Posts on The Official Wireshark Blog

Those Aren't Packets: How Stratoshark Brings the Power of Wireshark to the Cloud

Wed, 22 Jan 2025 15:00:00 +0000

For over 25 years, network professionals have relied on Wireshark packet captures (pcaps) to analyze and troubleshoot network system behavior. But packets are scarce in the cloud. Is it possible to get the same level of visibility and granularity there? And if so, is there an opportunity to leverage the same principles that have made Wireshark so ubiquitous?

Well, the answer to both questions is yes. We’ve named this new tool Stratoshark, and it’s powered by system calls.

One of the things that has contributed to Wireshark’s success is that it is part of the pcap ecosystem, which is centered around libpcap and the pcap and pcapng file formats. It all started with tcpdump, and over time other tools appeared. The ecosystem now includes Zeek (formerly Bro), Snort, WinPcap, nmap, nTop, Kismet, Suricata, and many others.

Each tool focuses on its specific job but together form a collective powerhouse. A common file format means that you can pivot between each tool with little to no effort. For example, you can take a capture file from Zeek or Snort and load it into Wireshark for detailed analysis. If you take a step back and look at the ecosystem as a whole, you might wonder if that same effectiveness and success can be applied elsewhere. As it turns out, with system calls, it can.

If you’re not familiar with system calls (this is a networking blog, after all), they can be thought of as a boundary between your operating system and all of the applications running on your system. Any time an application wants to do something useful, such as opening a file, connecting to the Internet, or playing a sound, it uses system calls. This is true whether you’re running on Windows, macOS, Linux, or any other OS. System calls can also be used to enforce security boundaries. For example, if an application tries to read or write a file that it shouldn’t, the operating system can say “no.”

If you can tap into that boundary and see what system calls each application is using you can get an excellent view into your system’s behavior. This is what tools like Falco and Sysdig OSS do. Sysdig OSS is a command line tool that works much like tcpdump, and prints system call activity on your terminal screen. Falco works much like an IDS, constantly monitors syscall activity, sending alerts whenever it finds something suspicious. Falco and Sysdig OSS are part of the scap (system capture) ecosystem. This ecosystem is based around the libscap library, which can capture system calls and read and write .scap files, and libsinsp, which enriches the information captured by libscap by adding information such as usernames and file paths. Libscap also has a plugin interface that lets you capture from other sources, such as cloud providers and application logs.

What if we took the powerful analysis features of Wireshark and made it possible to analyze the system call and log data provided by libscap and libsinsp? I’m thrilled to announce that we did that, and it’s called Stratoshark.

Stratoshark is a sibling application to Wireshark that lets you analyze system calls and logs. If you look closely at the screenshot below, it should look familiar to anyone who’s used Wireshark. However, the first thing you might notice is that those aren’t packets. In this case, they’re a capture of the curl utility downloading a file. If you scroll through the event list you can see the various system calls that it uses to get up and running, from loading its dynamic libraries to reading certificate files to connecting to the remote server. You can see the process name, user name, file paths, and other useful information. In this particular instance, I’ve selected an event that reads a dynamic library. After dissecting the system call, Stratoshark proceeds further and dissects the executable header in the library file itself.

I’m really excited about Stratoshark because it lets you peer into the inner workings of systems in the same way that Wireshark lets you peer into the inner workings of networks. I hope that you find it useful, and I’m looking forward to seeing how Stratoshark grows and evolves as part of the scap ecosystem.

You can download Stratoshark for Windows and macOS and find a link to its source code at stratoshark.org. If you’d like to learn more you can find information at the following locations.

Stratoshark: Extending Wireshark’s legacy into the cloud on the Sysdig blog
How Falco and Wireshark paved the way for Stratoshark on the Sysdig blog
Getting Started With Stratoshark on Josh Clark’s blog
How to capture an SCAP for Stratoshark on Medium
Stratoshark on the Wireshark wiki

What’s New In Wireshark 4.4?

Wed, 28 Aug 2024 21:05:31 +0000

Wireshark 4.4.0 has been released and it includes a lot of improvements and updates since version 4.2.0 was released last November. I’ll cover some highlights here, but you will definitely want to check out the release notes¹ for details.

Graph Dialogs 🔗

Many bugs have been fixed in the graph dialogs (I/O Graphs, Sequence Diagrams, and TCP Stream Graphs), and performance has been improved.

The following improvements have been made to the I/O Graphs dialog:

The minimum interval is now 1 microsecond.
The Y axis now uses SI prefixes.
Bar graphs are rendered more sensibly.
The graph list can be reordered by dragging and dropping items.
Graph legends and layer orders always match the graph list order.
The legend can be moved by right-clicking on it.

The new bar graphs and intervals

The Sequence Diagram (Flow Graphs and VoIP Calls) dialog has been improved as well:

The entire graph can be exported as an image. Previously, only the items on screen were exported.
Endpoints with the same address are now displayed correctly.

The TCP Stream Graphs dialog does a better job of identifying the client and server sides of connections.

Custom Columns 🔗

You can now add custom columns that do the following:

Use arithmetic. For example, frame.len * 8 will show the frame length in bits instead of bytes.
Show the raw bytes of fields using the @ operator. For example, @ip.src will show the raw bytes of the IPv4 source address.
Logical tests like tcp.port == 443 will show a check mark in the column when the check matches.

Other Updates 🔗

There are a whole bunch of display filter updates and improvements. If you’re a power user you will definitely want to check them out.

The “Follow Stream” dialog can now show delta times and turns.

You can now add a display filter to a configuration profile. When you open a capture file, Wireshark will automatically switch to that profile if the filter matches.

Automatic profile switching

Links 🔗

The complete Wireshark 4.4.0 release notes can be found at https://www.wireshark.org/docs/relnotes/wireshark-4.4.0.html ↩︎

From Network Packets to Log Data: How Logray built upon Falco’s foundation

Mon, 29 Jan 2024 17:13:42 +0000

In the ever-evolving landscape of network security, a new star has emerged – Logray. The name comes from “log” (as in event logs) and “ray” (the closest zoological cousin to sharks, similar to “wire” and “shark” for network packets. Logray represents a significant leap in network security tools. Premiering at SharkFest ’22, it takes the best of Wireshark and innovates further by focusing on log data analysis. While Wireshark focuses on scrutinizing network traffic, Logray delves into system calls, Amazon Cloudtrail logs, and other log data, offering new vistas for network security professionals.

At its core, Logray retains the user-friendly aspects of Wireshark, including the familiar filter engine, intuitive colouring, and context menus. Yet, it goes beyond by accommodating the reading of PcapNG files embedded with log data and facilitating the integration of third-party plugins using Falco’s powerful plugin API. System call and log data is saved using the PCAP Next Generation Dump File Format (pcapng), which provides a powerful and versatile shared foundation which broadens the scope of data capture and analysis.

A notable innovation within Logray is ‘falcodump‘, a component enabling the dumping of log data via a Falco source plugin. As an external capture (extcap) tool, falcodump captures log messages from cloud providers, presenting each plugin as a distinct interface.

For instance, the below command is run under the hood to capture AWS CloudTrail events from an S3 bucket. The end user does not have to type it themselves.

falcodump --extcap-interface=cloudtrail --fifo=/tmp/cloudtrail.pcap --plugin-source=s3://aws-cloudtrail-logs…/CloudTrail/us-east-2/… --capture

Logray’s choice to support Falco plugins allows security practitioners to harness the falcodump capabilities to potentially bridge the gap between sporadic data sources such as cloud services and identity providers.

The true value of Logray lies in its ability to synthesise information from system calls and log data into a unified recording format. This cohesive approach offers analysts a panoramic view of relevant events, transcending the limitations of examining network, system, and log contexts in isolation or through disjointed SIEM tooling. Logray embodies a holistic solution, using the power of Falco to enrich data from otherwise disjointed event sources, providing profound contextual analysis for system introspection.

In conclusion, Logray isn’t just another tool; it’s a paradigm shift in network security, enabling professionals to connect the dots across multiple data sources seamlessly. This unified vision provides a clearer, more comprehensive understanding of security events, marking a significant advancement in the field of network security analysis.

The evolution of system introspection from BPF to Wireshark to Falco

Wed, 27 Sep 2023 15:14:02 +0000

Falco, an open source innovation, was conceived with the vision of crafting a flexible and robust rules engine atop the Sysdig libraries. This initiative aimed to furnish a potent tool for the detection of aberrant behaviors and intrusions within modern applications, akin to the Snort paradigm but tailored to the realm of system calls and finely tuned for cloud environments.

Nevertheless, it’s important to recognize that Falco and Wireshark represent distinct facets of this evolutionary process. Falco offers ongoing surveillance akin to Snort, while Wireshark specializes in interactive endpoint network traffic analysis.

Introduction 🔗

Part of this journey has been the emergence of cloud-native apps. From the early days of BPF (Berkley Packet Filter) and libpcap (a portable C/C++ library for network traffic capture), which laid the foundation for network packet analysis, to the familiar graphical user interface of Wireshark, our understanding of network data has undergone profound changes. This article embarks on a journey through this transformation, shedding light on how tcpdump and libpcap sparked an explosion of packet-based analysis and runtime security tools exemplified by Wireshark and Snort.

Wireshark, Snort, Nmap, Kismet, ngrep, and a bunch of other tools started at around the same time and are all evolutionary branches of tcpdump and libpcap.

However, as cloud computing continues to reshape the technological landscape, traditional network packet analysis tools have found themselves grappling with an evolving challenge: the cloud itself. Cloud-native applications have ushered in a new era of complexity and dynamism, rendering many existing visibility solutions obsolete. This shift necessitated a fresh perspective on network monitoring, leading to the birth of Falco, a tool poised to be the Snort of the cloud.

In this exploration, we’ll dive into the why and how of Falco’s creation, uncovering the critical role it plays in addressing the challenges of cloud-native applications from the evolution of network packet analysis to the rise of Falco as a powerful solution for Linux workloads, whether they be hosts, containers, or IoT devices. Join us on a journey through the ever-changing landscape of network analysis and security in the cloud.

Starting the story with Network Packet Analysis 🔗

During the late 1990s Internet boom, the demand for computer networks skyrocketed, leading to an increased need for monitoring, troubleshooting, and securing these networks. Regrettably, the available network visibility tools of that era were prohibitively expensive for many operators, leaving them grappling with a lack of insights.

Consequently, teams worldwide embarked on a mission to address this predicament. Their efforts revolved around expanding existing operating systems to incorporate packet capture capabilities, essentially transforming off-the-shelf computer workstations into devices capable of residing on a network and capturing all inbound and outbound data packets from other workstations. One such solution was the Berkeley Packet Filter (BPF), crafted to extend the functionality of the BSD (Berkeley Software Distribution) operating system kernel.

For Linux users, the term ‘eBPF’ may ring a bell – a virtual machine renowned for securely executing arbitrary code within the Linux kernel. Remarkably, eBPF has evolved into a powerful and flexible technology over the years. However, its origins trace back to a modest programmable packet capture and filtering module designed for BSD Unix.

The BPF team introduced a game-changing library known as ‘libpcap,’ which enabled any program to capture raw network packets. It was developed in order to make tcpdump more useful. For instance, it gave the ability to filter packets. Since then, a bunch of spin-off networking projects would emerge on the scene. In 1998, a GUI-based open source protocol analyzer named ‘Ethereal’ (later renamed Wireshark) was introduced, eventually becoming the gold standard in packet analysis that persists to this day.

What unites ‘tcpdump,’ Wireshark, and numerous other popular networking tools is their ability to access a data source that is rich, accurate, and reliable, all collected in a nonintrusive manner: raw network packets. This fundamental concept will be central to our discussion moving forward.

The evolution of Packet-Based Intrusion Detection Systems 🔗

Introspection tools, such as tcpdump and Wireshark, naturally emerged as the initial applications harnessing the capabilities of the BPF packet capture stack. However, as time progressed, innovative applications for packet data began to surface. Enter Snort, an open source, packet-based runtime security tool that shares common ground with Falco. Much like Falco, Snort operates as a rule engine, processing packets acquired from network traffic. Like its cloud-native counterpart, Snort boasts an extensive library of pre-configured rules designed to identify threats and unwarranted activities by scrutinizing packet content, protocols, and payload data. The success of Snort served as a catalyst for the development of similar tools, including Suricata and Zeek.

What truly empowers tools like Snort is their proficiency in assessing the security of networks and applications in real time, even as these applications run. This real-time focus proves invaluable by delivering immediate protection with a unique emphasis on runtime behavior, enabling the detection of threats rooted in vulnerabilities that may remain undisclosed.

The issue with Network Packet Capture in the Cloud 🔗

The utilization of network packets as a foundational data source has spawned a thriving ecosystem. Nonetheless, several emerging trends have gradually eroded the viability of packets as an unequivocal source of information.

First, the task of comprehensively collecting packets has grown increasingly complex, especially within environments such as the cloud, where access to routers and network infrastructure is constrained. Second, the proliferation of encryption and network virtualization has posed formidable challenges in extracting valuable insights from network traffic. Lastly, the ascent of containerization and orchestrators like Kubernetes has rendered infrastructures more elastic while concurrently complicating the reliable collection of network data.

Once again, a dynamic new ecosystem was unfolding, yet the means to effectively troubleshoot and secure it remained elusive.

Solving these shortcomings with system calls 🔗

Before the emergence of Falco, an open source tool known as ‘Sysdig Inspect’ was crafted with a primary focus on the collection of packet data within cloud-native ecosystems. This was achieved through the capture of system calls, often referred to as syscalls, originating from the kernel of the operating system.

Syscalls, as a data source, offer a richness that surpasses that of mere network packets. They encompass a wide spectrum of activities, extending beyond network data to encompass file I/O operations, command executions, interprocess communication, and more. Syscalls stand out as an ideal data source for cloud-native environments as they can be harnessed from the kernel, catering to both containerized environments and cloud instances. Moreover, the process of collecting syscalls is characterized by its simplicity, efficiency, and non-invasiveness.

The architecture of Sysdig comprised a kernel capture probe, making use of either the default, loadable kernel module or leveraging eBPF. To facilitate the development of capture programs, Sysdig offered a suite of libraries, enabling seamless integration with modern cloud-native technologies such as Kubernetes and various orchestrators. This versatility addressed the shortcomings observed in environments where traditional solutions like Snort and Wireshark fell short. Additionally, Sysdig provided a command-line tool replete with decoding and filtering functionalities, tailored to accommodate the prevalent network packet workflows essential in cloud environments, where the ease of filtering and scriptability of trace files is paramount.

Bringing us to Falco – the evolution of Wireshark to the Cloud 🔗

DDrawing from our comprehension of how Snort introduced a rule-based engine for scrutinizing network traffic to identify suspicious activity, an evolution that implemented Wireshark’s network introspection, and how Sysdig expanded the scope of visibility within cloud-native environments by delving into system calls, effectively departing from sole reliance on Wireshark’s libpcap framework. It logically followed that an Intrusion Detection System (IDS) solution would emerge, featuring a sophisticated rule-based engine tailored for cloud-native workloads while harnessing the capabilities of eBPF and the kernel’s system call architecture.

Falco’s rule engine drew inspiration from Snort’s design but operated within a far more expansive and versatile dataset, seamlessly integrated with the Sysdig libraries. While its default ruleset may be more concise than Snort’s, Falco empowers users to craft intricate rules that trigger in real-time based on arbitrary contextual factors. These factors encompass a wide array of scenarios, including access to sensitive data, mode transitions, unexpected network connections, socket alterations, compliance breaches, and more. Given its capacity to monitor all activities on a server or node through system calls, Falco functions as a real-time intrusion detection tool, mirroring Wireshark’s role in providing real-time network analysis for endpoints.

Conclusion 🔗

In the journey from the early days of BPF to the widespread adoption of Wireshark, we’ve witnessed the remarkable evolution of system introspection tools, each one contributing to the ever-expanding landscape of cybersecurity. However, as cloud-native computing and microservices architectures become the new norm, a new champion has emerged: Falco. Falco represents the cutting edge of intrusion detection, specifically designed to tackle the intricacies and challenges posed by cloud-native hosts and workloads. With its real-time behavioral monitoring, container awareness, and comprehensive rule sets, Falco stands as a testament to the adaptability and innovation in the world of cybersecurity. As the digital landscape continues to evolve, Falco is the tool of choice for those who prioritize the security and integrity of their cloud-native environments. It’s not just a system introspection tool; it’s the future of protecting what matters most in this rapidly changing world of technology.

Wireshark Is 25: The email that started it all and the lessons learned along the way

Fri, 14 Jul 2023 16:14:30 +0000

25 years ago, I sent this email, which ended up changing the course of my life

From: Gerald Combs - Unicom Communications <gerald [at] … >
To: gtk-list [at] redhat . com
Subject: ANNOUNCE: Ethereal 0.2.0
Date: Tue, 14 Jul 1998 21:47:01 -0500 (CDT)

Ethereal is a network analyzer that lets you capture and interactively
browse the contents of Ethernet frames.  Packet data can be read from a
file, or live from a local network interface.

More information, including the source distribution, can be found at
http://ethereal.zing.org . 

Comments and patches are welcome.

I remember being nervous and excited at the time, wondering what the reaction would be. I had spent the previous few months working on a protocol analyzer, which was something I needed at work.

There are a couple of things to note: the name wasn’t Wireshark (we changed the name in 2006) and at the time of this email, protocol analyzers were rare, you could even say a precious thing. Back then, if you wanted to see what was happening on your network, command line tools like tcpdump and snoop were available at no cost, but if you wanted a GUI analyzer, you had to pay for a product that might cost the equivalent of a luxury car. I needed an analyzer to do my job, so I ended up writing a simple one and releasing it as open source.

As it turned out, other people needed an analyzer too. A couple of days after I sent this email, I received a patch. Then another, and another. This quickly blossomed into a thriving developer community which has kept me busy ever since. In the intervening years, the project and its community have grown beyond any expectation that I could have had. Today, Wireshark is used by people around the world to make their networks fast, reliable, and secure, and educators use it to teach the next generation of security and network engineers about the low-level aspects of networks.

What does it take to keep a project successful for so long? It would be nice to be able to say that from the very beginning, there was a grand, clear vision of how everything would evolve and unfold. However, as with any significant endeavor, you have to learn to adapt and apply the resources at hand as effectively as you can. In retrospect, Neils Bohr’s quote

“An expert is a person who has made all the mistakes that can be made in a very narrow field.”

rings especially true in our case. I did manage to learn that in order for an open source project to grow and thrive, you have to ensure that needs are met in the following categories:

User support. Living, breathing people make use of your project, and sometimes need assistance. They might be daily power users or novices, and their needs vary.

Educator support. Experts and power users can teach others how to get the most out of your project, and need assistance as well.

Developer support. The easier you can make it for people to contribute code or otherwise improve the project, the healthier the project and community will be.

Attorneys and accountants. Until GitHub and GitLab add “intellectual property law” or “travel reimbursement” buttons, you’re going to need to find outside help for the regulatory, legal, and financial aspects of your project.

Infrastructure. You need servers, containers, and services that provide an online presence and allow for collaboration. GitHub or GitLab may or may not be sufficient for this depending on your specific needs.

This isn’t quite a Maslow-style hierarchy of needs for open source, but it’s close. The lines between users, educators, and developers can be blurry, but in general, users and educators depend on the output that developers produce, and the project as a whole needs a solid infrastructure in order for everyone to collaborate.

It also doesn’t apply uniformly to all projects. For example, a small, single-purpose image processing library might only need infrastructure and developers, and its user community would likely be other developers. A hosting service like GitHub or GitLab would be sufficient for the project’s infrastructure. On the other hand, a large, feature-rich image editing application might have extensive needs in all five categories along with a business model to fund the project.

Wireshark falls into the latter group, and needs quite a bit of care and feeding. Until recently, the business model for meeting these needs has been “ask my employer if they’ll host the project,” which worked surprisingly well. My employers (CACE Technology, Riverbed and now Sysdig) provided the resources for Wireshark that go way beyond what GitHub and GitLab can offer, such as SharkFest, a conference dedicated to protocol analysis.

In recent years, it became clear that the project would best meet its needs by standing on its own, and with the help of Sysdig, we moved the project to the Wireshark Foundation earlier this year so that the project can continue to grow and serve its community.

25 years ago when I sent that email, I never thought I would be blogging about the project today! If you’ve ever thought about starting an open source project, don’t hesitate to do so. Supporting and managing Wireshark has given me a wonderful career, and opportunities to meet and work with brilliant, inspiring people. If I had to distill everything I’ve learned down to a couple of pieces of advice, it would be this:

The community has valuable insights to share. Let them do that.

Don’t be afraid to start something new. You never know where it might take you 25 years from now.

Finally, I can’t thank you all enough for using and contributing to Wireshark over the years. I can’t wait to see what the future brings. Cheers!

Comments 🔗

Comment by Mike B on 2023-07-15 10:58:05 +0000 🔗

Congratulations on 25 years! Thank you for everything you have done to make my job and the jobs of many thousands easier.

Comment by J. Zandbergen on 2023-07-15 12:38:53 +0000 🔗

Hi Gerald,

Congratulations on 25 years wireshark! Thank you so much for ~20 years of lessons learned and problems fixed!

Cheers!

