[Wireshark-users] printout file problem

2008-02-21 Thread nicolas büchi
Hello, I'm not so deep into wireshark, I just want to do something simple, maybe anyone can help me. For a graphic visualization of wireless traffic I want to do with processing, I need a text file, where I have all my capturing results in it. Just as the summary window in wireshark.

Re: [Wireshark-users] printout file problem

2008-02-21 Thread Guy Harris
nicolas büchi wrote: For a graphic visualization of wireless traffic I want to do with processing, If you want to do real-time statistics, you might want to look at ntop: http://www.ntop.org/ to see if it can be made to do what you want.

[Wireshark-users] Does wireshark decode TLS_DHE_RSA_WITH_AES_256_CBC_SHA using server key

2008-02-21 Thread vishal arya
Did everything by the book ,still tshark/wireshark fail to show may contents on the payload data. then i did some gooleing to find intresting stuff about ephemeral keys cannot be decrypted. please let me know if TLS_DHE_RSA_WITH_AES_256_CBC_SHA ( AES 256 bit Encryption ) can be decrypted using

Re: [Wireshark-users] Does wireshark decode TLS_DHE_RSA_WITH_AES_256_CBC_SHA using server key

2008-02-21 Thread Sake Blok
On Thu, Feb 21, 2008 at 04:19:55PM +0530, vishal arya wrote: Did everything by the book ,still tshark/wireshark fail to show may contents on the payload data. then i did some gooleing to find intresting stuff about ephemeral keys cannot be decrypted. please let me know if

[Wireshark-users] Intel 4965

2008-02-21 Thread Fat Ball
Who can let me know how to activate the interface of Intel 4965 upon wireshark? Thanks a lot. FB ___ Wireshark-users mailing list Wireshark-users@wireshark.org http://www.wireshark.org/mailman/listinfo/wireshark-users

Re: [Wireshark-users] Does wireshark decode TLS_DHE_RSA_WITH_AES_256_CBC_SHA using server key

2008-02-21 Thread Joerg Mayer
On Thu, Feb 21, 2008 at 12:21:42PM +0100, Sake Blok wrote: then i did some gooleing to find intresting stuff about ephemeral keys cannot be decrypted. please let me know if TLS_DHE_RSA_WITH_AES_256_CBC_SHA ( AES 256 bit Encryption ) can be decrypted using wireshark/tshark.

Re: [Wireshark-users] Does wireshark decode TLS_DHE_RSA_WITH_AES_256_CBC_SHA using server key

2008-02-21 Thread Sake Blok
On Thu, Feb 21, 2008 at 04:38:14PM +0100, Joerg Mayer wrote: On Thu, Feb 21, 2008 at 12:21:42PM +0100, Sake Blok wrote: then i did some gooleing to find intresting stuff about ephemeral keys cannot be decrypted. please let me know if TLS_DHE_RSA_WITH_AES_256_CBC_SHA ( AES 256 bit

Re: [Wireshark-users] Does wireshark decode TLS_DHE_RSA_WITH_AES_256_CBC_SHA using server key

2008-02-21 Thread Joerg Mayer
On Thu, Feb 21, 2008 at 05:13:41PM +0100, Sake Blok wrote: I was under the impression that these DH-keys within SSL randomly created when the ssl-session is being setup? In which case providig them to Wireshark is not possible... That depens on the debugging options of your ssl lib: If you

[Wireshark-users] strange artefact of ethereal for SCTP packets or something else

2008-02-21 Thread Ariel Burbaickij
Hello all, in some fairly common implementation of M3UA/SCTP of one of the major Scandinavian vendor I see in ethereal something strange: Several SCTP packets (packets as oposed to chunks, i.e. with two separate SCTP headers) are bundled over the same one IP packet. Question: is it some massaging

Re: [Wireshark-users] High broadcast traffic

2008-02-21 Thread Tom Greaser
Hansang Bae asked a great question. I have hung myself by setting up Mulitcast on a device in a legacy (FAT LARGE ) network. In doing so i only thought about L3.. well multicast uses the same L2 flag as bcast.! On Wed, 2008-02-20 at 19:22 -0500, Hansang Bae wrote: joans4nz wrote: I'm a

Re: [Wireshark-users] strange artefact of ethereal for SCTP packets or something else

