[Wireshark-users] Issues/Questions with SSL Decode for Windows in 0.99.3

2006-09-02 Thread Small, James
Hello, According to the 0.99.3 release notes - ...SSL decryption are now supported in the Windows installer However, when I follow the instructions at http://wiki.wireshark.org/SSL, I can not get the example SSL decode to work. Can someone send me an example of what it looks like when the

Re: [Wireshark-users] wireshark ssl decryption for dummies

2006-09-13 Thread Small, James
When I use 0.99.3 for Windows, I also have trouble with the SSL decodes. When I use the Wiki example and look at the logs, I see: In the logs, I keep seeing decrypt ssl3 record: no session key Logs: association_remove_handle removing ptr 02D39200 handle 0282E918 association_remove_handle

[Wireshark-users] Wiki/Link issue

2006-09-18 Thread Small, James
When browsing through the Wireshark wiki, I noticed that the links to the display filter references seem to be broken. For example, if I look at the SSL link: http://wiki.wireshark.org/SSL?action=""> And from there I click on the SSL display filter reference link:

Re: [Wireshark-users] Trace files for public download?

2006-10-17 Thread Small, James
? Besides the wireshark wiki, there are also some here: http://www.packet-level.com/traces/index.htm They are more for specific examples though so not sure if that's what you're looking for. --Jim From: [EMAIL PROTECTED] on behalf of P Li Sent: Tue

Re: [Wireshark-users] How to find the application sending a namerequest?

2006-10-28 Thread Small, James
One way to narrow it down would be to use Wireshark to identify the source IP and port. So on that particular Windows box, you could then use either netstat -ano (believe only 2003 and XP add the -o option) or you could use fport from Foundstone:

Re: [Wireshark-users] How to find the application sending anamerequest?

2006-10-28 Thread Small, James
application sits at the starting point for asking for the unknown server. I suspect it is some service. Thanks, Bob Small, James [EMAIL PROTECTED] wrote: One way to narrow it down would be to use Wireshark to identify the source IP and port. So on that particular Windows box, you could then use

[Wireshark-users] TCP Decoding differences between Ethereal 0.99 and Wireshark 0.99.3/4?

2006-10-31 Thread Small, James
I teach networking and security at a community college. When explaining to students why they should bother to use ssh and not telnet I like to show how easy it is to capture plain text passwords by firing up Wireshark and doing a live demo. Sometimes a picture/demo is worth a thousand words.

Re: [Wireshark-users] TCP Decoding differences between Ethereal0.99 and Wireshark 0.99.3/4?

2006-11-01 Thread Small, James
Thank you Steve, I believe you are right. Jaap/Ulf - I know you are busy and this does not appear to be a high priority bug. Is there any work around to disable the bug 852 fix so that if you want to easily display TCP stream text and are willing to except the crash risk you can? Thanks,

Re: [Wireshark-users] filter to capture ospf pacets?

2006-11-02 Thread Small, James
Stan, I believe you have it, but just to re-iterate: The most common capture is usually TCP/IP over Ethernet. So if we look at a capture of TCP/IP traffic over Ethernet, a typical Frame looks like this: Ethernet Frame which carries a Network Protocol (such as IP) IP Datagram which carries a

Re: [Wireshark-users] Exporting raw packet data?

2006-11-13 Thread Small, James
Replies in-line below... I didn't even realize you could do this until I read your question, but here is one way (not sure if this is exactly what you want): Open a capture Narrow down the interesting packets (For example, I do a lot of web traffic analysis so I might use a filter such as

Re: [Wireshark-users] Exporting raw packet data?

2006-11-14 Thread Small, James
Pretty cool Sake. I don't have any UDP streams to coalesce at the moment, but just looking at your perl script gave me some ideas. Thanks, --Jim -Original Message- From: [EMAIL PROTECTED] [mailto:wireshark-users- [EMAIL PROTECTED] On Behalf Of Sake Blok Sent: Tuesday, November 14,

Re: [Wireshark-users] RST in connection after webserver upgrade. Pleasehelp analyse

2006-11-16 Thread Small, James
Jeroen, From what you included below, it looks like after the upgrade, the web server responds with an extra/extraneous FIN segment. In the before scenario, you have a proper shutdown - FIN/ACK ACK (close one direction), FIN/ACK ACK (close other direction). In the after scenario you have a