Comment by Dan on 2023-07-15 15:13:16 +0000 🔗

Congrats! it must take a ton of effort and motivation to keep going for 25 years!

Comment by John on 2023-07-15 17:57:58 +0000 🔗

Thank you for so many fixes in many production environment because of Wireshark!

Comment by John on 2023-07-15 17:59:16 +0000 🔗

*environments :)). I may need to run wireshark on my keyboard

Comment by Teknik Industri on 2023-07-16 17:15:23 +0000 🔗

What is the significance of “Wireshark Is 25: The email that started it all and the lessons learned along the way” in relation to Wireshark?

Comment by nicholas ng on 2023-07-21 13:27:43 +0000 🔗

Happy 25th birthday wirrshark

Announcing the Wireshark Foundation

Wed, 01 Mar 2023 16:06:20 +0000

The thing that I most love about working on Wireshark is our community. Our users, educators, and developers have a passion for packets and protocols, and their work is important – modern society runs on computer networks and those networks need to be reliable, fast, and secure. I’m grateful that my employers and other sponsors have ensured that the community has had the resources to grow and thrive over the years.

This is why I’m beyond thrilled to announce that the Wireshark community now has a permanent home: the Wireshark Foundation. The foundation is a 501(c)(3) nonprofit and will host SharkFest, our developer and user conference, help to facilitate Wireshark’s development, and promote analysis and troubleshooting education.

The project leadership and I have been working on this for a long time, and many other people have generously given their time and expertise in order to make this happen. In particular I’d like to thank the following people for helping to make this a reality: the Wireshark core development team for providing much needed support and advice, and for making all of this possible. Sheri Najafi and Angelo Spampinato for keeping the foundation running, and along with Janice Spampinato, bringing us SharkFest. CACE Technologies for being the first home of SharkFest, Riverbed for taking up that mantle and hosting the project for so many years, and Loris Degioanni and everyone else at Sysdig for providing the resources necessary to get us across the finish line.

2023 is shaping up to be a great year for the project. Along with the foundation, we will celebrate our 25th anniversary in July, and we will be meeting in person again at SharkFest in Asia, the U.S., and in Europe. See you there!

You can learn more (and donate of course) at wiresharkfoundation.org.

If you or your employer would like to become a foundation member, you can learn more at https://wiresharkfoundation.org/pdf/become-a-member.pdf.

You can find Sysdig’s press release at https://sysdig.com/press-releases/wireshark-foundation/.

Comments 🔗

Comment by wireblog on 2023-04-03 22:17:09 +0000 🔗

this news is great and we know more about wireshark.

Comment by techradarto on 2023-04-06 20:08:20 +0000 🔗

celebrating 25th anniversary, that news was great .

What’s New In Wireshark 4.0?

Tue, 04 Oct 2022 23:22:08 +0000

Wireshark 4.0 was released today, and as you might have guessed from the version number, quite a few things have changed since 3.6. If you are a regular Wireshark user we recommend that you pay close attention to the release notes this time around, since it includes quite a few changes. I’ll cover some highlights here, but the release notes go into much greater detail.

Display Filter Changes 🔗

Display filters are one of Wireshark’s defining features and 4.0 makes them more powerful and more consistent. These improvements give you more control over the way that multiple occurrences of the same field are handled, let you do arithmetic, and many other things.

First, let’s look at the way multiple field occurrences are handled. Suppose you want to filter on an IPv4 source address. Within Wireshark that means using the “ip.src” filter field. You might assume that the packets on your network have one IPv4 header and therefore one source address, but that’s not necessarily the case. You might be in an environment that uses some form of tunneling like GRE or one of the many VPN protocols, and even on simple networks ICMP errors carry the IPv4 header of the offending packet. Maybe you live on the edge and used scapy to create a packet with a hundred or a thousand layers of IP in IP nesting.

In any case a filter like “ip.src == 10.1.2.3” can be ambiguous. Even worse, Wireshark has a completely made up “ip.addr” field, which is an alias for both “ip.src” and “ip.dst”. It’s convenient, but it also means you’re guaranteed to have two “ip.addr” fields for each IPv4 header which means guaranteed ambiguity.

In order to reduce this ambiguity Wireshark 4.0 adds a layer operator, which lets you select a specific occurrence of a field. To use the layer operator, just put a number sign and a layer number after a field. For example, if we have a GRE packet with both outer and inner IPv4 layers,

ip.src#1 == 10.1.2.3

will match the outer address,

ip.src#2 == 10.1.2.3

will match the inner address, and

ip.src == 10.1.2.3

will match either address.

Along with layers, you can be much more specific about matching zero, one or more, or all fields in a particular packet. You have been able to do the following comparison operators since Wireshark’s inception:

ip.addr == 10.100.100.1

If any of these match, we have a winner.

not ip.addr == 10.100.100.1

If none of these match we have a winner.

Wireshark also has “!=” (not equal), which was a bit confusing in past versions. This was fixed in Wireshark 3.6:

ip.addr != 10.100.100.1

In Wireshark 3.4 and earlier, if any of these don’t match, we have a winner. In Wireshark 3.6 and later, if none of these match, we have a winner.

Wireshark 4.0 adds the following:

ip.addr any_eq 10.100.100.1

If any of these match, we have a winner, similar to “==”.

ip.addr all_ne 10.100.100.1

If none of these match, we have a winner, similar to “!=” in version 3.6 and later.

ip.addr === 10.100.100.1
ip.addr all_eq 10.100.100.1

If all addresses match, we have a winner.

ip.addr !== 10.100.100.1
ip.addr any_ne 10.100.100.1

If any addresses don’t match, we have a winner, similar to “!=” in version 3.4 and earlier.

You can also do arithmetic – you can add, subtract, multiply, and divide. You can use the modulo (%) operator, which gives you the remainder of integer division. Suppose your company has all of its web servers running on a port that ends in 443: 443, 1443, 5443, 21443, etc. You can use the modulo operator to match them like so:

{tcp.port % 1000} == 443

There are a bunch of other changes as well. You can now match bytes starting from the end of a PDU, dates and times can be specified as UTC, Unicode can be matched using code points,

Default main window layout 🔗

In past releases Wireshark followed a standard set by its predecessors and placed the packet list, packet detail, and byte view on top of each other, like so:

That standard was set a long time ago when most monitors had a 4:3 aspect ratio and lower resolutions than they do these days. As of Wireshark 4.0, the default is for the detail and byte view to be next to each other, which makes it easier to take advantage of the real estate available on modern displays:

Conversations and Endpoints 🔗

The Conversations and Endpoints dialogs have been a popular feature for a long time and are often the first place people look when investigating a problem. Wireshark 4.0 makes them more powerful and easier to use. For example, you can tear off tabs — you can now see TCP and UDP conversations side by side in separate windows. Sorting has been improved, you can now hide columns, filter on stream IDs, and export data as JSON.

Hex import 🔗

Sometimes the packets you’re interested in aren’t in a nice pcap or pcapng file that you can just open with Wireshark, and are instead buried in a hex dump. Wireshark provides two ways to convert hex dumps to pcaps: “Import From Hex Dump” in the main application and the text2pcap utility. They had different feature sets and behaved differently in past versions, but they are much more consistent in Wireshark 4.0.

What’s Going Away 🔗

We no longer ship official 32-bit Windows packages for Wireshark 4.0 and later. If you’re still using a 32-bit Windows system, we’ll keep shipping Wireshark 3.6 updates until 2024. You won’t be able to take advantage of the cool new features in 4.0 and later, unfortunately.

What’s Not Here Yet 🔗

There are two features for Windows that we’d really like to add, but didn’t make the cut for 4.0: Dark mode and Arm64 support. Dark mode requires support from Qt, our user interface library. It’s still a work in progress, but we’re hoping it will make its way into Wireshark 4.2.

Building packages for Arm64 requires build hardware and software library support. We hope to have both of those in place for Wireshark 4.2 as well.

If You’re A Developer 🔗

We now require a C11 compiler, the PCRE2 library, and updated versions of many of the third party libraries that we use. We no longer require Perl to build Wireshark.

Summary 🔗

There are a bunch of other new features and improvements coming your way in Wireshark 4.0. Thanks to all of the developers that helped make this happen!

Comments 🔗

Comment by Guy Harris on 2022-10-05 06:35:19 +0000 🔗

Note that “Arm64 support” here specifically refers to Windows binary packages distributed from wireshark.org.

If, for example, a Linux distribution supports Arm64, they may provide Arm64 packages, whether source or binary, for current or past Wireshark versions. The issue is, as Gerald noted, an issue of wireshark.org building binary packages.

Furthermore, we already provide Arm64 binary packages of Wireshark 3.6.8 and, now, 4.0 for macOS.

Comment by Kara on 2022-10-05 14:52:09 +0000 🔗

Good

Comment by Totzi on 2022-10-26 08:14:58 +0000 🔗

YEAY!

We Have A New Sponsor

Thu, 13 Jan 2022 16:48:56 +0000

I’m excited to announce that Wireshark has a new home. I recently accepted a job with Sysdig, and along with that, they are now Wireshark’s primary sponsor.

I’m excited for a couple of reasons. First, I get to work with Sysdig’s founder, Loris Degioanni. We’ve been friends for a long time, and it’s difficult to summarize the impact he’s had on Wireshark. We first met in the early days of the project, back when it was still called Ethereal. At the time he was busy developing the WinPcap packet capture library, which was a natural fit for Ethereal and let us include Windows users in our community. This was a pivotal milestone for the project and it helped us grow into what it is today.

This isn’t the first time he’s asked me to join a company he founded. In 2006, my family and I moved halfway across the U.S. where I joined him at CACE Technologies and he welcomed us to our new town. We renamed the project to Wireshark and proceeded to build a line of products that complemented it. This was another pivotal time for Wireshark. We started hosting SharkFest, our developer and user conference. It allows the community to meet and share ideas in person, and it’s hard to overstate its importance to the project. I was (finally!) able to work on Wireshark full time, and with the help of our wonderful community, it grew to be the world’s most popular network protocol analyzer.

I’m also excited because Wireshark has a great sponsor in Sysdig. I was delighted to find that he’s built a wonderful company culture here. Everyone I’ve met is bright and creative, and open source is a huge part of the company and its culture. They sponsor the Sysdig system visibility tool (which Loris created) and the Falco runtime security tool. As part of Sysdig I’ll be applying what I’ve learned about low-level visibility to cloud environments.

Sysdig’s sponsorship will ensure that Wireshark and its community continues to grow. Wireshark has a wonderful community of users, developers, and educators and the work they do is important. Sysdig is cognizant of that and committed to supporting that community. They will continue to host SharkFest and support the community that builds and delivers the world’s best protocol analyzer.

Finally, I’d like to thank Riverbed for being such a great sponsor for so many years prior to this. Wireshark has been fortunate over its lifetime to have sponsors dedicated to supporting its community, and Riverbed deserves recognition for being a huge part of that.

Comments 🔗

Comment by tony fortunato on 2022-01-14 13:41:08 +0000 🔗

great to hear and excited to see what the future will hold.

Comment by Al Swanke on 2022-01-14 15:34:32 +0000 🔗

This is awesome! Congratulations Gerald!

Dedication and Disagreements

Tue, 02 Jul 2019 00:52:31 +0000

As I’ve mentioned in many of my talks about the Wireshark project, our primary goal is to help as many people as possible understand their networks as much as possible. We’ve been very fortunate over the years in this regard. Many people are passionate about this goal and have dedicated themselves to help to work toward it.

Although a group of people might agree about a particular goal, they can sometimes disagree about how to get there. When you add in personal dedication and investment, the disagreement can take on a life of its own. This happened to us recently.

Years ago when I worked at CACE Technologies we created the Wireshark Foundation¹. A couple of years later, Laura Chappell came up with the idea for Wireshark University and the WCNA certification program. She worked out an agreement with CACE’s CEO to license use of Wireshark’s trademarks which they subsequently signed.

Shortly after that, Riverbed acquired CACE, along with the Wireshark Foundation. Like CACE, Riverbed has been both supportive of the project and hands-off. They pay my salary, fund SharkFest and our infrastructure, and have done so since the acquisition. We always strive to do more, and last fall it was suggested that we might be able to bring in extra money to fund more initiatives which would improve Wireshark and benefit the community.

One of the ideas for extra revenue involved restructuring Wireshark University in the hopes of including more educators. We presented the plan to Laura, and it didn’t go well. Our relationship deteriorated to the extent that Laura now maintains that Riverbed has taken over Wireshark. I love and respect her and will be forever grateful for what she’s done for the Wireshark community, but I strongly disagree with this viewpoint.

Riverbed has and continues to be very hands-off with Wireshark and is dedicated to our independence. They don’t dictate our roadmap or otherwise try to push us in a particular direction². In my keynote³ at SharkFest ’19 US, I talked about creating an independent entity for the Wireshark Foundation and our assets, and they’ve been supportive of the entire process.

Going Forward 🔗

Although we weren’t able to come to an agreement on Wireshark University, there was never any question that Laura is welcome to keep using the Wireshark trademark to describe the purpose of her training courses, books, and the WCNA certification program. I would personally prefer that she continue to use the name “Wireshark Certified Network Analyst” – we would just need to have a proper agreement in place. If any of this wasn’t made clear to her over the past few months then that’s on me.

Please don’t let this dissuade you from buying Laura’s books, attending her classes, or going through the WCNA program. She’s a great educator and we share her passion for helping people understand their networks.

Also please be assured that Wireshark is and will always remain Free and Open Source Software. I am forever grateful to our global group of enthusiastic developers who continue to evolve the project. However, stuff costs money, and some of the initiatives we’ve discussed include (but aren’t limited to) hiring support staff. In order to serve the user and developer community and fund the project we must explore options such as charging for non-exclusive use of the Wireshark University trademark.

1 I don’t recall the precise reason, but it was most likely to reduce CACE’s exposure in the event that I left the picture. They were betting the farm on Wireshark. It should be noted that my daughter and I were on Southwest flight 812, so this wasn’t an unreasonable concern.
2 Aside from the occasional bug report from one of my co-workers. 🙂
3 See the “Sustainability” the keynote at https://sharkfestus.wireshark.org/sf19, about 36:15 in.

Comments 🔗

Comment by TomLaBaude on 2019-07-02 12:10:58 +0000 🔗

Donation would be a great opportunity for people and companies to contribute financially to Wireshark.

As a freelance, I use Wireshark in my software in the terms of the license and earn some revenues from it.
But I can’t contribute back by coding, I only report bugs.

At my level, I’d donate yearly part of my revenue to Wireshark Foundation.

Imagine rest of the world.

Comment by Uli on 2019-07-02 14:37:08 +0000 🔗

I’m with Tom. Putting some donation information on the website would help. There are a lot of companies where Wireshark is important for their business. I guess some of them would like to contribute with money.

Comment by David Lopez on 2019-07-02 15:46:54 +0000 🔗

Hi Gerald, thank you for the blog and clarification. I recently attended sharkfestUS-2019 and loved it. I enjoyed and learned a lot from all the presentations. Janice did a great job at organizing the venue and it takes money to hire staff and get resources. After sharkfest I got a copy of Laura’s great books and prepared for the WCNA which I successfully passed.
My only concern now is that Riverbed may decide to come out with their version of the Wireshark Certification program.

regards,
DL

Comment by Roland on 2019-07-02 17:02:20 +0000 🔗

@David – I do not think you have anything to worry about that. WCNA has a very good name to it, and rightfully so, and it will keep having a good name, as long as Laura steers the WCNA certification, as she is an excellent teacher.

Comment by Laura Chappell on 2019-07-03 15:46:41 +0000 🔗

Roland – unfortunately, Riverbed has kicked me out of steering the Wireshark Certified Network Analyst certification. Their lawyers hound me relentlessly – hence the name change to simply “WCNA Certification.”

In November, Janice Spampinato stated that [verbatim]: “they [Riverbed Education] are very enthusiastic about bringing that [the WCNA certification program] under the Riverbed training umbrella… did you see anything about the RCP program at SharkFest? …it would be a nice complement to what they are doing.”

Comment by Roland on 2019-07-03 16:03:22 +0000 🔗

@Laura – this is simply not the situation as described above in the blogpost. WCNA is your baby and always has been. Gerald has described that above and I agree 100% with that assessment.

But Wireshark University is a brand that is thought and could be a way to create a way to finance the project in the future. This is the core issue, to enable a long-term survival of the project.

Comment by Laura Chappell on 2019-07-03 17:10:22 +0000 🔗

I’m glad you see the Wireshark Certified Network Analyst program as my “baby.” I wish Riverbed legal would see it that way.

Yeah… we were told that the “Wireshark University” name would be licensed out to make money (going into a Riverbed bank account – we were told “not to worry about that”). Sure wish Janice had come to me first to see how I could’ve helped raise funds for the project. Blindsiding a long-time partner leaves a “Riverbad” taste in my mouth! Ha ha ha ha ha….

Comment by Gerald Combs on 2019-07-03 21:05:26 +0000 🔗

@Laura – I sometimes joke that I’m a business unit of one, but it’s true. Wireshark has a department code within Riverbed and I’m its sole employee. It’s also where the income and expenses for the project are handled, and I oversee them all.

Other issues aside, we seem to be in heated agreement about the WCNA. I’d dearly love for you to keep using the name. Again, that would require an agreement.

Comment by tony on 2019-07-09 13:48:34 +0000 🔗

wow. i had no idea what was going on.
looks like i should thank Janice for blacklisting me

Comment by James Robinson on 2019-07-22 15:05:48 +0000 🔗

Wow.. I got my Wireshark Certification because of the excellent relationship between Laura and Gerald. In the books, there were meaning Forewords supporting the books and training. I felt proud to call myself a Wireshark Certified. Now, it seems like an interesting situation and I can’t but wonder about the value of the certification. The logo even changed and I can’t wait to find out what else will change. Even the portal is going away. Just hoped that there is some compromise or agreement. I am still in shock. Please get this together soon .. Let’s stop the emails, set at table, and work this out for us …

Wireshark Is Now Twenty

Sat, 14 Jul 2018 20:31:21 +0000

Twenty years ago today I announced Ethereal 0.2.0, which marks the first public release of what is now Wireshark. The release was an attempt at two things: to create an interactive protocol analyzer for Linux and Solaris so that I could do my job better, and to give back to the open source community. As it turns out the second goal had a huge effect on the first one. After the initial release developer and user communities quickly formed. Different people had different goals such as support for other platforms and protocols, troubleshooting in specific environments, education, product development, network forensics, and so on. After a while things settled down to a single goal:

To help as many people as possible understand their networks as much as possible.

As goals go that’s pretty broad and implies a lot of work. Open source project hosting services didn’t exist in 1998 so in the olden days we pretty much ate sand. For example, I made thirty releases in the first year. Twenty of them were first two months. That’s because I was our revision control system¹. Contributors would send me patches, I’d apply them to my source tree and then make a release. Everyone would then sync their source directories with the new release. Fortunately we stopped doing that in short order. Other parts of the project followed similar paths. The first Windows packages were ZIP files with no capture driver. Our first web server was a 40 MHz SPARCstation IPX with 64 MB of RAM. We inflicted X11 on our macOS users far longer than we should have.

The project grew from those humble beginnings to what is today â€“ the world’s most popular network protocol analyzer. The goal is still there, and many people and organizations are helping us achieve it. We have a wonderful sponsor in Riverbed, which pays my salary, provides our infrastructure, and sponsors SharkFest, our developer and user conference². It’s managed by Janice Spampinato, who does a spectacular job of making sure our community can share its knowledge face to face in a welcoming environment.Â Speaking of SharkFest, we’re having three of them this year! Laura Chappell does a correspondingly spectacular job with Wireshark University, educating users throughout the year. Our user and developer community is second to none in its expertise, knowledge, and willingness to help.

I could not be more proud of what we’ve accomplished and look forward to the challenges and opportunities. On behalf of the Wireshark development team, thank you for your support.

Never, ever do this. If you want to start a project, just commit your code to GitLab. Or GitHub. Or BitBucket. Or anything else that doesn’t involve manual patching.
If your career involves looking at packets you should maybe show up once in a while.

The Cloudflare Incident And Its Impact On Wireshark.org

Sat, 25 Feb 2017 18:39:29 +0000

Cloudflare recently announced a security incident that potentially impacts anyone who visited various wireshark.org and winpcap.org sites for the past six months.

What happened? 🔗

Cloudflare is a popular service that provides content delivery, DDoS protection and DNS services for web sites.

A software bug Cloudflare’s servers leaked potentially sensitive information. Some of that information ended up in caches all over the Internet. At Google, Microsoft, your ISP, your company’s or university’s proxy servers, and elsewhere. Due to the randomness and distributed nature of the bug, it’s difficult to know what the full impact is. Cloudflare provides the following estimate:

“The greatest period of impact was from February 13 and February 18 with around 1 in every 3,300,000 HTTP requests through Cloudflare potentially resulting in memory leakage (thatâ€™s about 0.00003% of requests).”

The bug was introduced on September 22, 2016 and fixed on February 18th, 2017.