2008-02-21 Thread Michael Tuexen
Hi Ariel, can you provide a small example tracefile (in pcap format)? If you do not want to send it to the list, you can send it directly to me. Best regards Michael On Feb 21, 2008, at 9:09 PM, Ariel Burbaickij wrote: Hello all, in some fairly common implementation of M3UA/SCTP of one of the

[Wireshark-users] packet loss rate

2008-02-21 Thread Esma Y?ld?r?m
Hello How can I measure the packet loss rate with Wireshark? In my case I am sending a file of 512MB and wireshark captures the packets on my computer. Thanks ___ Wireshark-users mailing list Wireshark-users@wireshark.org

[Wireshark-users] build problem

2008-02-21 Thread bitmus DA
Hi.All i wan to use wireshark for just view packet, not for capture. so i run ./configure --without-pcap and then make. but make is giving error below ... packet_list.c: In function 'packet_list_check_end': packet_list.c:793: error: 'auto_scroll_live' undeclared (first use in this function)

Re: [Wireshark-users] strange artefact of ethereal for SCTP packets or something else

2008-02-21 Thread Jehanzeb Khan
Hello Ariel In case you decide not to send it to the list, can you send it to me as well? Regards Jehanzeb Khan - Original Message From: Michael Tuexen [EMAIL PROTECTED] To: Community support list for Wireshark wireshark-users@wireshark.org Sent: Friday, February 22, 2008 2:00:54 AM

Re: [Wireshark-users] build problem

2008-02-21 Thread Bill Meier
bitmus DA wrote: i wan to use wireshark for just view packet, not for capture. so i run ./configure --without-pcap and then make. but make is giving error below It's a bug :( A fix will be committed momentarily to not compile the offending code if --without-pcap. Thanks for the report.

[Wireshark-users] tshark -d option

2008-02-21 Thread MKS {}
Folks, The (-d , ) option with tshark tells tshark to interpret packets on the specified port as the given protocol. Is there a way to provide a range of ports using this route? Also, is wireshark does not seem to allow this command line otion. Is there some way to do the same other than

[Wireshark-users] packet payload string or hex filter

2008-02-21 Thread Grzegorz Szczytowski
Hello, I'm wondering if wireshark support string or hex filier similar to following syntax: data.data include or content blablabla The issue is that the filter should goes over the whole packet to match that string. Best regards, Grzegorz ___

Re: [Wireshark-users] build problem

2008-02-21 Thread Stephen Fisher
On Thu, Feb 21, 2008 at 11:20:47PM -0500, Bill Meier wrote: bitmus DA wrote: i wan to use wireshark for just view packet, not for capture. so i run ./configure --without-pcap and then make. but make is giving error below It's a bug :( A fix will be committed momentarily to not

Re: [Wireshark-users] tshark -d option

2008-02-21 Thread Stephen Fisher
On Fri, Feb 22, 2008 at 02:33:11AM +, MKS {} wrote: The (-d , ) option with tshark tells tshark to interpret packets on the specified port as the given protocol. Is there a way to provide a range of ports using this route? A quick glance at the tshark code didn't turn up any way to do

Re: [Wireshark-users] packet payload string or hex filter

2008-02-21 Thread Stephen Fisher
On Fri, Feb 22, 2008 at 03:38:23AM +0100, Grzegorz Szczytowski wrote: I'm wondering if wireshark support string or hex filier similar to following syntax: data.data include or content blablabla The issue is that the filter should goes over the whole packet to match that string. This

Re: [Wireshark-users] Hiding interfaces

2008-02-21 Thread Stephen Fisher
On Wed, Jan 30, 2008 at 11:20:55AM -0500, Onur Akgun wrote: Is there a way to hide some interfaces from the Capture Interfaces screen? Preferences - Capture - Interfaces - Edit does not do what I want... (Box is a fedora based Linux running with multiple network adapters) Would you mind

Re: [Wireshark-users] build problem

2008-02-21 Thread Bill Meier
(Yon can download the updated sources for the two programs or you can apply the changes to your local source). Or wait for the next release as Steve stated Two notes: 2. There's still a problem compiling the separate program rawshark without pcap. You'll need to use

Re: [Wireshark-users] build problem

2008-02-21 Thread Bill Meier
Stephen Fisher wrote: On Thu, Feb 21, 2008 at 11:20:47PM -0500, Bill Meier wrote: bitmus DA wrote: i wan to use wireshark for just view packet, not for capture. so i run ./configure --without-pcap and then make. but make is giving error below It's a bug :( A fix will be committed