Re: [Wireshark-users] 2 gig limit on mergecap

2006-11-23 Thread Small, James
Your suspicions are correct: http://www.microsoft.com/resources/documentation/windows/xp/all/proddocs/en-us/choosing_between_ntfs_fat_and_fat32.mspx?mfr=true The file size limit for FAT32 appears to be 4GB. That said, I can't image trying to use a modern Hard Drive with large partitions and

Re: [Wireshark-users] SSH packets

2006-12-09 Thread Small, James
What about: tcp.port==22 Normally an SSH Server/Service/Daemon listens on TCP Port 22. If the SSH end point is on a different port, then you can filter on the server port (e.g. tcp.port==60022) and right click on a packet and select decode as, and choose SSH. Hope this helps, --Jim

[Wireshark-users] TCP Reassembly Question

2006-12-16 Thread Small, James
I have learned much from listening to the list, especially about TCP and HTTP. Thank you to everyone for this! One question that this has brought up for me is on TCP Reassembly. I read Steven's TCP/IP Illustrated and other networking books so I have a pretty good idea how TCP works. However, I

Re: [Wireshark-users] I see no captured packets at all

2006-12-28 Thread Small, James
Cor, Unfortunately, many wireless cards in Windows do not allow you to do network captures. I use to have a link to a web site that explained it all and had a list of Wireless NICs/Chipsets and which ones worked or didn't work for network captures but now I can't find it. However, many times

[Wireshark-users] Question on interpreting TCP Expert Info

2006-12-29 Thread Small, James
Hello, I am using Wireshark to look at mail traffic (SMTP/POP3). When I look at the trace I see lots of the following: Previous Segment Lost Retransmission (suspected) Duplicate ACKs I'm suspecting that this is exacerbated by not having enough Internet bandwidth. My question is, how do I

Re: [Wireshark-users] I see no captured packets at all

2007-01-02 Thread Small, James
for Wireshark Subject: Re: [Wireshark-users] I see no captured packets at all Small, James wrote: Unfortunately, many wireless cards in Windows do not allow you to do network captures. I use to have a link to a web site that explained it all and had a list of Wireless NICs/Chipsets

Re: [Wireshark-users] OUI Look Up Tool on Wireshark site?

2007-01-21 Thread Small, James
Here's another set - I heard that some vendors ask the IEEE not to publish their blocks but I don't know if that's true... http://map-ne.com/Ethernet/ --Jim From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Keith French Sent: Sunday,

Re: [Wireshark-users] Filtering a very large capture file

2007-01-26 Thread Small, James
I wonder if ngrep would work for you: http://ngrep.sourceforge.net/ There are binaries for most platforms including Linux and Windows. Perhaps you could do something like this: ngrep -I input.cap -O output.cap regex I tried and it seems to work, although I only used a 20MB capture file. --Jim

Re: [Wireshark-users] Question on new U3P format of Wireshark

2007-01-27 Thread Small, James
and the authors page seems to be gone now but there's an archived version here where you can read how he did it: http://web.archive.org/web/20060427203232/http://www.packetstuff.com/ On Sat, 27 Jan 2007 14:33:16 -0500, Small, James [EMAIL PROTECTED] said: I have a question on the upcoming U3P package

Re: [Wireshark-users] Question on new U3P format of Wireshark

2007-01-27 Thread Small, James
portable thumb drive and found a deal on one w/U3 - wasn't looking for U3 specifically. So for now I think I'll stick to using regular install of WireShark so I don't have to deal with WinPcap every time I use WireShark. On 1/27/07, Small, James [EMAIL PROTECTED] wrote: Thanks Hans--that looks

Re: [Wireshark-users] capturing packets in stealth mode on Windows

2007-02-03 Thread Small, James
Dave, Under the Network Adapter Properties, under the General Tab, you should see a list of clients/protocols/etc. that use the particular network adapter. For example: Client for Microsoft Networks VMware Bridge Protocol Deterministic Network Enhancer File and Printer Sharing for Microsoft

Re: [Wireshark-users] how to filter a port?