The Google Project Zero bug describing the issue in detail can be found at https://bugs.chromium.org/p/project-zero/issues/detail?id=1139

Cloudflare’s incident report can be found at https://blog.cloudflare.com/incident-report-on-memory-leak-caused-by-cloudflare-parser-bug/

The initial Hacker News discussion can be found at https://news.ycombinator.com/item?id=13718752

Was Wireshark affected? 🔗

The following wireshark.org and winpcap.org sites were behind Cloudflare proxies during the period in question:

ask.wirehsark.org
blog.wireshark.org
bugs.wireshark.org
sharkfest.wireshark.org
sharkfesteurope.wireshark.org
wiki.wireshark.org
www.wireshark.org
www.winpcap.org

Wireshark’s download servers (*.dl.wireshark.org), buildbot.wireshark.org and code.wireshark.org were not behind Cloudflare.

I browsed to a one of the sites listed above between September 22nd, 2016 and February 18th, 2017. Am I affected? 🔗

The chances are slim, but those chances are not zero.

Most of the content that we serve is “static” and “public.” That is, it’s the same for everyone and doesn’t contain any sensitive information. The risk exposed by Cloudflare is from dynamic content that contains sensitive information such as the login page on ask, bugs, wiki, etc. Our web sites get frequent requests for static content, but dynamic requests are relatively infrequent.

In a world where everyone has infinite free time I would have no qualms about recommending that everyone with a wireshark.org account change his or her passwords. However, this is the real world and your time is valuable. If you logged in to one of our sites and used a unique password it might not be worth your time to change it. On the other hand, if your professional reputation depends on your ask.wireshark.org score you probably should. If you have any sort of administrative access you definitely should. Most of our users fall into the first category.

If you’re wondering why it looks like I’m downplaying the importance of changing your wireshark.org passwords, see the next question.

I used a web browser, smart phone, or an internet-connected wearable doohickey between September 22nd, 2016 and February 18th, 2017. Am I affected? 🔗

I honestly don’t know. The chances are almost certainly not zero.

Cloudflare is a very popular service. At the time of this writing an unofficial list of affected sites stands at more than four million entries and counting. It includes many of the world’s most popular web sites.

If you’re going to spend time changing passwords, doing so for sites that deal with finance, email, DNA testing, dating, and other parts of your personal life probably ranks higher than that for, say, the Wireshark wiki.

Isn’t a vague answer like “the chances are slim but not zero” a frustratingly craptastic one compared to a definitive “yes” or “no”? 🔗

Yes, but it’s also the honest and correct one.

Update: March 2, 2017 🔗

Yesterday Cloudflare posted an update on the issue at https://blog.cloudflare.com/quantifying-the-impact-of-cloudbleed/. In it they posted the following leak estimates:

 Requests per Month       Anticipated Leaks
 ------------------       -----------------
        200B â€“ 300B         22,356 â€“ 33,534
        100B â€“ 200B         11,427 â€“ 22,356
         50B â€“ 100B          5,962 â€“ 11,427
          10B â€“ 50B           1,118 â€“ 5,926
           1B â€“ 10B             112 â€“ 1,118
          500M â€“ 1B                56 â€“ 112
        250M â€“ 500M                 25 â€“ 56
        100M â€“ 250M                 11 â€“ 25
         50M â€“ 100M                  6 â€“ 11
          10M â€“ 50M                   1 â€“ 6
              < 10M                     < 1

The affected wireshark.org web sites get just over 10M requests per month combined. Private traffic is substantially less than that.

Comments 🔗

Comment by Graham Bloice on 2017-02-27 04:12:48 +0000 🔗

And the implications if using a remote authentication service rather than a password held on a Wireshark service, e.g. OAuth?

Comment by Greg Gill on 2017-03-04 13:10:47 +0000 🔗

Not a good news at all.
“I browsed to a one of the sites listed above between September 22nd, 2016 and February 18th, 2017. Am I affected? The chances are slim, but those chances are not zero”

Comment by Dustin DeTorres on 2017-03-23 04:48:57 +0000 🔗

Is there anything a user should do?

Getting Ready for SharkFest ’16

Thu, 09 Jun 2016 20:32:44 +0000

The week leading up to SharkFest is always a busy and hectic time around here, but it’s also exciting. I can’t wait to see everyone, and the talks and labs this year promise to continue our tradition of imparting protocol analysis knowledge and insight.

If you’re sill unsure about attending, perhaps this list of reasons for attending that Laura Chappell recently posted will sway you:

1. Gerald Combs and the Wireshark Developers

Gerald Combs, the creator of Wireshark (formerly Ethereal), and many of the core developers will be there actually working on the code in the Developer’s Den. They will be presenting many of the sessions, joining in on the social events (they are a fun group!) and sharing tips and techniques to improve your analysis process.

2. Wireshark Experts as Presenters and Varied Content Levels

There is no dispute that the presenters at SharkFest are the world-authorities on troubleshooting, security analysis, and network optimization. These are the folks who live in the world at packet-levelÂ and can spot a rogue packet at 50 paces! Through a variety of introductory through advanced lectures and hands-on labs, these presenters will show you some hot Wireshark techniques to speed up your time to resolution.

3. Focus on Wireshark 2

It’s time to move up to Wireshark 2. All the presentations and labs at SharkFest ’16 will be focused around the new version of Wireshark. From new features to new techniques, accelerate your migration to Wireshark 2 by getting an inside look at how the experts work their magic.

4. The Reef at SharkFest

I will be hosting The Reef again at SharkFest. The Reef will host hands-on lab exercises, numerous Wireshark University Certified Instructors, Wireshark experts, and Wireshark Developers. Come in and try your hand at the labs and pick up the SharkFest Packet Challenge. This is a great opportunity to mingle amongst Wireshark gurus and hone your troubleshooting and network forensics skills.

5. Hands-On Labs

Get your hands dirty in one of the lab sessions at SharkFest. This year we have added a 100-seat hands-on classroom to SharkFest. This is in addition to the 300+ seater Hahn auditorium. We will also have numerous lab exercises hosted in the Reef and folks to help out on the more challenging labs.

6. Social Events and Peer Networking

The SharkFest team has put together a Welcome Dinner, Vendor Night Party, “Sake’s Surprise” Dinner, and Closing Reception to give you plenty of time to network with other analysts. The casual atmosphere of the Grand Hall lunch area and the Reef offer plenty of opportunities to meet and mingle with other attendees and the developers.

7. Packet Challenge

Again, you will have the chance to test your skills in the SharkFest Packet Challenge. Pick up the Challenge Worksheet in the Reef and grab the USB stick filled with trace files. Turn in your answers in the Reef by Wednesday evening and join us for the Packet Challenge Awards Ceremony in the closing keynote timeslot.

8. Analysis-Focused Vendors

Vendor night is a highlight of the event. As the band plays and the food sizzles on the grill, visit the vendors who sponsor SharkFest. Each vendor is focused on network analysis, troubleshooting, security, optimization and other related topics. These are the folks we all work with to build the most effective analysis environments possible.

9. Computer History Museum and the Revolution

Considered one of the world’s best collection of historical objects relating to the computer industry, the Computer History Museum is a must-see destination for folks in the tech industry! During SharkFest, you will have time to visit the Revolution exhibit to see history in the making. This is our second year at the Computer History Museum – it’s an amazing venue.

10. Sake’s Surprise

I can’t wait to give you more details on this one. Right now, the surprise is in development. It should really be a highlight at SharkFest ’16. As soon as I’m allowed to spill the beans, I will!

11. Troubleshooting with Wireshark Pre-Conference Class

As an extra here, I will be teaching a 3-day class just before SharkFest. The focus is troubleshooting, troubleshooting, troubleshooting! Get the bundle pricing for SharkFest and the 3-day class at https://sharkfest.wireshark.org/registration16.html.

If you can’t attend SharkFest U.S., these reasons also apply to SharkFest Europe. If you are attending either conference, I’ll see you there!

Comments 🔗

Comment by Richard Stewart on 2016-06-10 14:19:47 +0000 🔗

**NOT A COMMENT – QUERY ON RSS FEED!! **
Hi
Couldn’t find a contact address, so am posting this here….
RSS feed at ‘https://blog.wireshark.org/feed/’ appears badly broken – validation through ‘http://validator.w3.org/feed/’ shows multiple errors. Discovered this as I use Outlook as my RSS reader. Any chance you could look at it/fix it please?

Let me tell you about Wireshark 2.0

Sat, 07 Nov 2015 00:35:54 +0000

We’re getting ready to release Wireshark 2.0, which includes a major user interface update. As a comparison, here’s a picture of Wireshark 1.12.8, which is the current stable release:

Here’s a picture of Wireshark 2.0.0rc2, which is the current development release:

See? Totally different.

Actually, quite a few things have changed. The user interface has been completely rewritten using a different interface library (Qt). It has been streamlined so that you can work faster and it should have a better look and feel on every platform. The screenshots above are similar because we’ve also tried to ensure that the new UI is familiar to current users. The features you’re used to are still there and in the same place (or at least nearby). They should work much more smoothly, however.

I can’t hope to cover all of the changes in Wireshark 2.0 in one blog post, but here are a few highlights:

Capture options. Capture options have been simplified and consolidated. In 1.12 they are spread out in many places across several windows. In 2.0 they are in two places: the Capture Options dialog (Captureâ†’Options or the “gear” icon in the toolbar) and the Manage Interfaces dialog, which you can open by pressing “Manage Interfaces” in the Capture Options dialog.

Streamlined preferences. Preferences windows usually aren’t something to get excited about and this is no exception, but it’s important to note that in the process of removing clutter some preferences have been removed from the main window. They’re still available in the “Advanced” preference section which lists every available preference item.

Translations. Thanks to the hard work of many contributors the new interface supports multiple languages. You can now select between Chinese, English, French, German, Italian, Japanese, and Polish in the “Appearance” preferences section. Many more translations are underway. You can see the status the translation efforts and help out with the effort at https://www.transifex.com/wireshark/wireshark/.

Related packets. As you scroll through the packet list you might notice little symbols pop up along its left edge. For example, you might see left and right arrows for DNS requests and Replies, or a check mark to denote an ACKed TCP packet. These are related packets. This exposes some plumbing we’ve had in place for a long time, but it’s now shown in the main window instead of buried deep in the packet detail tree.

Intelligent scrollbar. As you scroll through the packet list you might notice that the scroll bar itself looks odd. It now features a map of nearby packets, similar to the “minimap” available in many modern text editors. The number of packets shown in the map is the same as the number of physical vertical pixels in your scrollbar. The more pixels you have, the more packets you can see. In other words, if you use Wireshark regularly you now have a legitimate business case for a retina display.

Statistics dialogs. The dialogs under the Statistics and Telephony menus have seen many improvements. The backend code has been consolidated so that most of Wireshark’s statistics now share common internal logic. This in turn let us create common UI code with many workflow improvements and a much more consistent interface.

I/O Graph dialog. You can now graph as many items as you like and save graphs as PDF, PNG, JPEG, and BMP. Graph settings stay with your profile so you can customize them for multiple environments.

Follow Stream dialog. You can now switch between streams and search for text.

General dialogs. Many dialogs now have context-aware hints. For example the I/O Graph and Follow Stream dialogs will tell you which packet corresponds to the graph or stream data under your cursor. Most of them will stay open after you close a capture file so that you can compare statistics or graphs between captures.

If you want to see a live demonstration of the new UI, Laura Chappell and I are presenting a webinar next week on the 12th at 10:00 AM PST. You can register at http://bit.ly/wireshark2.

The final 2.0.0 release should be available in a couple of weeks. I’m excited about the new UI and about the opportunities that it provides for new features and further improvements.

Comments 🔗

Comment by Guy Harris on 2015-11-06 17:35:38 +0000 🔗

And the OS X version no longer requires X11.

Comment by Albert on 2015-11-06 18:39:22 +0000 🔗

Noice

Comment by Noice on 2015-11-09 18:59:59 +0000 🔗

Noice, noice

Comment by Noice, noice on 2015-11-09 21:00:38 +0000 🔗

Noice, noice, noice

Comment by Noice, noice, noice on 2015-11-10 01:53:43 +0000 🔗

Noice, noice, noice, noice

Comment by Noice, Noice, Noice, Noice on 2015-11-10 02:19:59 +0000 🔗

Noice, Noice, Noice, Noice, Noice

Comment by David Steele on 2015-11-10 03:43:40 +0000 🔗

Love the concept of color coding the drag bar so you have a chance to see where things that interest you _may_ be hiding in the cap.

Comment by c.mckenzie on 2015-11-10 04:35:17 +0000 🔗

Hey Gerald! Good job. This article made it to reddit btw, https://www.reddit.com/r/sysadmin/comments/3s6fm7/let_me_tell_you_about_wireshark_20/ … hit me up on skype sometime.

Comment by Joseph on 2015-11-10 06:22:15 +0000 🔗

The OS X version has stopped requiring X11 since months ago

Comment by noiceee on 2015-11-10 09:59:09 +0000 🔗

noiceeenoiceeenoiceeenoiceee
noiceeenoiceeenoiceee
noiceee

Comment by James on 2015-11-11 14:38:16 +0000 🔗

Can’t see packet data when opening a single frame.

Comment by Hansang Bae on 2015-11-11 18:34:45 +0000 🔗

VERY NICE! Congrats Gerald.

Comment by Hansang Bae on 2015-11-11 18:35:03 +0000 🔗

VERY NICE! Congrats Gerald, and core developers!

Comment by RoestVrijStaal on 2015-11-21 02:46:02 +0000 🔗

I’m wondering: How much C++ code have you to rewrite to the Javascriptish QML to wrap the Wireshark logic around Qt?

Comment by Gerald Combs on 2015-11-21 11:35:26 +0000 🔗

@Roest The new UI is written using Qt’s C++ API and not QML. This let us more easily take advantage of much of the pre-existing code in the GTK+ UI. We might end up using QML in the future if we ever write an Android or IOS UI. As far as I know, no one is working on that however.

Comment by Noice on 2015-12-01 00:55:51 +0000 🔗

NOICE!

Cool New Stuff

Wed, 17 Dec 2014 16:57:16 +0000

Hello everybody, we’ve got a handful of miscellaneous announcements for you today. They all just happened to occur within a handful of days, so it made more sense to lump them all into one post.

Development version 1.99.1 was released, another milestone on the road to 2.0 and our shiny new Qt interface. You can read the full announcement with release notes here, and download it from the “Development Release” section of here!
Tweet tweet! That’s right, we have an official twitter handle now for announcements and the like. It is shared by several of the core developers, but mostly run by our fearless leader Gerald. Follow us @WiresharkNews to find out more!
Thanks to the hard work of our Debian maintainer Bálint, we now have an Ubuntu PPA (Personal Package Archive) containing the latest stable Wireshark releases pre-built for all the supported Ubuntu releases. If you’ve ever wanted the latest and greatest Wireshark on an older version of Ubuntu, now’s your chance, so get it here.
Last but not least (although this one’s older – it actually launched way back in June), our repository now has an official github mirror. Please note that this is a convenience only; pull requests and issues will still go through our existing Gerrit and Bugzilla sites. The github mirror is very much *just* a mirror, but it is handy to have none-the-less.

That’s all we’ve got for you today, hopefully one or more of the above items caught your eye.

Wireshark 1.12 Officially Released!

Thu, 31 Jul 2014 22:40:45 +0000

We are proud to announce the release of Wireshark 1.12.0! This is a fairly significant release for us, as we expect it to be the very last release using the GTK toolkit in the default interface (see this post for our plans to replace it).

Wireshark 1.12 contains a substantial number of fixes and new features, representing just over a year of development effort. Check out the release notes for full information on what’s new and improved, and download it now!

If you have any issues with the new version, please file a report in our bug tracker.

Comments 🔗

Comment by L.Grove on 2014-08-05 10:37:44 +0000 🔗

Version 1.12 does not capture IEC61850 MMS massage any more. The MMS will be shown in T.125. This is not right.

Comment by Evan Huus on 2014-08-05 12:14:43 +0000 🔗

@L.Grove this is not the best place for bug reports: please file an issue in Bugzilla (https://bugs.wireshark.org/bugzilla/)

Comment by L.Grove on 2014-08-07 08:49:35 +0000 🔗

@Evan Huus, thanks, I didn’t know there is bugzilla

Comment by Andy Konecny on 2014-08-09 18:50:36 +0000 🔗

The install faults on one bit, that it uninstalls the previous version, and only then tells me there may be issues running it on XP and it recommends the version it just uninstalled. Kind of backwards.
Yes some of us are still stuck with some XP around because software doesn’t self recompile its own architecture to work on Vista+, especially when the source code is no longer available. Think about that great tool you found on the internet who’s author passed away years ago.
So far version 1.12 hasn’t blown up on XP.

Comment by Graham Bloice on 2014-08-10 04:12:51 +0000 🔗

@ Andy Konency, from the release notes:

2.4. Platform Support

Support for Windows XP has been deprecated. We will make an effort to support it for as long as possible but our ability to do so depends on upstream packages and other factors beyond our control.

However the installer could warn XP users before doing anything.

Comment by ladroop on 2014-08-11 08:42:45 +0000 🔗

i’m not a specialist in this but i used it to capture some packages from a rtmpt stream (filter rtmpt.function.response).
version 1.10.7 captures them , version 1.12 does not

Comment by Evan Huus on 2014-08-11 08:58:08 +0000 🔗

@ladroop this is not the best place for bug reports: please file an issue in Bugzilla (https://bugs.wireshark.org/bugzilla/)

Comment by OSX Fangirl on 2014-08-14 10:48:21 +0000 🔗

So I see wireshark still requires X11. Double U, Tee, Eff m8?

Comment by Evan Huus on 2014-08-14 11:09:58 +0000 🔗

@OSXFangirl this is the very last release requiring X11 – as mentioned in the post we are in the process of moving from GTK+ to Qt, which includes a native OSX UI among other goodies. I believe the x64 development builds (the “1.99” versions at https://www.wireshark.org/download/automated/osx/) already ship with a basic Qt UI, though it is by no means complete yet.

Comment by Idan on 2014-08-23 09:22:41 +0000 🔗

Evan,
Just wondering whether the new UI will support retina displays, right now it looks quite pixelated.

Comment by Evan Huus on 2014-08-23 10:42:55 +0000 🔗

@Idan I don’t know; I imagine Qt does support retina for the things it provides, but we may need to do some work on our end to provide retina logos etc. Perhaps try asking on one of our mailing lists: https://www.wireshark.org/lists/

To Infinity and Beyond! Capturing Forever with Tshark

Tue, 08 Jul 2014 00:57:25 +0000

Over the last couple of years that I’ve been involved with Wireshark, one issue has reared its head a significant number of times in a surprisingly varied number of ways. These range from “Capturing with tshark uses more and more memory!” to “I set tshark to capture in the background, and it keeps crashing!” to “How do I set up tshark to capture forever?”

Historically we’ve had no good answer to these complaints – Wireshark and tshark both only do what is called stateful dissection. This means that they store what they’ve seen in memory and use that information to provide additional details about future packets, for example by matching requests with responses. While this provides substantial benefits — reassembly of protocols over TCP being probably the most obvious — it means that as the amount of traffic increases, so does the amount of memory needed to store all of that state. It also means that there’s no way for tshark to run forever unless you’ve got infinite memory (what’s your secret!?) or no traffic at all.

All of that has just changed. Wireshark and tshark have long had a feature that lets you rotate your packet capture across multiple files, preventing any one file from getting too large; to do this, check out the “-b” flag to tshark. This was handy for systems limited in disk space, but did nothing for the ever-growing memory usage. A few days ago, however, I landed a change in tshark’s master branch that makes it discard its internal state every time the capture rotates to a new file. This has one huge benefit: you can now capture (theoretically) forever with tshark by using the “-b” flag!

Like any experimental change however, it does currently have a number of limitations:

State is lost when we switch to a new file, so if two fragments of the same message get split across that file boundary, they will not be reassembled. This is effectively unavoidable – while we considered discarding only very old state, this turns out to be extremely difficult with our current architecture. However, the result is that the dissection you get when capturing with “-b” should actually be closer now to the dissection you get when opening the individual files after the fact.
Discarding state can be a surprisingly expensive operation, so captures using this feature in high-traffic environments may see their dissection fall behind when switching to a new file. If you see this, please file a bug report with as much detail as you can provide, and we will try to smooth out the rough edges.
Memory usage might still grow a very small amount due to previously-hidden memory leaks now being much more obvious. Again, if you see anything problematic, please file a bug report.
This feature is limited to tshark only, it is not available in the graphical Wireshark interface. The graphical interface has to permit scrolling backwards to look at previously dissected packets, so it can’t discard anything until the entire capture is closed. (Edit: This isn’t strictly true – now that I’ve actually checked my assumptions, it should be possible to make the GUI behave the same way. It will take some additional work though.)
This feature is limited to the master branch only, it will not be in the upcoming 1.12 release. Given the substantial nature of the change, it was decided that it needed a chance to cook before being released as a “stable” feature. It is, however, present in the 1.99 automated development builds as of this morning.

Please test it out and let us know what you think. Happy capturing!

Comments 🔗

Comment by Scott on 2014-07-07 21:03:19 +0000 🔗

I can’t see the reasoning for continuous analysis. If there’s a problem, more often than not, in my experience, a multi-hour or multi-day trace will reveal the source of the problem.

And more to the point, how the heck can pouring through that much information–a continuous capture– produce any improvement? There are incremental opportunities to be sure, but that much information is just not practical. I know. That’s how we were packaging the data just to appease some people asking for it. Not worth it.

