Re: [Wireshark-users] Display filter

Hank, Thanks! On 5/3/07, Hank Leininger [EMAIL PROTECTED] wrote: On Fri, May 04, 2007 at 01:33:22AM +0200, Luis Ontanon wrote: On 5/4/07, Irakli Natshvlishvili [EMAIL PROTECTED] wrote: Also, could you clarify what type of regex wireshark supports? pcre Here is the example - if there

[Wireshark-users] Need help with display filtering for all packets on a subnet

This is probably obvious, but my Google-fu seems to be weak today. I have a trace file that I was to see any packet of a conversation between an IP on my network with one outside the network (aka filter inter-network traffic). However, I cannot seem to get a display filter that does this. I'm

Re: [Wireshark-users] Need help with display filtering for all packets on a subnet

On Fri, May 04, 2007 at 11:38:13AM +0200, Roman Daszczyszak wrote: This is probably obvious, but my Google-fu seems to be weak today. I have a trace file that I was to see any packet of a conversation between an IP on my network with one outside the network (aka filter inter-network

[Wireshark-users] Wireshark and 2GB capture files

Hi - I was just wondering if there was support for trace files larger than 2GB on x86 machines (CentOS 5) by any chance? And if so, how do you go about getting this to work? 2.6.18-8.1.3.el5 libpcap-devel-0.9.4-8.1 libpcap-0.9.4-8.1 wireshark-0.99.5 sorry, I'm new, so I apologize if

[Wireshark-users] capture filter

Im weak at filters... can someone point me in a good direction.. Im trying to find a LAYER 2 multicast issue on the network. that ask luck would have it.. pops up at different times every day.. The only reason i know of this issue some of the switches log the error..

Re: [Wireshark-users] Wireshark and 2GB capture files

Hi Alex, I never used CentOS, however independently of the OS it is recommended not to grow up to much the files to keep them manageable. Otherwise it takes too much to process them. Using multiple files when doing the capture and limiting them to lets say 100MB (or less) you can handle that

[Wireshark-users] Comparing RTP stream Jitter and Max Delta

Hello, I have been troubled with understanding the connection between the Max Delta (ms) and the Max Jitter (ms) column in the RTP stream analysis. If I use a G.711 codec (PCM) for the VoIP-call, there should be one packet sent every 20 milliseconds and therefore the Max Delta (ms) value

Re: [Wireshark-users] Comparing RTP stream Jitter and Max Delta

Hi, see http://wiki.wireshark.org/RTP_statistics - How jitter is calculated (bottom of page). Basically, jitter is a smoothed derivative of the interarrival delta. So it will not get nearly as high as the deltas itself, unless fluctuations of deltas are very frequent and of high amplitude over

Re: [Wireshark-users] capture filter

Tom Greaser wrote: Thanks Guy.. JUST want i was asking for i will remember to man tcpdump next time .. Well, the man page is a start, but the expr relop expr section is a bit of Full Frontal Capture Filter[*] - you have to know that the capability is there, and you then have to go from that

Re: [Wireshark-users] Wireshark and 2GB capture files

Hi Juan - I work in support and most of the times when SE's or customers take traces, they usually don't know how to really use tcpdump and what not, so the traces (or collector) doesn't really care and therefore I get stuck with huge traces. I was hoping to use tethereal with the -R

Re: [Wireshark-users] wpa decryption and : in passphrase

Matthieu CASTET [EMAIL PROTECTED] writes: Hi, I want to use Decrypt 802.11 of wireshark, but my passphrase contains :. So wireshark fails to parse correctly my passphrase. After looking at http://wiki.wireshark.org/HowToDecrypt802.11?highlight=%28CategoryHowTo%29, I wonder if there is

[Wireshark-users] WISH : WPA Decrypt

Hi, I use wireshark to debug a wpa driver that I develop. Unfortunately it doesn't check mic. I will be great if wireshark could check if the mic data is valid, and if it isn't display a warning. Thanks Matthieu ___ Wireshark-users mailing list

Re: [Wireshark-users] wpa decryption and : in passphrase

On Fri, May 04, 2007 at 05:59:18PM +, Matthieu CASTET wrote: I want to use Decrypt 802.11 of wireshark, but my passphrase contains :. So wireshark fails to parse correctly my passphrase. After looking at http://wiki.wireshark.org/HowToDecrypt802.11?highlight=%28CategoryHowTo%29, I

[Wireshark-users] Tshark and using display filters

I have a capture file, want to use tshark to filter packets and write a new file. When I use tshark -r all.cap -w filtered.cap -R udp contains 100 'I'm getting tshark Read filters were specified both with -R and with additional command-line arguments Platform is XP with SP2. What I'm doing

Re: [Wireshark-users] Wireshark and 2GB capture files

I think you would be better off realtime parsing this and shoving it into a db. That would eliminate the 2GB limit and allow you to run filtering and more advanced options (in Wireshark) from your favorite desktop after a more selective query on the db. From:

Re: [Wireshark-users] Wireshark and 2GB capture files

Realtime - meaning `tcpdump -r xxx.cap | mysql-insert.pl` once... From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Tim Connolly XX (PL/EUS) Sent: Friday, May 04, 2007 4:35 PM To: Community support list for Wireshark Subject: Re: [Wireshark-users]