2007-02-26 Thread Small, James
Thanks Ulf--I didn't realize you could do that, I've been doing not source and not destination - this is much more efficient! --Jim -Original Message- From: [EMAIL PROTECTED] [mailto:wireshark-users- [EMAIL PROTECTED] On Behalf Of Ulf Lamping Sent: Monday, February 26, 2007 5:34 AM

Re: [Wireshark-users] Question on Internet PerformanceTroubleshooting

2007-03-02 Thread Small, James
Sweet--talking about a great source of information in networking! :-) Laura, please allow me to respond inline: If you can capture on both sides of the firewall with two time synced WS systems then you can merge the trace files and note the delay at the firewall. [Small, James] That sounds

Re: [Wireshark-users] Question on InternetPerformanceTroubleshooting

2007-03-02 Thread Small, James
Steve, I believe the 3 T1 are multiplexed using multilink PPP using an Adtran router if I remember correctly. Is there any way to tell if this PPP bundle is causing out of order packets or other issues? Thanks, --Jim One off the wall idea - the site had two T1's (3.0 Mbps) multiplexed

Re: [Wireshark-users] Question on InternetPerformanceTroubleshooting

2007-03-02 Thread Small, James
Hi Sake, Not an unreasonable suspicion - in fact, when I used: http://miranda.ctd.anl.gov:7123/ The site suspected a duplex mismatch since my download speed tends to be less than half of my upload speed. Many times the upload speed is close to the advertised rate but I have never been able to

Re: [Wireshark-users] Question on Decoding packet with insertedproprietary header

2007-03-13 Thread Small, James
I am dealing with packets that are modified by a vendor device. The packets are standard Ethernet frames with IP. Once the frames/packets traverse the Vendor device, a new proprietary header is inserted between the Ethernet header and the IP header. So, in a standard IP/Ethernet

Re: [Wireshark-users] Question on Decoding packet with inserted proprietary header

2007-03-13 Thread Small, James
Anyway, could be a useful Wireshark feature - if you agree let me know and I'll put it on the wish list. What would be nice would be a language to describe a packet format and an interpreter for the language, so that a non-programmer could add a dissector for simpler protocols. Even if

Re: [Wireshark-users] Question on Decoding packet with inserted proprietary header

2007-03-14 Thread Small, James
Hi Doug, That sounds pretty sweet. I tried to follow the steps and I think I'm close. I use bittwiste to change the Data Link Type: bittwiste -I one.cap -O two.cap -M 147 I load the libpcap file in Wireshark 0.99.5. Under the Info column I now see: WTAP_ENCAP = 45, so I think so far so good.

Re: [Wireshark-users] Question on Decoding packet with inserted proprietary header

2007-03-14 Thread Small, James
. On Wed, 14 Mar 2007 20:46:24 -0400, Small, James [EMAIL PROTECTED] said: Hi Doug, That sounds pretty sweet. I tried to follow the steps and I think I'm close. I use bittwiste to change the Data Link Type: bittwiste -I one.cap -O two.cap -M 147 I load the libpcap file

Re: [Wireshark-users] Question on Decoding packet withinsertedproprietary header

2007-03-14 Thread Small, James
That's a great idea - I just did. Truly a fantastic tool! -Original Message- You got to thank the developer(s) of bittwiste -- great tool, one of a kind! Frank ___ Wireshark-users mailing list Wireshark-users@wireshark.org

[Wireshark-users] Malformed SSL - Is it really?

2007-04-10 Thread Small, James
Hello, When using Wireshark 0.99.5 on Windows, sometimes I see: [Malformed Packet: SSL] e.g.: No. TimeSourceDestination Protocol Src Port Dst Port Delta Info 381 15.301101 172.24.101.100172.24.100.107TLSv1443 1136

Re: [Wireshark-users] TCP Dup Ack

2007-06-04 Thread Small, James
Roland, What kind of problems? Do the transfers abort? Are they slow? When dealing with a carrier, you need to be specific. Remember that carriers deal with troubleshooting Internet traffic for a living so they are understandably skeptical if a non-carrier tells them there is something

Re: [Wireshark-users] Filter UDP from IP in UDP transport

2007-07-11 Thread Small, James
Scott, I believe bittwist might be able to do the trick for you: bittwist.sourceforge.net --Jim Hello I have a dataset where IP is transported in UDP For each packet in the wire shark pcap capture I need to strip the first 50 bytes. I would like to

Re: [Wireshark-users] Tons of ARP packets...?