Comment by Jim Baxter - PacketIQ on 2014-07-08 06:23:04 +0000 🔗

Great article – Thanks, Evan. Do I correctly interpret your discussion to mean that the graphical Wireshark interface can’t discard state to free memory when using the Ring Buffer option? Wasn’t aware of that.

Comment by Evan Huus on 2014-07-08 12:48:15 +0000 🔗

@Scott People keep asking for it, so there must be use cases somewhere.

@Jim My apologies – you correctly interpreted my post, but I hadn’t checked one of my assumptions, so it should be possible to make the GUI behave the same way. I’ll have to take a look at that.

Comment by Anders Broman on 2014-07-10 03:25:36 +0000 🔗

@Scott

I can’t see the reasoning for continuous analysis. If there’s a problem, more often than not, in my >experience, a multi-hour or multi-day trace will reveal the source of the problem.

That’s exactly it. That might not be possible without Evans change as tshark might run out of memory quite quickly under heavy traffic. Chosing the ring buffer file size apropriatly you would get chunks of a managable size for a given time period.

Comment by Paul Offord on 2014-07-13 00:03:37 +0000 🔗

Hi Evan,

Interesting article.

We run a lot of continuous captures to catch intermittent problems. We have always used dumpcap directly to avoid the memory problem. What advantage would we get running tshark rather than dumpcap.

Cheers…Paul

Comment by Evan Huus on 2014-07-13 05:51:12 +0000 🔗

@Paul

Instantaeous alerting. Dumcap doesn’t do dissection, so if you want to actually find out what’s going on in the traffic you capture that way, you have to pull it off the server and run tshark/wireshark on it separately (in other words, it’s useful diagnostically after the fact, but can’t be used to detect errors itself). With tshark running continuous dissection you get the packets dissected right away, so you can actually raise alerts on that information if something is wrong, without waiting for the application proper to complain.

Detecting Heartbleed Traffic

Wed, 09 Apr 2014 23:02:49 +0000

The big news in the tech industry this week is The Heartbleed Bug, a vulnerability that affects a large portion of secure web sites on the Internet. I updated the Wireshark and WinPcap web sites on Monday (along with reissuing and revoking certificates) shortly after OS patches were released.

Our web sites are protected going forward, but what about the past? We have a Shark appliance in our environment but that leads to a challenge. We had about 350 GB of HTTPS on our network on Monday alone. This is just slightly too large to load into Wireshark.

Fortunately one of my coworkers (P.J. Malloy) came up with a BPF filter that matches Heartbleed traffic:

http://www.riverbed.com/blogs/Retroactively-detecting-a-prior-Heartbleed-exploitation-from-stored-packets-using-a-BPF-expression.html

Applying this filter directly on the Shark appliance gave me a much smaller number of packets which I could easily analyze in Wireshark. So far I haven’t found anything suspicious.

We’re switching to Qt.

Tue, 15 Oct 2013 21:29:13 +0000

Today I released the next development version of Wireshark, 1.11.0. This marks a major change in the direction of the project. We’re switching our user interface library from GTK+ to Qt. Both libraries make it easy for developers write applications that will run on different platforms without having to rewrite a lot of code. GTK+ has had a huge impact on the way Wireshark looks and feels and on its popularity but it doesn’t cover our supported platforms as effectively as it should and the situation is getting worse as time goes on.

Making such a large change wasn’t an easy decision. It means rewriting thousands of lines of code and requires a lot of careful design. We might be the largest standalone application to make this transition (feel free to correct me below). However, I think it’s well worth it and that it’s important to the long-term direction of the project. Ultimately it came down to one thing:

Wireshark’s job is to show you what’s happening on your network. If it can’t run on your system then it’s not doing that job.

If you’re using Windows, Mac OS X, or Linux Mint we need to support Windows, Mac OS X, and Linux Mint. If you’re using an iPad or a Galaxy Note we need to give you a long, hard, nonplussed stare and think about supporting IOS and Android at some point.

When I started writing Ethereal (Wireshark’s original name) it looked like this:

It looked like that on Linux and Solaris. It didn’t look like that anywhere else because those were the only two platforms we supported. I chose GTK+ for the user interface toolkit because it made the most sense. Compared to the options available at the time it had a number of advantages. It was small, light, easy to work with, had an active development team, and had a compatible license. A short time later we added support for Windows. GTK+ had some initial compatibility issues on Windows but it has gotten better over time.

Since then the platform landscape has changed but unfortunately GTK+ hasn’t. Most notably Mac OS X has gained popularity and people are starting to ask about Wireshark for their tablets. GTK+ supports OS X but it’s definitely a second-tier platform, making it hard to install and use. We either have to require X11 (like Inkscape) or use an experimental native GTK+ port (like GIMP). Either way it requires a lot of effort on the part of developers to produce a substandard application for users. With GTK+ Wireshark doesn’t look or act at all like a Mac OS X application:

Qt on the other hand provides a nice, clean user experience on all of the platforms that we currently support. If you install the 64-bit version it now looks like this:

What does this mean for users? 🔗

If you’re a power user you should probably keep using the GTK+ flavor for the time being. You should also test the Qt flavor from time to time to see how your workflow will change. Both are installed by default on Windows and Linux.

If you’re running OS X you should use the Qt flavor. For common tasks it should have a better workflow. Again, if it doesn’t we aren’t doing our job.

What does this mean for developers? 🔗

If you’re developing a new feature using GTK+ you should stop. You’re very likely wasting your time. If you would like to help with the migration grab the code and start developing.

What works? 🔗

Everything under the “File” and “Edit” menus.

You can capture, filter, and inspect traffic.

You can edit preferences.

You can follow streams.

You can view TCP stream graphs.

What doesn’t work? 🔗

Everything else. No capture options, I/O graphs, flow graphs, VoIP analysis, etc. We still have a lot of work to do.

Switching to Qt is a long and arduous process but I’m excited about what the future holds.

P.S. Solaris is still supported.

Comments 🔗

Comment by user on 2013-10-16 04:12:28 +0000 🔗

Yay! GIMP dropped X11, and now Wireshark too, thats just super cool )
It would be great if automatic updates would be incorporated at an early stage of the development of the Qt version.

Comment by Laura Chappell on 2013-10-16 22:00:16 +0000 🔗

I’m thrilled at this change. I know it was a difficult decision for the you and the entire development team, but it had to be done. Thanks for all your efforts in moving into this next phase!

Comment by Tekn0 on 2013-10-17 08:10:40 +0000 🔗

Glad you still support Solaris!

Comment by Moschops on 2013-10-17 08:18:24 +0000 🔗

Yeah Solaris! 🙂

Comment by ikt on 2013-10-17 08:25:03 +0000 🔗

Grats!

Comment by Djisse on 2013-10-17 08:50:15 +0000 🔗

Well, you see, in my eyes I don’t really care if a button is a flat or pseudo3d. I just need it at the right place. But that is a good thing to learn as much dev libraries as possible.

Comment by yegle on 2013-10-17 09:02:07 +0000 🔗

Just downloaded the 1.11.0 and installed on OSX, but I can’t find the QT version in it. Where can I find the QT version?

I don’t mind to build it myself.

Comment by james chandler on 2013-10-17 09:09:27 +0000 🔗

There’s a discusson on https://news.ycombinator.com/item?id=6565513 about Qt4 or Qt5 usage. Do you have any thoughts on this matter?

Comment by Max Treskin on 2013-10-17 09:12:00 +0000 🔗

Nice to hear this. I was dreaming about it for seven years. Thank you!

Comment by Gerald Combs on 2013-10-17 09:12:02 +0000 🔗

@yegle Did you install the 32- or 64-bit package? The Qt flavor ships with the 64-bit installer but not the 32-bit one. I’m hoping to move both to Qt at some point. If you want to build a 32-bit version from source you’ll have to recompile Qt as well.

Comment by Todd on 2013-10-17 09:25:30 +0000 🔗

I remember writing cross platform desktop applications… for a product we developed SimoHealth… it was first written in Gtk+ but we migrated to XULRunner. It make it incredibly easy to maintain our C++ backend code but have a JS/HTML/XUL frontend… Very similar to now writing web applications… JS/HTML is very good at cross platform user interface… I’m not sure how XULRunner has evolved since 2005 but it was pretty amazing to work with back then… I’d never consider writing native code for user interface again…

Comment by Miguel de Icaza on 2013-10-17 09:31:30 +0000 🔗

Gtk+ on OSX does not require X11, you can compile it to support Cocoa directly.

Xamarin Studio is built entirely in this way, and this is what it looks like:

http://tirania.org/s/138c98b8.png

You can see more screenshots and videos in action here:

http://xamarin.com/

If you are still interested, we can show you how to bundle your own Gtk+ with WireShark to have no external dependencies.

Comment by Markus Goetz on 2013-10-17 09:41:22 +0000 🔗

Yay. I’m so looking forward to not use the ugly unintegrated UI in OS X anymore 🙂
Thanks guys, wireshark is a nice tool.

Comment by Lilian on 2013-10-17 10:09:55 +0000 🔗

Great news guys.
Qt 5 is an amazing “technology”. Well, I guess the mobile version is not that far away after the desktop version is ported…

Comment by fasd on 2013-10-17 10:12:28 +0000 🔗

Yes!!

Comment by Dennis Roberts on 2013-10-17 10:34:17 +0000 🔗

Excellent news. I can’t wait to try out the QT versions.

Comment by Luc on 2013-10-17 10:41:42 +0000 🔗

people are starting to ask about Wireshark for their tablets.

Worked fine for me. Real hackers (in the catb.org/hacker-emblem sense of the word) just run Debian on Android phones 😉

Comment by numerodix on 2013-10-17 11:20:38 +0000 🔗

– We might be the largest standalone application to make this transition (feel free to correct me below).

Vlc also ported from gtk to qt a few years ago. i’m not sure how the ui codebases compare in size.

Comment by Ralph on 2013-10-17 11:34:45 +0000 🔗

As a user, this is a little disappointing. I find Qt apps even worse than GTK+ apps, because Qt tries to look the same as native apps, even though the behavior is still wrong. At least GTK+ looks different, which accurately reflects that it acts different. Current GTK+ Wireshark looks like “a foreign app trying to look like Motif, poorly”, while the new Qt Wireshark looks like “a foreign app trying to look like OS X, poorly”.

The poster child for “free cross platform app using a cross platform GUI toolkit” is perhaps Firefox, which is the most frustrating Mac app in the world, because it looks 99% correct and acts 95% correct for a Mac app. I can sometimes use it for minutes at a time between remembering that the native keyboard shortcuts are only about 75% working (like in this text box).

I’m not a Wireshark developer, so I can’t really criticize. It’s great that you’re supporting this software at all. I guess if it requires less effort “to produce a substandard application for users” by making this switch, then more power to you. There’s not really any free competition, so it’s not like you’re going to lose any users over this. So while I don’t like it, I realize I don’t have a leg to stand on to criticize anyone here.

I wonder how hard it’d be to add a native front-end.

Comment by Nick Arnold on 2013-10-17 12:59:49 +0000 🔗

This is great news for all OSX converts who’ve grown up on Ethereal (and then Wireshark) in a Win/*nix environment. When you gotta go deep in tubes Charles et. al. just dosen’t cut it.

Thank you!

Sincerely,
The Internet

Comment by Tynach on 2013-10-17 13:13:53 +0000 🔗

Hey, just wanted to say, that the large 3D Animation studio project Maya (not open source though) recently switched to Qt instead of… Well, whatever they used before. I’d say that’s a larger software package than Wireshark to switch to Qt.

Comment by Sebastian on 2013-10-17 17:23:18 +0000 🔗

Thank you! Looking forward to the iOS and Android versions 🙂

Comment by yegle on 2013-10-17 20:18:04 +0000 🔗

@Gerald Combs

I’m using the 64bit OSX version but can’t find the QT version anywhere.
P.S. I wish this blog uses disqus comment system so that I can get notification when there’s reply to me…

Comment by b4d on 2013-10-17 23:48:39 +0000 🔗

Looks nice, just add some retina support and we are set 🙂

Comment by filippo on 2013-10-18 01:25:43 +0000 🔗

Greetings,

that makes a lot of sense ! Qt, either under the ruling of TrollTech, or Nokia, or Digia is really an extremely lively project with outstanding support for a large variety of platforms. I remember that I made that big decision almost ten years ago for a large scientific software project with a large GUI module (massXpert) that I was authoring with Gtk+. I never looked back, *really*. The Qt libs for non-GUI stuff are extremely

Comment by Karl Napf on 2013-10-18 03:02:54 +0000 🔗

Welcome to the Qt Community! Great to see the best network analysis tool to finally use the best UI toolkit;-)

Comment by Peter Wairuru on 2013-10-18 03:26:16 +0000 🔗

“We might be the largest standalone application to make this transition”. In as much as these statement is true, i thing we also have Opensot (One of the best video editor for linux) that is transitioning currently in order to support more platforms.

Comment by tux. on 2013-10-18 11:36:43 +0000 🔗

If you’re using an iPad or a Galaxy Note we need to give you a long, hard, nonplussed stare

BAHAHAHAHAHAAHA! mmd 😀 thanks!

Comment by Andrew Ziem on 2013-10-18 14:40:35 +0000 🔗

As the developer of BleachBit (currently supporting Linux and Windows), I am also pondering switching from GTK+ to QT. I am already considering a GUI rewrite to improve functionality and to get off of GTK+ 2, and my main problems on Windows are the native look and bloated installer.

Comment by onox on 2013-10-18 18:48:08 +0000 🔗

Is qt designer still about micromanagement of positions (pixel precision) of UI elements? Or can it do like Glade (app for building GTK+ UI’s) do the right thing by giving elements a sensible padding and spacing, so that it’s very easy to reproduce a UI again (from you brain).

Comment by yama on 2013-10-20 14:19:29 +0000 🔗

@onox: Given that qt designer always was about layouts with padding and spacing and never about pixel positions it sounds a bit like you are asking the question wrongly.

Comment by SmokeX on 2013-10-21 04:12:27 +0000 🔗

Qt designer isn’t the tool of choice these days any way. People do graphical UI design through Qt Creator while the vast majority prefer to use the force and write their UIs entirely in code.

Comment by Robert Smol on 2013-10-21 14:12:17 +0000 🔗

So it seems Miguel actually provided some good insight about GTK on Mac, so this all might not be necessary. Still it would be interesting to hear actuall advanteages from QT over GTK2/GTK3 as you keep coding. I doubt there is real demand fot iPad/Android version, been working in with telco engineers and workstation is still a must today.

Comment by Gerald Combs on 2013-10-21 14:47:12 +0000 🔗

@Robert The big advantage of Qt is that Windows, OS X, and Linux are all tier 1 platforms, complete with SDKs, documentation, active support, and a large, active community. Miguel is doing some amazing work but his experience with GTK+ on OS X is the exact opposite of mine.

The reason I mentioned iOS and Android is that people keep asking for it. The demand is most definitely there.

Comment by Guy Harris on 2013-10-21 18:03:27 +0000 🔗

The biggest problem with Wireshark – or any other network analyzer – on iOS is that you cannot capture traffic on a non-jailbroken iOS machine; you need root access either to open BPF devices or to install a launchd LaunchDaemon to make the BPF devices available to users.

Comment by Sudhir Khanger on 2013-10-22 19:44:46 +0000 🔗

This transition was much warranted. Keep the good work up.

Comment by Frank Salcido on 2013-10-24 14:39:15 +0000 🔗

Great call!

Comment by David Demelier on 2013-10-25 01:15:08 +0000 🔗

Very very great news!

In any case Qt is so much superior to Gtk and so much more convenient to use :-).

No more

gtk_window_get_object_converted_from_my_very_large_number_of_parameters_passed_like_that(GTK_WINDOW(myobject), G_OBJECT(that_super_cast);

Comment by Manis on 2013-11-03 10:27:02 +0000 🔗

The most important question for me is:
Will you keep supporting PowerPC Macs?
And how will Qt affect the look on Ubuntu which is made for GTK+?

Comment by Guy Harris on 2013-11-07 13:13:20 +0000 🔗

Will you keep supporting PowerPC Macs?

1.10 already dropped support for them; if you have a PPC Mac, you’ll have to run 1.8, which will not switch to GTK+.

Comment by Nabeel Sowan on 2013-11-08 07:30:42 +0000 🔗

I like both GTK+ and Qt toolkits.
Qt has for many years been number one when it comes to platform integration on platforms other than X11. So I can understand the need for a change…

Comment by Wycliffe arasa on 2013-11-11 05:19:20 +0000 🔗

Congratulations! Can the new platfom support wireless networks?

Comment by Khoulaiz on 2013-11-16 02:34:25 +0000 🔗

@Gerald Combs
Sorry that I have to repeat the questions regarding the QT version of wireshark for OSX. but I simply can’t find it. Where is it?
I’ve downloaded the 1.11.1 64-bit dmg, installed it and after starting the wireshark app, it tells me that it cannot run it without X11 support. I currently have no XQuartz installed, because of the recent update to Maverick.
Do I miss the correct download or is it a bug in the current package?

Comment by Khoulaiz on 2013-11-16 02:48:20 +0000 🔗

@Gerald Combs
Actually it looks like that the 1.11.1 version doesn’t install wireshark at all. Looks like I am starting the old version. After a complete remove of wireshark and then reinstall I can’t find the wireshark app anywhere.

Comment by Gerald Combs on 2013-11-18 13:54:18 +0000 🔗

@Khoulaiz The OS X packaging issues should be fixed in 1.11.2.

Comment by Jeremy Impson on 2013-11-19 20:01:25 +0000 🔗

Are there any plans to re-work some of the expert mode & packet analysis functions to be less memory intensive, or to be able to use files rather than memory to store computational state? I thinking about functions like RTP stream analysis or using display filters to reduce then export the capture data. Somewhere I read that these deep analysis functions were intrinsically linked to the visualization code, and thus are susceptible to the same memory limitations that Wireshark has when rendering huge captures for display.

I realize ultimately this is a big data problem (and thus not high on Wireshark’s priority list) but I figured I’d ask. I’d love to be able to just run tshark on a huge file without having to chunk it up with editcap beforehand and reassemble it after, hoping I guessed well about what chunk size to use to avoid memory issues.

Regardless, thank you Gerald and the entire dev team for all the work that goes in to producing and maintaining my favorite tool of all time.

Comment by Kelly on 2013-12-02 14:03:55 +0000 🔗

Have capture filters changed in the dev release? Testing out the new Mac OSX build and cant see, to form a valid capture filter..

Comment by Kelly on 2013-12-02 14:33:11 +0000 🔗

Found the 1.11.3 dev build and it fixed my issue mentioned above.

Wireshark Tutorial Series #2. Tips and tricks used by insiders and veterans

Mon, 12 Aug 2013 15:27:51 +0000

Yes, I know it’s been a while since tip #1 video (https://blog.wireshark.org/2012/10/wireshark-tutorial-series/?utm_source=rss&utm_medium=rss&utm_campaign=wireshark-tutorial-series) and this one. Judging by the number of views and comments, it is helping. So keep me honest by reminding me to post more often!

In this short video (http://www.youtube.com/watch?v=aIiosBw2YH4), I discuss the dangers of using default values without fully understanding what the consequences are. In Sharkfest 2013, Christian Landström gave an excellent session on the reassembly feature of Wireshark. Unfortunately, it wasn’t recorded and I wanted to convey the message. The PDF of his excellent session can be found here: http://tinyurl.com/lko37zb

Enjoy!

Hansang Bae

Comments 🔗

Comment by juanmapalad on 2013-08-24 07:05:30 +0000 🔗

hi,

i have some issue on wireshark, you can view it from here:

https://learningnetwork.cisco.com/thread/60209?tstart=0

.. can i ask for a help? thanks

Comment by Gerald Combs on 2013-08-24 09:37:43 +0000 🔗

The best places to ask for help about Wireshark are the Q & A site and the wireshark-users mailing list.

Comment by Bolee on 2013-08-28 09:21:21 +0000 🔗

Not many take the trouble to take notes of a meeting to upload online for others so thank you firstly Hansang for doing so. I’m certain that many would find it beneficial and it would help save a lot of time. I wasn’t fortunate to attend that tutorial however we’re counting on your notes. Thanks again! =)

Comment by Hansang Bae on 2013-09-01 09:45:33 +0000 🔗

Bolee,
It’s my pleasure. Glad you find this helpful! 🙂

Comment by Otto on 2013-10-07 09:19:58 +0000 🔗

Hi Hansang,
Can’t believe I run into you again. I remember your name from way back in -97 when I was studying for my CNE 🙂
Anyway, I really like your tutorials, but being old with not-so-good eyesight anymore, is there any chance you can increase the size/resolution of the window? If I try to do that on my end, the text becomes illegible, and as is it is unreadable.
And of course, remember to make parts 3 and 4 and the rest.

Thank you for the effort, it is greatly appreciated.

Otto

Comment by Hansang Bae on 2013-10-08 08:43:34 +0000 🔗

Otto,
Man, a blast from the past from comp.sys.novell days!?! 🙂 I’m not sure if I can make it any bigger resolution wise, because I lose the ability to show all the columns. But shoot me an email, and I’ll see if I can post the raw camtasia files for you. If you don’t have camtasia, I may be able to convert to a bigger resolution. So shoot me an email and we’ll figure something out.

