCP duplicates. It is not perfect, by any means, but is a quick way to remove most cases of duplicates. The logic is this: Remove the first TCP duplicate acknowledgement and remove any retransmission that takes place in under 5

Re: [Wireshark-users] some strange cifs request

2007-06-13 Thread ronnie sahlberg
it is just the client checking if the file has any AlternateDataStreams attached to it. On 6/13/07, Zuoheng <[EMAIL PROTECTED]> wrote: > Hi, > > I am a newbie to Wireshark, currently using Wireshark troubleshooting > a cifs performance issue. I got some insteresting output from > Wireshark, > >

[Wireshark-users] some strange cifs request

2007-06-13 Thread Zuoheng
Hi, I am a newbie to Wireshark, currently using Wireshark troubleshooting a cifs performance issue. I got some insteresting output from Wireshark, No. TimeSourceDestination Protocol Info 23 0.027344152.62.34.59 10.32.33.99 SMB

[Wireshark-users] Windows, connection not listed in netstat

2007-06-13 Thread paul
Hi. I tried to use Wireshark on Windows. I catched one three way handshake from some foreign address on some ports greater than 1024. immediately I run netstat -a -n , but I cannot find any corresponding connection in this list. Does anybody know why ? __