Re: [Wireshark-users] Wireshark scripting?

2008-02-05 Thread Lars Ruoff
Rather start here: http://www.wireshark.org/docs/wsug_html_chunked/wsluarm.html -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Lars Ruoff Sent: mardi 5 février 2008 11:41 To: 'Community support list for Wireshark' Subject: Re: [Wireshark-users

Re: [Wireshark-users] Wireshark scripting?

2008-02-05 Thread Lars Ruoff
http://wiki.wireshark.org/Lua Br, Lars -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of David Sent: mardi 5 février 2008 11:20 To: wireshark-users@wireshark.org Subject: [Wireshark-users] Wireshark scripting? Has any thought ever been given to

Re: [Wireshark-users] RTP Stream Analyses [Marker Bit]

2007-07-12 Thread Lars Ruoff
There were some responses to your mail! As long as you aren't registered, look at the web archives at http://www.wireshark.org/lists/wireshark-users/ Lars _ From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Shuaib Siddiqui Sent: jeudi 12 juillet 2007 12:58 To:

Re: [Wireshark-users] RTP Stream Analyses [Marker Bit]

2007-07-06 Thread Lars Ruoff
From my memories: packets with the marker bit set don't take part in the jitter calculation. This is because in RTP audio streams marked packets usually mark the end of silence periods. The wrong jitter values probably come from the fact that there is no (or at least not the right) sampling clock

Re: [Wireshark-users] Capturing local traffic on Windows XP

2007-06-18 Thread Lars Ruoff
each packet intended for localhost to go out to the default gateway first, from which it will come back again. Of course this means you see each packet twice. hope it helps, Lars Ruoff Marcos Israel Ibarra Arias wrote: Hi, I need to capture the traffic of what in linux is the interface lo

Re: [Wireshark-users] Comparing RTP stream Jitter and Max Delta

2007-05-04 Thread Lars Ruoff
Hi, see http://wiki.wireshark.org/RTP_statistics - How jitter is calculated (bottom of page). Basically, jitter is a smoothed derivative of the interarrival delta. So it will not get nearly as high as the deltas itself, unless fluctuations of deltas are very frequent and of high amplitude over

[Wireshark-users] Identify dropped packets?

2007-03-02 Thread Lars Ruoff
? (libpcap format) If yes, how can i view it? Lars Ruoff ___ Wireshark-users mailing list Wireshark-users@wireshark.org http://www.wireshark.org/mailman/listinfo/wireshark-users

Re: [Wireshark-users] Jitter wrong in wireshark?

2007-02-26 Thread Lars Ruoff
Hi Anders, since this too is a recurring question, perhaps you (or someone else) could add it to the Wiki, just under what i added last week: http://wiki.wireshark.org/RTP_statistics (bottom). (I'm sorry, i don't have the time right now). br, Lars Anders Broman wrote: Hi, Looking at the

Re: [Wireshark-users] Calculate Jitter

2007-02-22 Thread Lars Ruoff
Wireshark *does* use that formula. Can you give an example where you think it doesn't work? Note that you need to know the RTP clock sampling time (depends on codec)) to do the transformation from RTP timestamps to real time. br, Lars Ruoff Goran Štrok wrote: I do not understand how jitter

Re: [Wireshark-users] Calculate Jitter

2007-02-22 Thread Lars Ruoff
sec - 1400 * 0.000125 sec) = -0.016467 J(2) = J(1) + (|D(1,2)| - J(1))/16 = [in seconds] 0.0031216875 + (|-0.016467| - 0.0031216875)/16 = 0.00395576953125 etc. best regards, Lars Ruoff Goran Štrok wrote: In this example: http://wiki.wireshark.org/SampleCaptures#head

[Wireshark-users] Problems with dumpcap and ringbuffer

2006-11-24 Thread Lars Ruoff
Hi, one of my customers in using dumpcap (on Windows) like this: dumpcap -i X -w data/dump.pcap -b filesize:1 -b files:100 (where X is the index of the right capture interface.) This should turn on a max of 100 files * 1KB = 1GB of maximum used disk space. He notes that: quote We have

Re: [Wireshark-users] Problems with dumpcap and ringbuffer

2006-11-24 Thread Lars Ruoff
Additional info: It is dumpcap from Ethereal 0.99.0 I told the customer to try again with dumpcap/Wireshark 0.99.4. But then i think this part hasn't much evolved? Lars Lars Ruoff wrote: Hi, one of my customers in using dumpcap (on Windows) like this: dumpcap -i X -w data/dump.pcap -b

Re: [Wireshark-users] Problems with dumpcap and ringbuffer

2006-11-24 Thread Lars Ruoff
PROTECTED] On Behalf Of Lars Ruoff Sent: den 24 november 2006 13:19 To: Wireshark-users Subject: [Wireshark-users] Problems with dumpcap and ringbuffer Hi, one of my customers in using dumpcap (on Windows) like this: dumpcap -i X -w data/dump.pcap -b filesize:1 -b files:100 (where X