Thanks

Hansang

Fifteen Years

Mon, 15 Jul 2013 03:22:47 +0000

Fifteen years ago I released a little network protocol analyzer. At the time it wasn’t very special. It only dissected five protocols and only ran on Linux and Solaris. I decided to share it with the world and released it as open source. I made use of quite a bit of open source software at that point (and still do), and it seemed like a good way to give back to the community.

Immediately after the release an amazing thing happened — I started receiving code from people around the world. They had problems similar to mine and were able to modify the little analyzer to suit their needs. They were also kind enough to contribute those modifications back. Those contributions haven’t stopped to this day and Wireshark has grown into a mature, feature-rich, award-winning network analysis tool. People around the world use it to troubleshoot networks, develop software and protocols, and to learn about networking.

Wireshark has been a source of pride many times over the years but I’m particularly proud of two accomplishments. First, your network is not a black box. This is important inasmuch as our daily lives depend on networks operating efficiently, reliably and securely. Wireshark lets you peer into your network and see how it operates at a low level. It’s also accessible. Anyone can download and run it. Protocol analysis is a fascinating world and if you don’t understand what you’re looking it we have a large community of users and educators that can help you.

Second, it turns out that a protocol analyzer makes a great open source project and Wireshark is an example of open source at its best. People who know a lot about protocols are typically know how to write software. If you provide a platform that allows them to give meaning and context to the bits and bytes that make up network packets they will do so on a massive scale. Wireshark now supports over 1,000 protocols and 140,000 different protocol fields and those numbers keep growing.

We’ve had quite a few challenges in the past and we still do. These days all of your interesting traffic is either off in the cloud or speeding across your LAN at multiple gigabits a second. Wireshark doesn’t run on my tablet and it looks awful on my Macbook. However, these are solvable problems and I’m looking forward to the challenge of fixing them.

When I made that first release I had no idea how big it would become or how much it would impact my life. Wireshark is a great and wonderful thing due to the following people:

The development team, who seem to generate an endless stream of brilliance and cleverness.
The user community, for their knowledge and enthusiasm, and for putting up with the odd wart here and there.
Educators, researchers, developers, and everyone else who help people peer into their networks.
My employer for sponsoring the project and being such an awesome place to work, and my co-workers for their passion for network performance.
My family and friends, for their support and encouragement over the years.

It’s been a wonderful journey so far and I can’t wait to see what lies ahead. Thank you all.

Comments 🔗

Comment by dredgie on 2013-07-14 22:22:14 +0000 🔗

Happy bday, Wireshark! And thanks for everything you do for the community, Gerald

Comment by Jasper on 2013-07-16 02:04:28 +0000 🔗

Happy Birthday, Wireshark! Thanks, Gerald, and thanks to all the developers that push the cart with all their dedication and time!

Comment by Harry on 2013-07-20 02:10:05 +0000 🔗

Congratulations to the entire team …. ethereal to wireshark what a fabulous journey.

Troubleshooting the hidden dangers of TCP’s Nagle algorithm and delayed acknowledgement

Fri, 11 Jan 2013 23:58:10 +0000

As we all know, TCP/IP is a great protocol suite. However, there are times when it can become the bottleneck. This is especially true if you use TCP/IP for real time transactions where small data sizes are the norm (think financial institutions). In this session, I’ll show you why Nagle algorithm and delayed acknowledgement was developed. But more importantly, I’ll highlight the unintended consequences when the two features interact – badly – with each other. After watching this session, you will be able to spot the hidden dangers of using TCP/IP for real time transactions. Enjoy, and as always, I would really appreciate your feedback and suggestions. Here is the video:

http://www.youtube.com/watch?v=2CMueBcQNtk&feature=share&list=PL18B4C1339C54900A

And as always, any and all feedback and suggestion are welcome. Thank you and Enjoy!

Hansang Bae

Comments 🔗

Comment by credible58 on 2013-01-13 23:57:32 +0000 🔗

Great video, Hansang.

Comment by Hansang Bae on 2013-01-14 12:53:06 +0000 🔗

@credible58, thank you! If you have any ideas for future sessions, by all means, please let me know.

Comment by Jasper Bongertz on 2013-01-21 06:46:43 +0000 🔗

Nice presentation, Hansang, as usual. The only thing that I might have added to the slides would haven been an animation of what would be different without the push flags.

Comment by Hansang Bae on 2013-01-21 07:17:54 +0000 🔗

Ah, good point. I removed some popup hints, quizzes etc. because youtube doesn’t support it. That would have been a good one, especially since I talk about it on the PPT. BTW, I just spent an hour anonymizing an upcoming CIFS troubleshooting scenario. What a pain that was! 🙂

Comment by Andrew on 2013-01-23 12:52:27 +0000 🔗

Great presentation, you gave a very clear explanation of the rules on the message sequence chart that made understanding the actual packet trace easy. I also like that you made the packet trace available.

I’m left with one question though, why does packet #7 in the trace get to go immediately? This packet is only 226 bytes long so isn’t an MSS and there is unacknowledged data in flight (the bytes in #4, #5 and #6) so even though the Push bit is set in #7 my read of the Nagle rules on your slide #4 is that the only way #7 can be sent is if the Nagle override timeout expired? Yet the time between packet #7 and #6 is 16us which means the override timer cannot have expired. I’m presumably missing something though?

Comment by Hansang Bae on 2013-01-24 16:20:17 +0000 🔗

Andrew,
Give me a day or two. I’m on the road and will be back this weekend. I will reply when I’m back in the office. thanks

Comment by Hansang Bae on 2013-01-29 13:06:52 +0000 🔗

Andrew,
I’m glad you picked up on it. There are other small nuances in this trace that I didn’t get into . I didn’t delve into them just yet because this was more of an intro. 20/20 hindsight, I think it might have been better to tackle the bread and butter “nagle/delayed-ack” case first. But I’m very happy that you picked up on the fact that 10.10.10.10 probably has Nagle turned off. Another user Aaron also contacted me about packet #7! So I’m very happy that you guys are picking up on the small nuances of protocol analysis!

There are other oddities in the trace, and I may come back to it after a few more sessions.

Comment by Hai Wanxue on 2013-01-30 01:28:40 +0000 🔗

Great session.
I wrote something about TCP Nagle algorithm and Delayed ACK before in Chinese.
http://wenku.baidu.com/view/fbfda71aa300a6c30c229f99.html

Comment by Hansang Bae on 2013-01-30 08:00:45 +0000 🔗

Hai,
Thanks. Please feel free to download the presentation and pcap files and use it to your heart’s content! I see your presentation was much more thorough, was it for a class you were teaching? I can’t read it (if it was Korean, I could! 🙂 ) but I see enough TCP related acronyms to get the feel of it.

Thanks,

Hansang

Comment by Hai Wanxue on 2013-01-30 18:49:59 +0000 🔗

Hansang,
I am working at one company for technology consultant.
Writing it only as case because I often encountered them at work.
Thanks.

Comment by Anonymous Coward on 2013-02-05 17:33:39 +0000 🔗

These retransmissions are killing me!

Comment by Hansang Bae on 2013-02-05 21:23:25 +0000 🔗

That’s pretty funny, K! 🙂 Sorry folks, that’s a little insider joke!

Comment by jaspreet on 2013-02-19 23:18:53 +0000 🔗

Very very knowledgeable video. thanks for all the efforts taken to create this good stuff!

Comment by Hansang Bae on 2013-02-20 08:20:40 +0000 🔗

It’s my pleasure jaspreet! Glad you found it useful.

thnx

Hansang

Comment by krishnayeddula on 2013-03-06 19:34:11 +0000 🔗

Superb Video. It does nothing but enhances the Zeal to learn. That bus example was simple yet powerful.

Hansang,
People are thirsty here.Some more please.

Comment by Hansang Bae on 2013-03-09 18:33:37 +0000 🔗

@krishnayeddula, @Cyril, @Beulah, @Money..
Thank you. Another video will be coming out shortly. I’m glad that my passion for protocol analysis is coming through! 🙂

Wireshark Tutorial Series. Tips and tricks used by insiders and veterans

Wed, 17 Oct 2012 18:08:26 +0000

For those of you who have attended Sharkfest in the past, you already know that protocol analysis is near and dear to my heart. It’s also a field where experience and art still matter. As great as Wireshark is as a tool, it still takes coaxing by an analyst to ferret out root cause. And as networks and applications become more complex, keeping up will be challenging.

But the one thing that I noticed over the years is that people rush to install sniffers without really thinking about it. It’s almost as if people expect sniffers to magically spit out the root cause, served on a silver platter! In reality, it takes fair amount of protocol and application knowledge to truly bring a tool like Wireshark to bear.

I started posting to this blog so that I can help budding protocol analysts and perhaps show interesting tricks-of-the-trade to veteran users. To become good in this field, it takes a fair amount of practice. It takes practice to know how to capture the right data, where to capture the data, what filters to use, and how to interpret the data. So how do you go about getting started? First, you can watch the accompanying video/tutorial session (see below for the link.) Next, make sure you setup your Wireshark in a consistent manner – the video tutorial covers this.

Ever wonder how router jockeys like me can scroll through a “sho run” output so quickly? It’s because I’ve done it for so long that the eyes are trained to filter out unneeded information. That’s the key to training – knowing what to filter out so your brain can get to work on the important stuff. It turns out protocol analysis works the same way. You have to train your brain to filter out the noise. Setting up your Wireshark environment will go a long way to maximizing productivity.

There is no “right way” to setup Wireshark. There’s only “my way” and everyone else’s – by definition – is wrong! Some like destination address to be the first column just like in DOS Sniffer. Others prefer using Wireshark’s default order. Whatever your style is, make sure it’s consistent. And if you’re just starting out, perhaps you can benefit from my setup. Even Anthony Bourdain in his book “Kitchen Confidential” talks about “mise-en-place.” It’s a term used by chefs and signifies how the cooking stations are setup. It’s important because it makes them more productive. For the same reason, you need to develop your own Wireshark mise-en-place!

If you still have not modified the default layout of Wireshark, you’re definitely missing out. In the video, I’m going to help you setup Wireshark so that you can become more productive. And we’re going to embark on a journey where I show you all the secrets to protocol analysis. I’m like the “magicians’ tricks revealed” guy. I’m going to help make you a rock star – where protocol analysis is concerned – in your company. If you’re an industry veteran, don’t be alarmed. The first few sessions are geared towards beginners so they can catch up. After that, I promise you that we’ll be in the weeds!

Hope you enjoy it, and I’d love to hear your comments. You can reach me at hansang.bae@riverbed.com

Comments 🔗

Comment by Betty DuBois on 2012-10-18 09:24:29 +0000 🔗

Great video Hansang. I’m looking forward to the next installment. Did you know you can left click on the profile name in the status bar to toggle between all of your profiles? Just another way to achieve the goal as quick as possible.

Comment by Tony Fortunato on 2012-10-19 06:28:05 +0000 🔗

very nice. I look forward to more articles

Comment by wireshark on 2012-10-19 08:55:01 +0000 🔗

is there a way with wireshark to simulate / replay website visitor ?

i would like to simulate visitor behaviour and trafic !

thanks

sebastien

Comment by Hansang Bae on 2012-10-20 18:42:03 +0000 🔗

Thanks everyone!
Betty, yes, Gerald actually pointed that out and I was going to edit the video with a popup (but must have forgotten it! 🙂

sebastien,
Wireshark will not replay the data. You’ll need something like tcpreplay (and there are other tools, just google for ‘replay pcap’)

Comment by Chris Greer on 2012-10-21 16:43:33 +0000 🔗

Hansang,
Looking forward to reading and watching your work here.
Thanks for taking the time to get this great info together.

Comment by Travis Marlette on 2012-10-30 08:25:59 +0000 🔗

I look forward to learning more from you Hangseng! Now that my wireshark is setup properly, it should go much faster.

I look forward to your future posts!

Comment by Hansang Bae on 2012-10-31 10:29:02 +0000 🔗

Travis,
Thank you, another session will be posted (hopefully) by next (Nov 10th) weekend. Hurricane Sandy made things a bit difficult – to say the least.

Comment by Alex on 2012-11-13 12:44:53 +0000 🔗

Hey there…

I downloaded the Wirshark software and it works great for viewing packets and destinations running back and forth to my laptop….but I was wondering is there a way for me to see the traffic going to other laptops on my home router….I have 2 children and am concerned who they are chatting with etc…?

Thanks for your help.

Comment by Alex on 2012-11-13 13:31:33 +0000 🔗

Is there anyway to capture the traffic with all laptops (3)on a home router with Wireshark?

Thanks for your help.

Alex

Comment by Hansang Bae on 2012-11-18 21:36:28 +0000 🔗

Alex,
It depends on your home router. Please see

http://www.wireshark.org/faq.html

Q 7.1: When I use Wireshark to capture packets, why do I see only packets to and from my machine, or not see all the traffic I’m expecting to see from or to the machine I’m trying to monitor?

7.2 When I capture with Wireshark, why can’t I see any TCP packets other than packets to and from my machine, even though another analyzer on the network sees those packets?

Comment by Riu on 2012-11-24 08:43:26 +0000 🔗

Great video, but i was wondering how could i send packets to test server responses to them.
Thanks for your help!

Comment by Hansang Bae on 2012-11-26 06:57:06 +0000 🔗

Riu,
You can’t use Wireshark to (re)generate traffic. There are other tools for sending packets out, but for TCP, it can get a little tricky. If you’re interested check out tcpreplay or Google’s Ostinato tool.

Comment by http://business-ethernet.com on 2012-12-02 22:24:57 +0000 🔗

When you’re looking for an Internet connection for your company, you must know a few things about the telecom world, what the different circuits are, and most of all, what is guaranteed and what it is. The marketing hype is often very deceiving, so you need to understand dedicated lines such as business Ethernet, T1 and similar. Additionally you have to know where to look for the best pricing and how to make sure it truly is reliable at the best prices possible.

Comment by bernard on 2012-12-07 15:20:48 +0000 🔗

I must be among the dumber ones. I can’t find the link to the video. Where is it?

Comment by Hansang Bae on 2012-12-07 15:24:57 +0000 🔗

Bernard, it’s the hyperlink in the final paragraph.

“If you still have not modified the default layout of Wireshark, you’re definitely missing out. In the

**> video<** , I’m ….."

Comment by Kostas on 2012-12-15 00:03:21 +0000 🔗

Very helpful! Looking forward for the next one!

Comment by Hansang Bae on 2012-12-15 14:48:09 +0000 🔗

Thank you, I’m currently working on the next set (as I type this…actually). It requires some visual explanation so I’m working through my PPT issues at the moment. LOL. I can do packet analysis, but PPT can elude me at times!

Comment by decaptcha service on 2012-12-15 19:48:28 +0000 🔗

Everyone loves what you guys are usually up too. This type of
clever work and exposure! Keep up the fantastic works guys I’ve added you guys to my own blogroll.

Comment by captcha reader on 2012-12-15 19:54:17 +0000 🔗

Hey I know this is off topic but I was wondering if you
knew of any widgets I could add to my blog that automatically tweet my newest twitter updates.

I’ve been looking for a plug-in like this for quite some time and was hoping maybe you would have some experience with something like this. Please let me know if you run into anything. I truly enjoy reading your blog and I look forward to your new updates.

Comment by captcha decoder on 2012-12-15 19:55:57 +0000 🔗

When I initially commented I clicked the “Notify me when new comments are added” checkbox and now each time a comment is added I get four e-mails with
the same comment. Is there any way you can remove people from that service?
Thanks a lot!

Comment by recaptcha bypass on 2012-12-15 19:58:03 +0000 🔗

When I initially commented I clicked the “Notify me when new comments are added” checkbox and now each time a comment is added I get several emails with
the same comment. Is there any way you can remove people from that service?
Thanks a lot!

Sharkfest ’12 Recap

Fri, 29 Jun 2012 22:49:41 +0000

The fifth annual Sharkfest wrapped up a couple of days ago. You are no doubt feeling terrible if you missed it. Don’t despair, you can find a retrospective at the Sharkfest web site. The events team tried to make sure each session was recorded so we should have videos to go along with the slides soon.

As usual I wanted to attend more presentations than physics allowed but unfortunately missed some, so I’m waiting for the retrospective videos along with everyone else. (Hansang Bae observed that this is one of the few conferences where presenters attend other sessions.) Here are some quick notes about the sessions I was able to attend:

Monday’s keynote was delivered by Cliff Stoll. He kept insisting that he didn’t have much to say while simultaneously delivering an informative and entertaining talk.

Steve Riley provided a lot of insights into cloud computing: how it’s changing computing and how it can best be utilized.

Loris Degioanni (aka my boss) gave a great presentation on the new platform API that some people have been working on here at Riverbed. I think this is going to be a must-have once people realize the cool and crazy ways that this can be leveraged.

Wireless was well-represented Thomas D’Otreppe taked about OpenWIPS-ng, his new wireless IPS/IDS project. Metageek’s Ryan Woodings talked about wireless below the packet level. Mike Kershaw and Michael Ossman talked about the development of the Kisbee and Ubertooth adapters, and how you too can design and implement real hardware devices.

Hansang Bae showed modern TCP stacks and network devices can collude to make connectivity really slow, and at a really low level.

Laura Chappell showed off a lot of the new features in Wireshark 1.8. I even learned something — you can type a color name (e.g. “bisque3”) into the color picker in the preferences. She also released the second edition of Wireshark Network Analysis. It’s even heavier than the first edition, which I learned first-hand.

I led one session this year, Ask The Experts. We ended up talking about ways to improve Wireshark and a few of the core developers and I discussed these ideas the next day.

We got logs of great feedback on the conference as well. Several people commented that we didn’t have as many devlopment-oriented sessions this year as we have in the past. Maybe we can add more next time.

Wireshark is a great and wondrous thing due to its community. The developers, users, educators, sponsors all play a big role in its development and evolution. I see small reminders of this every day but it becomes abundantly clear each year at Sharkfest.

Thanks to the attendees, presenters, and to the Riverbed events team for creating a wonderful experience. I can’t wait to see what next year’s Sharkfest has in store.

Comments 🔗

Comment by Ian Brown on 2012-07-04 22:18:16 +0000 🔗

Thank you for the post. Unfortunately I was unable to attend so the videos are a must have to keep me on track… thanks again for the great work.

Best regards

Ian

Wireshark and Pcap-ng

Tue, 06 Mar 2012 18:47:56 +0000

When Wireshark 1.8.0 is released in the next few months it will introduce two major features: the ability to capture from multiple interfaces at once and the ability to annotate packets. These features have been on the wishlist for years and they will make Wireshark much more useful. They both share dependency on pcap-ng.

Packet comment example

Pcap-ng is Wireshark’s new default file format. It is more complex than its predecessor (pcap) but it’s also more flexible. Along with multiple interface types and annotations you can store host information, extended interface information, and much more. Wireshark has had basic support for pcap-ng for several years now and 1.8.0 will bring it to the forefront.

But there’s a catch. Suppose you sit down at a computer with Wireshark 1.7 or 1.8 installed. What file format will Wireshark use by default? Unfortunately the answer is “It depends.” If this is a fresh install of Wireshark on a new computer you’ll get pcap-ng files. If this is an upgrade from 1.6 or below you’ll get pcap files. If the preferences were changed or copied from another machine the default format will be affected as well.

There’s another catch. Suppose you’ve just saved a capture file and you want to read it using tcpdump, Cascade Pilot, Snort, or any of the dozens of other applications that use the classic pcap file format. What will happen? Again, it depends. If that application has been updated to support pcap-ng or if it’s using a recent version of libpcap it will probably work. Otherwise don’t hold your breath.

If you’re a Wireshark user you might want to try a recent build of Wireshark 1.7 to see the new features and new file format in action. If you’re a developer and your application reads pcap files you’re most likely in for some grief. For that I apologize. You should probably investigate adding pcap-ng support now before your users start complaining.

Despite the migration pains the switch to pcap-ng is long overdue and will make Wireshark more useful to more people.

Comments 🔗

Comment by Guy Harris on 2012-03-06 11:05:49 +0000 🔗

In “If that application has been updated to support pcap-ng or if it’s using a recent version of libpcap it will probably work.”, “a recent version of libpcap” means “libpcap 1.1.0 or later”. Libpcap 1.1.0 and later versions (the current version is 1.2.1) can read pcap-NG files that have packets only from one interface (the “any” device counts as one interface in this context) or packets from multiple interfaces if all interfaces have the same link-layer header type and snapshot length.

For applications such as tcpdump that use libpcap to read capture files, using libpcap 1.1.0 or later is sufficient – no changes to the application itself are needed. The application won’t see the additional information Gerald refers to, but it will see the packets.

Applications that have their own code to read pcap files aren’t so lucky. (That’s why, when people asked what pcap files look like, I always warned them not to write their own code to read them, but to use libpcap instead. Wrappers for libpcap exist for languages such as Perl, Python, etc.)

Unfortunately, there’s currently no version of WinPcap based on libpcap 1.1.0 or later, so even WinPcap-based applications are out of luck on Windows.

Comment by Mario Vilas on 2012-03-12 02:58:05 +0000 🔗

Will it be possible to migrate files from one format to the other? I understand some information may be lost in the process, even if it’s possible to extract packets coming from different interfaces into different .pcap output files.