2007-07-13 Thread Small, James
IchBin, Still need to find the bugger who is causing that problem. Or more interestingly where is this xxz0n3dxx.dyndns.org coming from on my machine. I did a global text search for xxz0n3dxx.dyndns.org and only found in 5 files but these related to the emails I have sent to this newsgroup.

Re: [Wireshark-users] Beginner Quick Setup Question

2007-07-13 Thread Small, James
Depends on the switches - as long as they are RSPAN capable and not limited by bugs then yes - setup RSPAN on 7 with the last one receiving and spanning everything to your Wireshark node. I believe you need a 2950 or better for RSPAN (except don't believe 3500XLs do RSPAN). Also, if you have

Re: [Wireshark-users] Beginner

2007-07-13 Thread Small, James
I completely agree - Laura's books are fantastic - an excellent investment if you want to get productive in network analysis quickly. I still have and use her books on Novell networks - the Token Ring explanations are probably the best I have ever seen if you're (un)fortunate enough to still

Re: [Wireshark-users] Tons of ARP packets...?

2007-07-13 Thread Small, James
Dooh! That's a major bummer. Perhaps Zone Alarm then? Or... How about this for a wish item - the ability to filter and/or identify network traffic by process name/ID. Based on what I've seen from the Sysinternals tools I believe it may be possible. What do you think? --Jim -Original

Re: [Wireshark-users] Setting up a display offset

2007-07-22 Thread Small, James
Hi Bill, Excellent question, I hope this helps: Try getting bittwist: http://bittwist.sourceforge.net/ It works on Windows/UNIX/Linux/BSD so you should be good on any platform You can get pre-compiled binaries for Windows Assuming you have a file in libpcap format: bittwiste -I

Re: [Wireshark-users] Setting up a display offset

2007-07-23 Thread Small, James
- [EMAIL PROTECTED] On Behalf Of Luis EG Ontanon Sent: Sunday, July 22, 2007 12:55 PM To: Community support list for Wireshark Subject: Re: [Wireshark-users] Setting up a display offset On 7/22/07, Small, James [EMAIL PROTECTED] wrote: For the general Wireshark community - is there a way to do

Re: [Wireshark-users] Setting up a display offset

2007-07-26 Thread Small, James
Bill, I don't believe there is in Wireshark. You have to change the datalink type in the capture file and then setup custom offsets as I described. Did you try this and have any luck? --Jim -Original Message- Can anyone follow up with me on this, is there a way to force a offset so

Re: [Wireshark-users] Whitewashing Packet Traces?

2007-07-30 Thread Small, James
Hi Andy, Lots of interesting suggestions - one that I have used which works decently is the bittwist family (works on most platforms including Windows with pre-built binaries available). Just make sure you heed Guy's warning - there are many other embedded fields and it's hard to get them all in

Re: [Wireshark-users] Ethereal vs wireshark

2007-07-30 Thread Small, James
Did you try dumpcap? It's included with Wireshark (the latest version of Ethereal) and typically is much better at capturing because it doesn't do any processing - it just dumps everything to a file. I've used it in many situations where Wireshark/tshark would drop packets (1Gbps+) because of

Re: [Wireshark-users] Way to easily identify UDP/ICMP packets with no reply?

2007-09-11 Thread Small, James
Oops - that was supposed to be capture/display filter! -Original Message- Is there a way to easily identify UDP/ICMP packets with no reply? I suppose statistics--conversations is one way, but is there a capture filter that would help? Thanks, --Jim

[Wireshark-users] Way to easily identify TCP SYNs without a response?

2007-09-11 Thread Small, James
Hello, Is there a way to easily identify TCP SYN packets that get no reply? In other words, no SYN/ACK or RST/ACK sent in reply? I know you can do a tcp.flags.syn==1 and just look through the list, but I was wondering if there is a better way with a capture/display filter? Thanks, --Jim

Re: [Wireshark-users] 12 bytes before the IP header

2007-09-19 Thread Small, James
Aleksander, If I save the pcap file you sent and follow this procedure: bittwiste -I http_packet.cap -O http-new.cap -M 147 Open http-new.cap in Wireshark 0.99.6 Edit-Preferences-Protocols,DLT_USER,Edit... Click on Edit... Click New Leave encap at default of User 0 (DLT=147) payload_proto - ip