Comment by Gerald Combs on 2012-03-12 11:19:58 +0000 🔗

@Mario You can translate trace files with only one encapsulation type between a variety for formats (not just pcap and pcap-ng) using Wireshark, TShark, editcap, and mergecap. It’s a bit more complicated when multiple encapsulation types are involved. For example the current development version of mergecap returns an error when I try to merge files containing Ethernet, PPP, and IEEE 802.11 packets when it should arguably Just Work. Hopefully we’ll have that fixed for 1.8.0.

Comment by Laura on 2012-03-13 15:16:05 +0000 🔗

HOORAH!

I can’t wait to see how people like the annotations! I’m going through hundreds of trace files adding notes regarding what’s good/bad in those files. This is a FABULOUS feature that I’ve been not-so-patiently waiting for! Congrats Gerald and all the faboo developers!

Comment by Manjari Shukla on 2012-04-03 22:51:51 +0000 🔗

I need just that. thanks. Keep the good job up.

Used Cars and Stub Installers

Tue, 06 Dec 2011 19:59:28 +0000

The Wireshark development team works hard to earn the respect of our users. This includes making sure that downloading and installing Wireshark is as easy and trouble-free as possible. Right now the vast majority of our users can go to www.wireshark.org, follow the big green arrows, and immediately download the appropriate Wireshark package for their platform.

For many years a number of third party sites have also offered Wireshark downloads. Typing “wireshark download” into your favorite search engine will turn up a bunch of them, usually just below links to wireshark.org. These sites are popular and often provide valuable services such as reviews and malware prescreening. They also reside outside the Wireshark ecosystem — we don’t link to them and aren’t affiliated with any of them.

"This is the Cadillac of invasive toolbars at a Chevy price!"

Sometimes these sites abuse their relationship with their users. For example a few months ago Download.com started using a stub installer which tries to get you to install various toolbars and who-knows-what-else before it installs the package you ultimately want, much like a sleazy car salesman trying to bundle add-ons you don’t want or need.

This sort of bottom-feeding behavior is harmful to our user community and exploits the goodwill we have with our users. Brian Krebs and Gordon “Fyodor” Lyon describe the problem with much more depth and eloquence than I can.

I sent a request to Download.com to disable their stub installer for Wireshark. They complied, but there are dozens of other download sites. Trying to keep tabs on all of them would result in a never-ending game of Whac-A-Mole®.

On behalf of the Wireshark development team I promise to provide easily accessible, direct downloads of Wireshark from wireshark.org just as we always have. If you choose to download Wireshark somewhere else we can’t guarantee that the experience will be free of shenanigans so please be careful.

Comments 🔗

Comment by Sean B on 2011-12-07 01:36:37 +0000 🔗

But they just wanted to ‘wrap’ all these nice programs in an extra little blanket for…warmth, and safe-keeping…and stuff. I mean who notices extra toolbars and new default search engines? Intrusive? Infuriating? Nonsense.

Sharkfest ’11 Recap

Tue, 21 Jun 2011 00:35:31 +0000

The fourth annual Sharkfest was held last week. If you missed it, don’t worry. We are busy uploading all of the presentations to sharkfest.wireshark.org.

The conference started with a keynote by Dr. Steve McCanne, CTO of Riverbed. He described the history of BPF and how its optimizing compiler works. It was interesting to see all of the problems he ran into and the solutions he found. The presentation was easy to follow despite its technical level. (Steve created BPF, and co-wrote tcpdump and libpcap.)

The keynote set the tone for the rest of the conference, which featured a lot of talented speakers. Jeff Carrell’s IPv6 was so popular it had be repeated several times over the course of the conference. Lara Chappell, Hansang Bae, and Betty Dubois drew their usual huge crowds. The other presenters did great jobs as well.

People have great ideas for improving Wireshark. Plenty of these ideas and suggestions were heaped our way throughout the conference, especially during the last two sessions. I hope to spend some time this summer implementing some of them.

Wireshark is very much a community-owned project. It is where it is today because of the developer and user communities. Steve stressed this fact during his keynote and it was readily apparent throughout the conference. On behalf of the developer team, the Sharkfest organizers, and Riverbed I extend my heartfelt thanks to the Wireshark community. This continues to be an amazing adventure and I can’t wait to see what the future has in store.

Comments 🔗

Comment by Free Webcam Chat on 2011-07-02 00:44:17 +0000 🔗

Great get it upload soon I would like to refer it…

Comment by Gerald Combs on 2011-07-02 08:48:00 +0000 🔗

@Free Webcam Chat The keynote and presentations are up at http://sharkfest.wireshark.org/sharkfest.11/ .

Comment by depannage mac on 2011-07-18 08:51:21 +0000 🔗

@ Gerald : just try to see video at http://www.lovemytool.com/blog/sharkfest/

but website not responding (FFv5 MAC OS 10.5)

is there aother way to watch it ?

Thanks Sebastien

We’re not Participating in World IPv6 Day. Mostly.

Tue, 07 Jun 2011 17:23:54 +0000

Tomorrow is World IPv6 Day, the largest full-frontal test of IPv6 to date. It is going to be a historic event. It’s also one in which wireshark.org will and won’t be participating.

In one sense every day is IPv6 day here and tomorrow will be just another day. Most of our web sites (anonsvn, ask, this blog, bugs, buildbot, sharkfest, and wiki) have been fully dual-stacked for some time. You can reach them over both IPv4 and IPv6 and so far it’s been working pretty well. The big exception to this is the main web site, which still only has an A record. We can add an AAAA record at any time, but I’ve been holding off doing so until well *after* World IPv6 Day.

My concern is that having an AAAA record in place for www.wireshark.org tomorrow will cause unnecessary problems. If anyone runs into trouble reaching dual-stacked sites I don’t want to impede their ability to troubleshoot the problem by making Wireshark difficult to download.

We’ll add the AAAA record for www.wireshark.org in a few weeks.

P.S. According to the SCM revision logs IPv6 support was introduced in Wireshark in 1998. Tomorrow’s test is long overdue.

Comments 🔗

Comment by reddy on 2011-06-12 08:30:16 +0000 🔗

make sense.

Comment by Smat Testing on 2011-06-14 00:17:12 +0000 🔗

IPv6 good

Comment by guilleme on 2011-06-14 18:58:11 +0000 🔗

All ipv6 is looong overdue.
It started being needed many, many years ago.

Comment by Byte on 2011-06-15 07:56:52 +0000 🔗

I’d suggest creating a separate domain http://www.wiresharkipv4.org with only an A record, and http://www.wiresharkipv6.org with only a AAAA record. Not only handy for testing, but also ensures the site can be reached.

Comment by Gerald Combs on 2011-06-15 11:50:58 +0000 🔗

@Byte we have ip4.wireshark.org (A) and ipv6.wireshark.org (AAAA). They are primarily used by the IPv4/IPv6 connectivity test in the upper right corner of the pages on the web site, but you’re free to use them to connect to the site using your browser. Will that work?

Comment by NickC on 2011-07-08 04:49:31 +0000 🔗

While websites can often respond to more than one name, there is always issues for HTTPS – with certificate name mismatches if the Hostname doesn’t match. As the SSL certificate exchange happens before there is any HTTP sent on the connection, the Host can’t offer multiple certificates, based on the Hostname that will appear only once the SSL connection has been established.
So the wireshark website doesn’t work well via alternative names.

Looking forward to Sharkfest ’11

Thu, 12 May 2011 21:57:20 +0000

I’ve been looking over the session schedule for Sharkfest ’11. Once again Janice and Sheri have created an event which guarantees a wealth of knowledge and insight for everyone attending.

What to expect 🔗

Sharkfest is small. This is on purpose. We limit the size of the conference in order to allow more one-on-one communication between the attendees and presenters.

It has a high knowledge density. Our strategy is to gather together a bunch of people who are excited about Wireshark and protocol analysis, and know what the heck they’re talking about. We do our best to make sure the presentations focus on usable information with a minimum of fluff.

How to get the most out of Sharkfest 🔗

Sharkfest is active, not passive. Mingle. Compare notes. Many of the attendees are Wireshark power users, but many are not. Everyone has something insightful to share. The worst thing you can do is keep to yourself.

For the past three years I’ve had the opportunity to witness the top people in protocol analysis exchanging and sharing ideas. I look forward to seeing the same thing this year. See you there.

Comments 🔗

Comment by madinah on 2011-06-01 08:51:43 +0000 🔗

please, you know how to use wireshark

and how to read ports from wireshark

Comment by madinah on 2011-06-01 08:58:05 +0000 🔗

please, you know how to use wireshark

and how to read ports from wireshark

send step using wireshark

Is there an RFC for hashtags?

Wed, 04 May 2011 23:28:09 +0000

On May 24, Steve McCanne, Loris Degioanni and I will answer questions sent to us on Twitter via #packetcap. We’ve given talks about the origins of tcpdump, BPF, WinPcap, and Wireshark live but this is the first time we’ll do so remotely and capped at a 140-byte MTU. It should be fun and informative and I hope you’ll join us.

Full details on the Riverbed blog.

Should Sunlight Be Streaming In Like That?

Sun, 03 Apr 2011 18:47:37 +0000

Two days ago my daughter and I were flying home from vacation when a hole tore open in our plane’s roof. The oxygen masks dropped down and we had to make an emergency landing and everything. Luckily the rest of the plane held together and we were able to land quickly.

The crew and passengers did an amazing job. The pilot and co-pilot immediately got us to a safe flying altitude and pointed us toward an airfield. One of the flight attendants briefly lost consciousness and struck his nose but was immediately back up and helping passengers despite his injury. The passengers remained calm and we were all checking on each other to make sure everyone was OK and that we all had our masks on.

Once we were on the ground U.S. Marine EMTs came aboard and provided medical assistance to anyone who needed it. While we waited for Southwest to pull a cold spare 737 from the shelf and send it our way a couple of the passengers kept my daughter entertained. I wondered if the exposed wiring was ARINC 429.

I would like to extend my thanks to everyone involved — the crew, passengers, and first responders for their swift action and calm demeanor throughout the entire experience. Everyone had a job to do and they did it well, supporting each other the whole time.

P.S. The reporters who called at 4:30 and 6:30 the next morning can my .

Comments 🔗

Comment by Chris Maynard on 2011-04-04 07:20:58 +0000 🔗

Wow Gerald, that had to be quite the experience. Glad everyone is OK and hopefully your daughter doesn’t have any long-term fears of planes and flying as a result.

Southwest is inspecting all their planes now as a result of this incident: http://www.swamedia.com/releases/f0e157e2-3c65-a6ca-163b-30004d98ede3. I sure hope they inspect those planes I’ll be flying to/from Sharkfest ’11 in June extra carefully! 😉

Comment by Joshua Gallagher on 2011-04-05 14:41:22 +0000 🔗

Awesome. You were potentially seconds away from a horrifying death and you’re sitting there wondering if you could slip in a tap to dissect the packets being sent from the cockpit. In all the world, only you would think of that!

Glad you made it home safe.

Comment by Laura Chappell on 2011-04-13 18:37:58 +0000 🔗

Jeepers, Gerald… could it be that someone on that plane was trying to *gasp* SELL a copy of Wireshark to another passenger…? Sniff free or die ya know…

So glad things weren’t worse in that situation! Perhaps we need to make a “swaskylight dissector”?

Comment by Stephen Fisher on 2011-04-19 14:48:26 +0000 🔗

You were on that flight? You’re famous! (not that you weren’t already) I wish I had a cold spare 737 on the shelf. Is there such a thing as a warm or hot spare 737?

Comment by Chris Maynard on 2011-04-26 07:18:52 +0000 🔗

An update: An article in today’s (4/26/2011) NY Times suggests that a rivet manufacturing flaw may be the cause: http://www.nytimes.com/2011/04/26/business/26air.html?_r=1&nl=todaysheadlines&emc=tha23

How To Read IPv6 Addresses

Tue, 08 Feb 2011 23:53:19 +0000

A common complaint about IPv6 is that addresses are “hard to read”. If you’ve been in the networking world any length of time IPv4’s dotted quad is most likely seared into your brain and clumps of hexadecimal digits of varying lengths can can be hard to wrap your head around. However, those clumps can provide useful information.

Below I’ll go over some of the address types I’ve seen and show you what information they provide.

NOTE: I’m not going to explain the basics of IPv6 address formats. Plenty of others have done that elsewhere. Wikipedia and RFC 4291 are good places to start.

Many of Wireshark’s web sites have been available over IPv6 for a while and as I’ve looked through various capture files and server logs patterns have emerged. Most of the addresses in this post are from IPv6 traffic captured in late January 2011. In Wireshark you can view IPv6 addresses via Statistics→Endpoint List→IPv6 or Statistics→Conversation List→IPv6 or by using the display filter “ipv6”.

First let’s look at the network prefixes that were captured. In my sample capture I see the following /16s (which we’ll call chunks for now):

2001::
2002::
2607::
2620::
2a01::
fe80::
ff02::

Most of the traffic in the capture starts with “2”. The prefix 2000::/3 has been assigned for global unicast traffic — that is, traffic you should see on the public internet. Right now you should only see prefixes between 2001::/16 and 2c00::/16 since IANA has only assigned prefixes in that range.

This alone is incredibly useful. A simple regular expression “[23]…:” (a “2” or “3” followed by three characters followed by a “:”) can be used to match public IPv6 traffic. I use this to find IPv6 addresses in Apache access logs.

Wireshark’s display filter engine doesn’t support prefix lengths for IPv6 addresses (not yet, at least) but you can use arithmetic comparisons to find public addresses, e.g. “ipv6.src >= 2000:: && ipv6.src < 4000::”.

Many prefixes in the assigned range are recognizable:

2002:: — 6to4 traffic. MTUs from these addresses will probably be lower than normal.
2001:470:: — Hurricane Electric. HE provides a popular tunnel broker service, so MTUs from these address will often be lower than normal.
2001:0:: — Teredo tunneling.
Organizations with large v6 deployments such as 2001:420 (Cisco) 2001:4860 (Google)

The prefixes outside the global unicast range (fe80:: and ff02::) are link-local and multicast addresses respectively. Both of these are limited to the local network and typically used for ICMPv6 neighbor discovery.

Now let’s skip over to the last half of the addresses and look at some of the recognizable bits in the host portion:

::5efe:xxyy:zzqq — ISATAP. Yet another tunneling technology. xx, yy, zz, and qq represent a tunnelled IPv4 address.
::xxyy:zzff:feqq:rrss — SLAAC. This is the machine’s MAC address (xx:yy:zz:qq:rr:ss) with “ff:fe” shoved in the middle.
::random digits — A SLAAC privacy extension address.

There are two things of note about these last two. Windows has SLAAC privacy extensions enabled by default, while other operating systems (particularly Linux and OS X) don’t. You can often tell machine’s OS by looking at the host portion its IPv6 address. Furthermore, one of the big complaints about IPv6 (big hairy addresses) is actually a feature.

Now take a look at the following addresses. Notice anything unusual?

2620:12::5
2001:4860:8004::68
2001:420:80:1::5

Compared to the formats above they’re short. The host portion is mostly zeroes. These are manually assigned. In this case they’re all web server addresses. I added them to demonstrate that the length of IPv6 addresses is often up to you.

Are there any patterns or address types I missed? Feel free to share them below.

Comments 🔗

Comment by Erik on 2011-02-09 10:22:43 +0000 🔗

Great post Gerald!

Interesting that you too have noticed the need for a better name for the Chazwazza/Chunk/Hextet in IPv6: http://www.netresec.com/?page=Blog&month=2011-02&post=Name-the-Chazwazza-in-IPv6

Comment by Alex on 2011-02-17 23:44:42 +0000 🔗

The explanations are clear, thank you. Indeed, they’re not that hard to read, when you think about it.

Comment by Cassondra on 2011-02-24 03:44:24 +0000 🔗

Just thought I’d let you know your FAQ page talks about the “man page” instead of the “main page”. While I’m sure a man page would be interesting, I’m also fairly sure it’s not what you meant. 😉
Q 1.10: What protocols are currently supported?

A: There are currently hundreds of supported protocols and media. Details can be found in the wireshark(1) man page.

Comment by Gerald Combs on 2011-02-24 08:40:10 +0000 🔗

@Cassondra In this case “man page” means just that. It’s an abbreviation for “manual page”: http://en.wikipedia.org/wiki/Man_page

Comment by Rob on 2011-03-01 13:04:03 +0000 🔗

Hi Gerald,

This is completely unrelated to your post, but I wrote a script that helps automate the Wireshark install for OS X 10.6. The script only requires that you mount the dmg. It will then prompt you for the admin password and user short name to modify the permissions necessary for Wireshark to function. I’d love to send it to you if I could.

Thanks.

Comment by Gerald Combs on 2011-03-01 13:44:27 +0000 🔗

@Rob Can you send the script to the wireshark-dev mailing list or attach it to a bug at bugs.wireshark.org?

Comment by Rob on 2011-03-01 21:02:18 +0000 🔗

Thanks Gerald. Just send the script to the dev mailing list.

Comment by Oyvind on 2011-03-07 02:48:37 +0000 🔗

Facebook has a quite amusing IPv& address:
http://www.v6.facebook.com. 3600 IN AAAA 2620:0:1cfe:face:b00c::3

(Hint: face:b00c)

Wireshark Has a New Home

Thu, 21 Oct 2010 20:33:08 +0000

By now you may have seen the press release and announcement about the purchase of CACE Technologies (my as-of-three-and-a-half-seconds-ago former employer) by Riverbed Technology (my new employer). In the announcement to the wireshark-users and wireshark-dev mailing lists I mentioned Riverbed’s commitment to the Wireshark community. I’d like to expand on that a bit.

Wireshark is more than a protocol analyzer. It is the foundation for relationships between several groups of people: the user community, the developer community, Wireshark University (driven by Laura Chappell), and CACE Technologies. Each one is an important part of Wireshark as a whole. We often referred to it as “the ecosystem” at CACE. It is an honor to be a part of it.

The important, wonderful, and rare thing about the ecosystem is that it benefits everyone involved. You can see this in action on Wireshark’s mailing lists, Laura’s seminars, and at SHARKFEST. It’s something that we worked hard to foster at CACE. What’s even better is that with Riverbed this commitment doesn’t change. Everyone I’ve talked to at Riverbed, from the CEO and CTO on down is committed to Wireshark and to its community. They realize we have a good thing going and they want to keep it that way.

On a personal level this has been an incredible journey so far. Every day I get to work with the amazing people on the Wireshark development team and at CACE. I also get to interact with the amazing people who make up the Wireshark community. For that I am grateful and I look forward to helping the ecosystem grow and evolve in the coming years.

Comments 🔗

Comment by Chrisliom on 2010-10-22 01:56:55 +0000 🔗

At the moment we will not see any change but slowli we will see a dramatic change. Riverbed is a company on the stock exchange and the only purpose of this guys is to make as much money as possible. In the bigining they are always nice but ….. I take a bet this will happen and we will see a commercial wireshark soon

Comment by Brian on 2010-10-22 05:36:22 +0000 🔗

I agree with Chrisliom. Riverbed’s purpose is to make money. Why is a WAN optimization company interested in Wireshark? Watch out for the commercial wireshark.

Comment by Frankie J. on 2010-10-22 07:11:27 +0000 🔗

why would they want to make a commercial shark? what good does it do to add yet another analyzer appliance in the market? if we are talking about integration, doesn’t riverbed already have these application & protocol awareness in their products? How much more can either scenario really add to the top line?

Comment by Gerald Combs on 2010-10-22 08:36:36 +0000 🔗

@Frankie is correct. Wireshark is the product of brilliant people in many different domains of expertise. Taking it commercial would a) require copyright reassignments from ~700 people and b) destroy the magic that makes it work.

CACE Technologies’ business model focused on building great products that complemented Wireshark and WinPcap. The model works, and works well. Those products happen to complement Riverbed’s. That’s why they bought us.

Comment by Karol on 2010-10-22 10:21:44 +0000 🔗

Riverbed’s CEO created tcpdump. He’s had his eyes on wireshark for a while now. Let’s see what happens.

Comment by Guy Harris on 2010-10-22 10:37:20 +0000 🔗

Note that Wireshark is GPLed, which makes it difficult to make a “commercial version” in the sense of a closed-source version.

(Slight correction to Karol – Steve McCanne, the co-creator of tcpdump with Van Jacobson, is the CTO, not the CEO.)

Comment by jeff on 2010-10-22 11:38:34 +0000 🔗

Last year Riverbed acquired Mazu Networks – re-branded as Cascade and has a done a great job in integrating it and providing resources to it. Cascade is doing really well and killing it in the market …. with the addition of Wireshark capabilities that product will rock. From flow to packet all in one …. sweetness.

Comment by clyde in ohio on 2010-10-22 13:20:58 +0000 🔗

i love wireshark. add this to Cascade asap and we are all set. i am a riverbed steelhead customer and had no idea what cascade was until they introduced me to it. i use it all the time for troubleshooting and security.

Comment by Chrisliom on 2010-10-25 02:36:48 +0000 🔗

@Gerald i think CACE was a good idea it was small good working company, now you are a small group in a very big organisation. In the past you know who is the owner you can talk to a person now you had to talk to inverstors and they dont take care about the cummunity the are interested only on return on investment, and they want 20 % profit at least. I saw many of this storys in the past years. I know riverbed is different 🙂 everone told me this in the beginning. This is a pond with sharks i hope wireshark will be survive.

Comment by Fernando Correia on 2010-10-30 04:26:09 +0000 🔗

That probably means more resources and exposure. Any acquisition brings challenges, but the opportunities look great. Good luck!

Comment by Huston on 2010-11-01 08:47:44 +0000 🔗

Last time I checked Riverbed does not do charity work, so for Gerald to say things are not going to change is simply trying to ignore the fact that he sold out. In the long term you’ll see the cost increase go up on Wireshark as well.

Comment by Gerald Combs on 2010-11-01 10:31:51 +0000 🔗

@Huston Riverbed does in fact do charity work: http://www.riverbed.com/us/company/reach_out/ However, that’s outside the scope of this discussion. Wireshark isn’t a charity and shouldn’t be characterized as such.

What are you paying for Wireshark now? Why do you expect that cost to increase? What if we have a sound business model that involves keeping Wireshark strong, open, and free-as-in-both-speech-and-beer?

Comment by Jesper on 2010-11-05 14:39:00 +0000 🔗

I’ve never visited wireshark’s website until now and frankly I’m quite surprised to see it. It struck me as very commercial and seeing terms like “business model” only increases that feeling.

As it’s only really a transition from one company to another I guess I shouldn’t say much. Already the old company seemed to offer a lot of solutions around Wireshark. I can’t help but think that this only weakens Wireshark itself as if these tools complement and in some ways address shortcomings of Wireshark itself, there will be little motive to ever improve the application in those areas for fear of eating away one’s own market.

Gerald:
A question, these companies seem intent on running Wireshark on windows and have gone to great lengths making it so (winpcap comes to mind) – is the emphasis on Windows or is the application still every bit as strong on Linux ?

Comment by Guy Harris on 2010-11-24 00:13:22 +0000 🔗

For all those who worry about a commercialized Wireshark, I have only one word:

fork

As I said over a month ago:

Note that Wireshark is GPLed, which makes it difficult to make a “commercial version” in the sense of a closed-source version.

And as for the “cost increase [going] up on Wireshark”, one could, with 100% certainty, predict all of the following:

the cost of Wireshark will go up 50%;

the cost of Wireshark will go up 100%;

the cost of Wireshark will go up 1000%;

the cost of Wireshark will remain the same;

the cost of Wireshark will go down 50%;

the cost of Wireshark will go down 100%;

the cost of Wireshark will go down 1000%;

as, given the *current* cost of Wireshark, all those statements say the same thing. 🙂

And, again, if somebody charges money for it – fork. Read the GPL.

Comment by Guy Harris on 2010-11-24 00:22:55 +0000 🔗

“I can’t help but think that this only weakens Wireshark itself as if these tools complement and in some ways address shortcomings of Wireshark itself, there will be little motive to ever improve the application in those areas for fear of eating away one’s own market.”

The majority of the members of the Wireshark core team do *not* work for Riverbed, and do *not* have any inherent incentive to avoid adding extensions to Wireshark that might take away the market for enhancements from Riverbed.

“A question, these companies seem intent on running Wireshark on windows and have gone to great lengths making it so (winpcap comes to mind) – is the emphasis on Windows or is the application still every bit as strong on Linux ?”

Wireshark is more “native” to Linux (or other UN*X+X11 platforms) than it is to Windows. Many of the developers work primarily on non-Windows platforms (including a platform where Wireshark looks more “non-native” than it does on Windows, the fact that the platform is a UNIX(R) nonwithstanding). Windows has a plethora of packet-capture applications; UN*X+X11, and that other UNIX platform, don’t have so many, so the Wireshark developers not working on Windows have more of an incentive to keep Wireshark working.

WinPcap exists because Windows, unlike most modern UN*Xes, lacks a packet capture mechanism atop which libpcap can run; many of those UN*Xes, including most Linux distributions (and, again, the aforementioned other UNIX platform), ship with libpcap. I’m not even sure WinPcap was developed for Wireshark – it was an academic project at the Politecnico di Torino, which happened to be a convenient tool for porting Wireshark *from* UN*X to Windows.

Comment by Greg Davis on 2010-12-05 07:21:43 +0000 🔗

So, what’s so wrong with making money. I hope that this culture you describe, which sounds amazing, can be maintained and still have a profit motive that is equal to your motives for a great work environment (ecosys) and that is conducive to a pleasant and rewarding experience that you folks seem to have had so far.

I am a new user and find the application quite neat on the front-end and I came to your site seeking further documentation on its use.

Here’s hoping that you have a great experience with your new owners and that there will be a sort of symbiosis (to remain consistent with your theme) whereby the ecosystem(s) turn the whole place into an even bigger, better (and even more profitable) paradise of prosperity, inner-peace and quality production !

(Like I said, the software really looks great in my initial trials, and I’m looking forward to digging in deeper).

Oh, and as to the motive for improving software – what better motive can one have than prosperity? The better the software gets, the bigger the profits and the more “well-off” is everyone, most especially your customers.

Remember now W. Edwards Deming and his rule (the only one I remember) “adopt the new paradigm”…in a constant state of chaos and change, it is the very best rule one can apply; (until, that is, someone can get some sense and join the rest of we mugwamps who believe in not changing a good thing when it is working).

Best Regards,

-Greg

PS – I’ve been a technical writer for some twenty years now and have spent a large portion of the time documenting software and data-collection systems.

Comment by Scott on 2010-12-20 10:09:25 +0000 🔗

There’s in interesting precedent in the open source market to monetize user communities. I suspect that Riverbed will be moving in this same direction in leveraging the Shark users.

Announcing ask.wireshark.org

Mon, 13 Sep 2010 05:00:00 +0000

There have been requests over the years for an online forum for Wireshark. I’m not too crazy about traditional forums, particularly for support. You often end up digging through a lot of not-so-useful content to get to the information you’re looking for.

(If you can see where this is going and are impatient, you can go straight to the new support Q&A site now. Otherwise read on.)

Last year Jeff Atwood and Joel Spolsky started Stack Exchange, a collection of question & answer sites including Stack Overflow, Server Fault, and Super User. SE fixes everything that’s wrong with traditional form software. Useful answers can be voted up by the community, and “hot” questions are listed first.

Stack Exchange is wonderful but they require you to host your content on their servers. This is goes against my control freak sensibilities, so I had to look elsewhere for a solution. I found OSQA. The software is still beta, but it’s quite functional and becoming quite popular.

Here are some of the things you can do with OSQA:

Vote questions and answers up and down 🔗

This means that the good stuff floats to the top. Additionally the person who posted the question can select one answer as the best.

Comment on questions and answers 🔗

This lets you have a traditional forum-style linear discussion when you need it.

Tag questions 🔗

Tags let you categorize questions. For instance the python tag on Stack Overflow will give you all of the Python programming questions.

Earn karma 🔗

As you ask questions and provide helpful answers you gain karma points. This lets you do things like…

Edit content 🔗

Power users can correct, clarify, or otherwise make helpful changes to things others have posted.

Q&A sites aren’t for everyone. They tend to work best when you have a bunch of helpful, active, and knowledgeable people willing to exchange ideas in a particular field. As luck would have it this describes the Wireshark community to a tee.

Go try it for yourself at http://ask.wireshark.org.

Comments 🔗

Comment by Srivats P. on 2010-09-18 07:04:07 +0000 🔗

Gerald,

How do you distinguish/differentiate the purpose behind the mailing list and ‘ask’ ?

Srivats

Comment by Gerald Combs on 2010-09-18 17:41:27 +0000 🔗

Their purposes certainly overlap. wireshark-users, wireshark-dev, and “ask” all let Wireshark’s user and developer communities interact and help each other.

The mailing lists get a lot of “drive-by” questions — someone asks a question, (hopefully) gets an answer, and is never heard from again. If the person asking the question subscribes to the list he ends up getting a lot of messages from other threads that may not have anything to do with his problem. If he doesn’t subscribe he may not see any responses to his question. A Q&A site is much more suited to this than a mailing list.

However Q&A sites aren’t discussion forums. Long discussions are much more suited to mailing lists (IMHO at least).

Last but not least, some users prefer mailing lists and other prefer the web.

Comment by Brian Bewick on 2010-09-19 14:11:02 +0000 🔗

Hi, How do I find someone if all I have their email address
and a phone number. Please advise, Brian.

Comment by Gerald Combs on 2010-09-22 08:28:20 +0000 🔗

@Brian That’s way outside our scope.

Comment by Bob on 2010-10-25 08:24:50 +0000 🔗

A couple of questions:
I want to monitor wireless traffic from an iphone going to my home linksys router. The only computer I have at home is my windows laptop, so I would be loading wireshark on that?

Antivirus Outbreak

Mon, 09 Aug 2010 18:00:49 +0000

Wednesday, August 4, 8:00 AM 🔗

We receive a phone call from someone complaining about “Wireshark Antivirus”. I take the call. The person on the other end isn’t able to provide many details other than that a program named “Wireshark Antivirus” is displaying some a shield and directing him to the cacetech.com web site.

This is new. We’ve been on the receiving end of a few false positives in the past but this is new. Some jackass is using our name do do harm.

This will not end well.

August 4, Morning 🔗

I start searching using Google and Bing, looking for other reports or any details. This is my job for the rest of the day.

So far our only exposure is through reports from other people. A forum post mentions “Wireshark Antivirus.exe”. I ask for screen shots so I can at least put an image online but don’t received any.

The calls continue, but are mercifully few. I add news items to www.wireshark.org and www.cacetech.com and send an email to wireshark-users and wireshark-dev.

This will not end well.

August 4, Afternoon 🔗

Two discussions pop up on Yahoo! Answers. This is a reputation-based Q&A site. Someone posts erroneous information but I can’t correct it. How do you get enough reputation to be helpful in an emergency?

At around 2:00 PM posts start showing up with recommendations for cleaning up the trojan.

Thursday, August 5 🔗

We get our first angry letter! Threats and foul language and everything!

More calls come in. Most AV software has been updated to catch the code if it hadn’t already done so.

This will not end well.

Friday, August 6 🔗

The reports and calls taper off.

By this time several blog entries and news articles have covered the malware. I add them to the news items on the Wireshark and CACE web sites.

This will not end well.

Saturday, August 7 🔗

More cussing and threats via email. Someone managed to find our contact information on the CACE web site, but completely missed the “Wireshark Antivirus” Malware news banner at the top of the home page.

This will not end well.

Monday, August 9 🔗

The crap-storm continues. We’re trying to help as best we can.

Tuesday, August 10 🔗

Yahoo! Answers deleted one of my comments because it was flagged as spam. Thanks Yahoo! You guys are swell!

Lessons: 🔗

Communicate. Luckily its victims were visiting www.cacetech.com, so we could pass along updates in near real time. Google and Bing helped track down users posting questions to online forums. I responded to each question with any information I had at the time.

People don’t run AV software. Seriously — you should at least be running something like MS Security Essentials by now.

Even cake is dangerous. One of the infections apparently happened while looking for pictures of cake on Flickr.

Comments 🔗

Comment by James Wylie on 2010-08-09 13:58:08 +0000 🔗

Gents,

I’ve had two customers in the past few weeks with virus infections from an app called Wireshark Antivirus. This was strange becuase I used your app a few years back. Took me a minute to realize that it was you guys and that some bonehead was using your name to exploit with bad character your company.

How can I help –

Mr Wylie

Comment by Gerald Combs on 2010-08-09 18:11:19 +0000 🔗

@James It sounds like you’re helping already.

Comment by mary chang on 2010-08-09 20:35:21 +0000 🔗

hello,
something calling itself WIRESHARK ANTIVIRUS installed itself on my computer & seems to insist on a subscription of some sort. I wonder if your program can uninstall it? I have notified CONSUMER FRAUD REPORTING.ORG. Many thanks for any help!
MARY CHANG.

Comment by Lee Anne Farnham on 2010-08-09 21:19:22 +0000 🔗

How do I get rid of this sharkware virus? It tagged on to my computer this morning when I was taking a look at wedding anouncement web sites.

I will also send an email to consumer fraud reporting.org.

Comment by Gerald Combs on 2010-08-09 21:31:07 +0000 🔗

Mary & Lee Anne,

There are a links with removal instructions at http://www.wireshark.org/news/20100804.html . Googling for “wireshark antivirus” (WITH quotes) turns up a lot more information about removing the trojan. I don’t have any way of testing them here and so can’t recommend any particular one.

Comment by belensaurus on 2010-08-12 22:48:11 +0000 🔗

i got the wireshark thingy and i managed to get rid of it,
download thee Malwarebytes’ Anti-Malware program and it will actually get rid of it
the wireshark program thingy wont let the program pop out but all you have to do it press the alt+ctrl+delete keys together and youll get the windows task manager pc lick on the wireshark and end the task then once the malwarebites program pops out do a quick scan and once the scan is finished remove the threats and your done your computer will restart and your computer will be ok go on malwarebites again and delete the threats and your done

Comment by Matt on 2010-08-13 10:50:08 +0000 🔗

The MalwareBytes solution seems to have eliminated the bug itself. However, further investigation has revealed that my browser is hijacked. I do not know if this was part of the Wireshark Antivirus bug or some prior threat I missed, but Googling “Malwarebytes” and following any of the links redirects me to off-the-wall websites that I’m sure are attempting to add more malicious garbage to my machine. I highly promote MalwareBytes, but be very careful attempting to download it. You may want to DL it from the comfort of another (uninfected) machine, and copy the installer to your infected machine. Also, you may need other solutions besides MBAM if your browser has been hijacked as mine has.

Comment by margy on 2010-08-13 11:37:00 +0000 🔗

how to do you know if your browser’s been hijacked? I have this Wireshark AV thing and can’t open apps to download anything to get rid of it. Had just downloaded MalwareBytes the night before…then got this. Can’t open MB to even scan

Comment by Gerald Combs on 2010-08-13 12:15:07 +0000 🔗

@margy According to a Malwarebytes forum post you can rename mbam.exe to something else:

http://forums.malwarebytes.org/index.php?s=bf5375540445801cd46624397aa2918a&showtopic=59850&pid=297318&st=0&#entry297318

Comment by brian on 2010-08-13 17:36:36 +0000 🔗

For those of you having issues running malwarebytes or other removal tool, your best bet is to boot in Safe Mode prior to executing anything. To enter safe mode, simply pres F8 while your computer is in BIOS prior to windows start up.

Comment by mary chang on 2010-08-13 19:15:13 +0000 🔗

Success to report! Our computer guru has solved all my problems, cleaned the whole system, besides identifying & removing that fake program. I intend to forward the fake’s name to Fraud Prevention authorities. If anybody wants to know, I can share my guru’s name — he has a huge reputation in our counties.

Comment by Curt on 2010-08-19 23:24:47 +0000 🔗

Is there a chance to monitor ports on unmanaged switches and the NIC´s of the machines attached to these ports?
I am experiencing ports to be hung up by machines in a way that they are not reachable anymore. The switch seems to be physically well but traffic to these ports is impossible.

Comment by James Eighmey on 2010-08-21 10:16:47 +0000 🔗

If you are a newbie to system security. You can run clamav portable or stinger to remove wireshark anti-virus. here are the links to both. McAfee Stinger – http://vil.nai.com/vil/stinger/ ClamAV Portable – http://portableapps.com/apps/utilities/clamwin_portable Your best bet is to run these from a flashdrive or memory card, and download them from a clean system.

Comment by Jamie on 2010-08-23 16:20:38 +0000 🔗

Wow… There’s some really stupid people floating around. “Wireshark” is an awesome packet-sniffing program. “Wireshark Antivirus” is a virus, and is not related to Wireshark in any way. Get a brain, people.

I would smack you people so hard, if I could. Give Gerald a break from your stupidity…

Comment by Joe Sammarco on 2010-08-24 13:13:10 +0000 🔗

This piece of malware is almost indistinguishable from the “SuperAntivirus 09” bug of recent fame. These idiots probably pulled the name “Wireshark” out of the blue because it sounded cool to them. The bug is easily eradicated by running the free application “Malwarebytes anti malware scanner” in windows safe mode. Just download the free software and make sure it updates before you scan with it. If you are not computer literate enough to do this for yourself, there are plenty of guys like me around willing to charge for this work.

Comment by Chris Maynard on 2010-08-29 07:36:45 +0000 🔗

Wow, how sad is it that the first site listed after a google or yahoo! search for wireshark is “Wireshark Removal”.

Comment by Michael McNamara on 2010-08-30 20:37:38 +0000 🔗

I’ve been on the receiving end of a few similar situations. Unfortunately you’ve got to bite your tongue and soldier along. You did a great job of communicating the issue once you learned of it. It’s a shame that users continue to be the mindless people that we know them to be.

Cheers!

Comment by Jason Cruse on 2010-08-31 07:58:50 +0000 🔗

Well I do computer work and let me tell you this and other fakeAlert programs and rogue spyware is crazy here in ohio. some let it go as far as were the system is so far bogged down that I end up having to do a renistall. Usually you can get rid of everthing but the redirector. Its my job…but still a pain.

Comment by M. O’Connor on 2010-09-16 13:16:58 +0000 🔗

Don’t want to sound flippant but…

Whoever created the wireshark AV app has created a new definition of “Wireshark” 🙂

Sharkfest ’10 Recap

Thu, 24 Jun 2010 21:37:04 +0000

Sharkfest ’10 ended a week ago today and I’m still reeling. The conference started with a keynote from Van Jacobson and ended with one from Harry Saal, two monumental figures in our industry and very nice people to boot. Attendees traveled from all over the globe, from large companies to single-person operations. The presentations were packed with information and it was great to see how experts tackle packet-level network monitoring and troubleshooting. If you missed out we’re getting the presentations online as fast as we can.

Van Jacobson talking about sequence numbers

Harry Saal (left) talks with an attendee

I love Sharkfest. I get to interact with Wireshark developers and users daily but this is one of the few opportunities to meet them face to face. On behalf of CACE, thanks to everyone who attended. It’s great to see so many people enthusiastic about packet capture and about Wireshark!

T-Mobile: Clever or Insane?

Sun, 11 Apr 2010 00:36:35 +0000

I recently got an Android phone. After downloading the Android SDK I noticed that my cellular provider (T-Mobile) was doing something odd. According to the netcfg command they’re using 25.0.0.0/8 on their GPRS/EDGE network:

$ netcfg
lo       UP    127.0.0.1       255.0.0.0       0x00000049
dummy0   DOWN  0.0.0.0         0.0.0.0         0x00000082
rmnet0   UP    25.130.205.212  255.255.255.252 0x00001043
rmnet1   DOWN  0.0.0.0         0.0.0.0         0x00001002
rmnet2   DOWN  0.0.0.0         0.0.0.0         0x00001002
sit0     DOWN  0.0.0.0         0.0.0.0         0x00000080
ip6tnl0  DOWN  0.0.0.0         0.0.0.0         0x00000080

T-Mobile doesn’t own that netblock. The UK Ministry of Defence does. Why would they do such a thing? After all, RFC 1918 gives you three whole blocks (10.0.0.0/8, 172.16.0.0/12, and 192.168.0.0/16) to do with as you please. Straying from those on your private will damn you to an eternity of network flakiness and give your twisted pair cabling scurvy, right?

Why this is clever 🔗

According to several BGP looking glasses and figure 5 of Geoff Huston’s IPv4 Address Report the Ministry of Defence doesn’t advertise any routes for 25.0.0.0/8. That means that none of the 25.x.x.x addresses are being used on the public Internet. If you’re on a private network they’re effectively free for the taking. But still, why aren’t they using the officially-sanctioned RFC 1918 address?

My phone also has an 802.11 interface. Let’s take a look at netcfg’s output when I’m connected to T-Mobile’s network and my home network:

$ netcfg     
lo       UP    127.0.0.1       255.0.0.0       0x00000049
dummy0   DOWN  0.0.0.0         0.0.0.0         0x00000082
rmnet0   DOWN  25.130.205.212  255.255.255.252 0x00001002
rmnet1   DOWN  0.0.0.0         0.0.0.0         0x00001002
rmnet2   DOWN  0.0.0.0         0.0.0.0         0x00001002
sit0     DOWN  0.0.0.0         0.0.0.0         0x00000080
ip6tnl0  DOWN  0.0.0.0         0.0.0.0         0x00000080
eth0     UP    192.168.25.4    255.255.255.0   0x00001043

See the 192.168.25.4? That could just as easily be 10.0.0.4, 172.18.34.4, or any other RFC 1918 address. On many networks (particularly universities) it could even be a public address. T-Mobile has no way of predicting or controlling what happens on that interface. The 25.0.0.0/8 netblock has the following advantages:

It doesn’t overlap with any other network, public or private. Therefore you won’t get any routing confusion when the phone is connected on GPRS/EDGE and WiFi at the same time.
It’s not in public use. The next Facebook or Lolcats isn’t going to show up with a 25.x.x.x address, thereby causing routing confusion for your users.
Even if the UK MoD is handing out 25.x.x.x address over 802.11 they’re way over in the UK. It’s unlikely that my phone will be connected to the MoD and T-Mobile networks at the same time.

Why this is insane 🔗

IPv4 addresses are getting scarce. Who says the MoD won’t turn the 25.0.0.0/8 netblock over to RIPE or IANA next week? Even then my phone has to go through a proxy server on T-Mobile’s network so it’s probably not a huge deal.

Update 🔗

Just before publishing this I ran netcfg and my phone was using 14.64.186.160. The 14.0.0.0/8 netblock used to be reserved for public data networks but was allocated to APNIC earlier this month. I wonder what other questionable netblocks they’re using.

Comments 🔗

Comment by Stephen Fisher on 2010-04-11 02:15:40 +0000 🔗

Maybe they should start using that strange “new” thing called IPv6 🙂

Comment by Gerald Combs on 2010-04-12 09:19:00 +0000 🔗

You’re absolutely right. This would be a non-issue with IPv6. To be fair, I’m not sure what else T-Mobile can do in this situation. They probably have a lot of customer handsets that are v4-only. Luckily none of the mail or SSH servers I use have 25/8 or 14/8 addresses.

Comment by Julio De Leon on 2010-04-12 12:52:24 +0000 🔗

Let’s see if I understood well, if I were to point to your address 25.130.205.212/8 from my computer, it will route me to your phone? Instead of correctly route me to anywhere in the UK MoD network?

Comment by Gerald Combs on 2010-04-13 09:54:27 +0000 🔗

@Julio The 25/8 block isn’t publicly routed at all, so you should see a timeout or network unreachable error if you try to connect to 25.130.205.212. T-Mobile’s GPRS/EDGE uses a proxy server for HTTP connections and NAT for everything else so the 25/8 and 14/8 addresses are invisible to the outside world. The problem is when I’m connected via GPRS/EDGE and need to connect to a 25/8 or 14/8 address *outside* of T-Mobile’s network. Right now this isn’t a problem. As the IPv4 address space nears exhaustion it could easily become one.

Comment by Old T-Mo Employee on 2010-05-13 10:15:57 +0000 🔗

Actually, T-Mobile has many “illegal” IP ranges, depending on what network you connect through. In fact, there is a management network which also uses stolen public space. It is a risk, but was done because of the scarcity of RFC1918 space. Believe it or not, there just are not addresses in that range to handle all the network devices and phones.

Comment by Rollo on 2010-05-15 08:25:15 +0000 🔗

Here in Germany t-mobile uses IP-Adresses like 1.2.3.4 for example, APNIC-adress-space. Should work fine, they are not only “way over”, but “down under” 😉

Comment by brn0vrflw on 2010-05-18 10:13:48 +0000 🔗

Why extrapolate ? Just contact them !

Comment by olivia on 2010-05-25 13:38:50 +0000 🔗

i found exactly the same issue with our business “orange” mobiles however T-mobile and orange have now merged. Surely Its obvious UK.gov are turning a blind eye to the misuse of what essentially is a public network.

Comment by Will on 2010-05-25 14:44:10 +0000 🔗

@olivia: It’s not a misuse of a public network… in a worst-case scenario, let’s say you work for the UK Government and need to connect to 25.1.1.1 from your T-Mobile phone– you’ll likely be unable to, as T-Mobile is using that address for their INTERNAL network. However, if you connect from anything else besides your T-Mobile phone, it’ll work fine.

So this isn’t a misuse, it’s just risky since T-Mobile customers could potentially be angry that they can’t reach a certain website.

Currently, however, it’s a smart move on T-Mobile’s part because they can avoid even worse problems if you connected your phone to a wifi network that happened to use the same internal IP range as T-Mobile.

IPv6 will solve all of this, and it should solve it soon as most new devices are IPv6 enabled and strategies for routing between IPv6 and IPv4 networks are already well-known.

Comment by Jodrik on 2010-05-30 23:46:17 +0000 🔗

Versatel also has a hand in this using 1.0.0.0/8 for their GPRS in the Netherlands for instance. I personally think it’s -extremely- annoying that major companies like ISPs just go out and set “bad examples” with work-arounds like this. Yes IPv4 is limited, but how long has IPv6 been in the making? Shouldn’t ISPs be the one pushing phones manufacturers to implement IPv6 instead of just waiting for it to happen and basically abusing privately owned networks.

In my opinion if they should have seen this limitation comming way back when GPRS etc started catching on and should have just implemented IPv6 on it by default.

Comment by Michael Patterson on 2010-06-06 18:20:42 +0000 🔗

Hello Gerald,

We are testing IPFIX in our next release due out later this month. We are finally receiving the data from procflow correctly. What are your intentions with this tool? We noticed it hasn’t been updated for about a year.

See you at sharkfest.

Mike [at] plixer.com

Sharkfest ’10 Is Going To Be Awesome

Fri, 12 Mar 2010 23:24:40 +0000

We just finalized the schedule for Sharkfest ’10. This year’s agenda includes:

Van Jacobson and Harry Saal, who formed protocol analysis with their bare hands
Two three wireless security experts including Mike Kershaw and Thomas D’Otreppe, the creators of Kismet and Aircrack-ng
Network security experts including nmap creator Gordon “Fyodor” Lyon
Five six many amazing protocol analysis instructors, including Laura Chappell, Betty DuBois, Sean Walberg, and Joe Bardwell
Several members of Wireshark’s development team
Protocol, network, and application performance experts from Citi, Google, and Intel
Lots of other great presenters. See for yourself.

The attendees are amazing and knowledgeable as well.

Tell your boss I said you should go.

Laura Wrote A Book

Wed, 10 Mar 2010 19:04:15 +0000

Laura Chappell wrote a book about Wireshark: Wireshark Network Analysis (The Official Wireshark Certified Network Analyst Study Guide). In typical Laura fashion, it is amazingly comprehensive, covering everything you need to know to use Wireshark effectively. My review copy is massive. It broke the plastic binder:

Could crush small woodland creatures

The publication copies are still massive but much better looking:

What your copy might look like

The book is great. It covers all of the features in the upcoming 1.4 release and includes a ton of fascinating case studies. Best of all, if you buy it before March 29 you can get 35% off at Wireshark University and Chappell University by using the coupon code 998nws35.

Comments 🔗

Comment by Philip Smith on 2010-03-15 06:15:30 +0000 🔗

I’m interested in Laura’s book, Wireshark Network Analysis The Official Wireshark Certified Network Analyst Study Guide”. How much does it cost and where can I get it from?

Thanks,
Philip Smith

Comment by Gerald Combs on 2010-03-15 14:06:18 +0000 🔗

The book’s purchase page is at http://www.wiresharkbook.com/purchase.html . The Wireshark University and Chappell University links should let you use the coupon code above (998nws35) for a 35% discount as well as a signed copy.

Comment by Roger on 2010-03-22 16:40:59 +0000 🔗

Hm… It look like coupon code did not work on Amazon.com

Comment by Michael Lane on 2010-03-23 17:02:09 +0000 🔗

I tried Amazon as well with no luck. I’d love the 35% without the $10 shipping but if it’s a signed copy, hmmm…

Comment by Gerald Combs on 2010-03-25 13:33:54 +0000 🔗

Roger & Michael – The coupon only applies to orders placed at Wireshark University and Chappell University. I’ve updated the post accordingly.

Comment by John C on 2010-03-31 10:50:36 +0000 🔗

I thought the discount ended on 3/31/10, not 3/29/10 – when will the 35% discount
be offered again?

Comment by Gerald Combs on 2010-03-31 15:40:11 +0000 🔗

The original code expired on the 29th. Laura issued a new code (998exp35) that expires today (the 31st). I’m not sure if or when there will be another discount.

Comment by Chameh A on 2010-04-01 13:59:30 +0000 🔗

I missed out on the discount by a day 🙁 Anyone know of an April Fool’s Day discount?!

Looked at sample pages and seems like a great read but will have to brew over paying full retail for it a little bit 😉

Comment by Michelle on 2010-04-20 10:39:47 +0000 🔗

I thought the discount ended on 3/31/10, not 3/29/10 – when will the 35% discount
be offered again?

Comment by Dan on 2010-04-20 11:26:09 +0000 🔗

Amazon has the book right now for $62.97

Comment by Chameh A on 2010-04-27 15:48:48 +0000 🔗

Thanks Dan! Just ordered me a copy and freeeeee shipping is extra nice 🙂

The History of Wireshark in 3 minutes

Tue, 09 Feb 2010 22:11:47 +0000

Few days ago, I learned about a cool visualization program called Codeswarm which, surprisingly, is made by a guy that lives in Davis California like me. Codeswarm can be fed with the logs from a source code repository and produces an animated history of that source code. Soon enough, my weekend project became the creation a video that would condense the 11+ years of the Wiresahrk source code in 3 minutes. The result can be seen here: http://www.vimeo.com/9329501.

Comments 🔗

Comment by Stephen Fisher on 2010-02-09 17:02:04 +0000 🔗

That has to be the most awesome geek thing I’ve seen lately ;).

Comment by Mike on 2010-02-10 04:34:28 +0000 🔗

WOW! very nice

Comment by Chris Maynard on 2010-02-14 20:08:37 +0000 🔗

Very impressive! So impressive that I had to go create one of my own. Thanks for the inspiration.

Comment by Elliott Aldrich on 2010-02-15 10:14:11 +0000 🔗

That is fantastic!
Loris – Is the music created and synced by Codeswarm or did you add that yourself later? There are some moments where the music really enhances the visuals well.

Comment by Loris Degioanni on 2010-02-15 10:35:58 +0000 🔗

Codeswarm creates the animation only. I post-produced the result to add the text and the music; took a couple of attempts to synchronize everything.

A curiosity: the music I picked (http://en.wikipedia.org/wiki/Lou_Dalfin) is a traditional piece from the region in Italy where I grew up, and the instrument you are hearing is a hurdy gurdy (http://en.wikipedia.org/wiki/Hurdy-gurdy).

Comment by Brock on 2010-02-27 12:53:32 +0000 🔗

Very cool – first instance of Codeswarm I’ve seen (or heard of, for that matter)… good choice of music and great job editing… just the right pace, good synch 🙂

Comment by Chris on 2010-03-10 11:11:42 +0000 🔗

Loris, would you tell us the title of the piece from Lou Dalfin?

Comment by Christian on 2010-03-11 01:18:11 +0000 🔗

The music sounds a bit like the fast part in Deep Purples “child in time”.

Comment by AKE on 2010-03-17 10:29:39 +0000 🔗

Very nicely done — this really hits the spot aesthetically and presumably emotionally for the Wireshark team!

Comment by Luke on 2010-03-25 01:11:16 +0000 🔗

You see it coming together nicely!

Comment by Jay on 2010-04-07 05:08:35 +0000 🔗

That was amazing it sounds like Dropkick Murphy’s to watch Irish Gangster movies by…

Running Wireshark as You

Thu, 04 Feb 2010 20:11:57 +0000

Running Wireshark on Linux involves an interesting challenge¹: Capturing packets requires root access, but Wireshark is big program and we strongly recommend against running it with elevated privileges. On Linux it’s common to see Wireshark running as root, but this is nearly unheard for similarly-sized applications like Firefox and GIMP. How can we avoid running Wireshark as root?

UPDATE 2010-02-10: Made changes suggested by Jaap and Balint.

A good way 🔗

Notice how I said “capturing packets requires root” above? Here’s a secret — Wireshark doesn’t capture packets. A separate program called dumpcap does. Compared to Wireshark, dumpcap is tiny. It’s much less complex and much safer to run as root. We can make it so that dumpcap runs as root and that only users in a particular group can run it:

$ sudo -s
# groupadd -g wireshark
# usermod -a -G wireshark gerald
# chgrp wireshark /usr/bin/dumpcap
# chmod 4750 /usr/bin/dumpcap

A better way 🔗

It’s also possible to let dumpcap do its job without involving root access at all. For a very long time Linux has allowed the use of fine-grained permissions called capabilities. In many recent distributions you can use the setcap utility to add capabilities to individual files.

Dumpcap needs CAP_NET_RAW and CAP_NET_ADMIN, so what do we need to feed setcap? On my Ubuntu Karmic system the setcap man page points you to cap_from_text. Cap_from_text points you to _cap_names, an array in the kernel. It would be nice if the setcap man page included a list of capability names along with a few examples. As it turns out, the names need to be in lower-case.

$ sudo -s
# sudo apt-get install libcap2-bin
# groupadd -g wireshark
# usermod -a -G wireshark gerald
# chmod 750 /usr/bin/dumpcap
# setcap cap_net_raw,cap_net_admin=eip /usr/bin/dumpcap

You can also set these capabilities for Wireshark and TShark directly. Fully-functional filesystem capabilities is something the Linux world has needed for a very long time. I’m glad they’re finally seeing wide deployment.

Who’s Doing This? 🔗

Debian and Gentoo are using group-based permissions for Wireshark. Ubuntu is working on it. Hopefully the other distributions will follow suit.

1. This is a problem on other systems too, but it’s usually easier to solve. On Windows you can run the NPF service at startup. On OS X you can use ChmodBPF.

Comments 🔗

Comment by Jake on 2010-02-08 05:45:00 +0000 🔗

Note that the recent Debian packages already implement this, something you’ll notice when installing them. Thanks Balint. For Ubuntu it’s still on Wishlist status.

Comment by Balint on 2010-02-10 04:11:39 +0000 🔗

Gerald,
Could you please suggest using the wireshark system group instead of packetcapture?
Gentoo and Debian already use wireshark group, and it would be easier for newcomers to use the same group name everywhere.

I plan to update the Debian packages to use setcap, thanks for the hint.

Comment by Gerald Combs on 2010-02-10 10:59:09 +0000 🔗

I changed the example group to “wireshark” and mentioned Gentoo, Debian, and Ubuntu.

Comment by Balint on 2010-02-17 10:28:51 +0000 🔗

It would also make sense to use groupadd -g -r wireshark instead of groupadd -g wireshark to make the new group a system group. That would match and nicely coexist with Debian’s and Ubuntu’s installation method.

Shark Appliance Preview

Fri, 22 Jan 2010 23:56:00 +0000

Things have been pretty busy at CACE Technologies over the last few months. As a result, we have a nice pipeline of cool products that will hit the market over the course of the next year or so.

A product that we are going to announce very soon is the Shark Appliance. Think about a rack-mountable system that can do long term 24/7 recording of multiple Gigabit links without dropping packets. Now add:

– An extremely slick user interface, based on Pilot, which allows you to remotely navigate across terabytes of data and pinpoint issues in a few mouse clicks.
– Full integration with Wireshark. Not as in “we can save in .pcap so Wireshark can read it”, but as in “highlight a conversation IN THE REMOTE BOX and instantly see the relevant packets in Wireshark ON YOUR LAPTOP”.
– Remote control on multiple appliances from a single console.
– The possibility to buy the product as a Kit: card + OS + software. I find this quite revolutionary, because it will make it possible to configure the hardware (disk type and size, CPU…) for your specific needs, and at the same time save money.

Give a look at http://www.cacetech.com/media/appl_intro/ for some UI nuggets (apologies for the soundtrack, but I like that song). And stay tuned if you want more information.

Sharkfest ’10 Registration Now Open

Thu, 21 Jan 2010 18:34:26 +0000

Registration for the third annual Wireshark Developer and User Conference is now open! If you want to learn how to get the most out of Wireshark, develop dissectors, or just hang around with protocol geeks this is the place to be!

Comments 🔗

Comment by solanki on 2010-02-06 06:09:54 +0000 🔗

HELOO I CANT USED THIS PLZ USE THIS SOFTWARE PROSESS

Leveraging Your Settlement

Wed, 23 Dec 2009 18:01:55 +0000

Comcast owes me money. They owe lots of people money.

In 2007 and 2008 Comcast forged TCP RST packets in order to throttle P2P and other kinds of traffic. This resulted in several class-action lawsuits. They recently settled one of them and agreed to pay each affected customer $16.

From an individual perspective this isn’t a lot. However, for those who are eligible for the settlement I have a proposal: submit your claim form and make it part of a larger donation to your local food bank or homeless shelter.

That’s what I’m going to do.

Holiday Gift Opening Tip

Thu, 17 Dec 2009 04:47:42 +0000

This is a blister pack:

We take gift-giving safety seriously here at the CACE Technologies World Domination Headquarters.

These are aviation shears:

This is what you can do to a blister pack in just a few seconds using aviation shears:

The shears were designed to cut sheet metal. They go through annoying packaging with precision and ease. You know those scissors that can cut through a penny? Aviation shears can cut through a penny and through those scissors.

They’re the best thing I’ve found so far for the job.

Troubleshooting A Slow Web Site

Tue, 08 Dec 2009 01:58:00 +0000

A couple of weeks ago we had a strange problem in the CACE Technologies World Domination Secret Lair. Loris was having trouble loading the Wireshark blog. It was working fine on my machine so I checked some of the other machines in the office. I found the same problem on one of the development machines. Loading the page in Firebug showed that the object requests were stalling out every 20 seconds or so:

I fired up Wireshark and captured the browser attempting to connect to the blog:

The problem was immediately obvious. The browser attempted to connect to the blog’s IPv6 address (2607:f0d0:2001:e:1::1), timed out, and connected to the blog’s IPv4 address (67.228.110.126).

As it turns out Loris and I ran some IPv6 tests a long time ago and we added unique local addresses to our machines (mine was fd00:cace::4) . Since each machine had an IPv6 address the TCP stack assumed that there was general IPv6 connectivity. However, our ISP is steadfastly ignoring IPv6 so end-to-end connectivity wasn’t there. After timing out the connection fell back to IPv4 and proceeded normally.

This sort of thing will likely crop up more and more often as we transition to IPv6. If either IPv4 or IPv6 connectivity fails, your applications will still have connectivity so the failure may not be immediately obvious. In this case Firefox stalled out but still managed to connect. If it used a connect-by-name socket API the failure wouldn’t have been evident at all.

Comments 🔗

Comment by siyu on 2010-01-28 17:58:55 +0000 🔗

thanks a lot.

Wish List: Decent SVG Network Elements

Wed, 25 Nov 2009 05:02:17 +0000

Nmap 5 has a really cool feature: you can scan a network and dump its map to SVG. Inkscape is turning out to be a really nice vector drawing program.

A really useful workflow would be to combine the two:

Map your network using Nmap.
Tweak that map to your liking using Inkscape.
Have a cool map.

Unfortunately this is a harsh, cruel world we live in. The workflow we currently have is:

Map your network using Nmap.
Load the map Inkscape.
Search the interwebs for decent SVG network elements until you have to explain the foul language and crying to your wife.

This is something Visio is famous for (network art, not the foul language and crying). Search for “visio stencils” and you’ll be bombarded with all sorts of network shapes, from major equipment manufacturers to ones that look like crayon art. Where are all the cool SVG network elements? Quantum Bits made a nice start, but we need a lot more than that.

Comments 🔗

Comment by shannon on 2009-12-02 10:09:28 +0000 🔗

this is some good info. thanks, by the way is there some wireshark software for the palm pre?

Comment by Kirby Files on 2009-12-23 13:06:31 +0000 🔗

Just a note: the OpenClipArt site (which can be accessed via the Inkscape “Import from Open Clipart Library” menu) has some (mostly rudimentary) SVG artwork. Try searching for “network”, “router”, or “server”.

Chrome OS

Fri, 20 Nov 2009 00:31:59 +0000

Today I followed the announcement of the new Chrome OS from Google and the acclaiming response it received. Am I the only one thinking: very simple, maybe TOO simple?

Since the beginning of the “browser as an OS” idea, I always wondered how I am supposed to run my favorite program, Wireshark, in a browser. Wireshark, of course, is an example, but many people do things with computers that don’t translate well into the cloud paradigm. Will they just be dismissed by OS manufacturers as a “nerdy minority”? Or will they need to stick with old uncool OSes to do their things? I’d like to be cool too, Google, but I’d still like to run Wireshark.

Another thing I feel weird about: Google is telling me not to worry about data loss, because from now on all my documents will be online. Nothing will need to be saved locally.
Actually, I like that my documents stay in my computer. Am I really the only one in the world? I’m not only talking about personal stuff like the love letters to my wife or the drunk pictures at the party last week. What about the trace files that I get all the time from customers? Will they have to go online too? Hmm, I’m sure my customers will love having them on Google’s server.

I can already hear the objection: “this OS is for netbooks, and netbooks are only used for simple things like going online, so this is perfect for them”. Actually, I love using Wireshark on a netbook! Together with an Airpcap adapter, it’s the perfect portable wireless troubleshooting station.
Why does small need to mean “limited”? Personally, I’d actually love to run Wireshark on my wireless-enabled IPod Touch! Ok, maybe I’m going too far…

http://googleblog.blogspot.com/2009/07/introducing-google-chrome-os.html

Comments 🔗

Comment by Aaron C. de Bruyn on 2009-11-19 20:16:17 +0000 🔗

I just had the pleasure of using Wireshark on a netbook today.

Looks pretty good on the small screen.

Comment by vasiljevich on 2009-11-21 15:44:49 +0000 🔗

If Chrome OS is only for internet surfing, it seems to be useless, as there are many devices (more comfortable and portable than netbooks) with the same functionality.

Comment by Dan on 2009-11-21 22:00:11 +0000 🔗

Is there any reason wireshark couldn’t run as a javascript webapp?
I look forward to building an ultraportable sniffing machine using the wireshark webapp for Chrome OS on a netbook…
Of course, if I have to rely on a live connection to run the app to sniff the packets to troubleshoot my live connection, that may be a problem 🙂

Comment by Varun on 2009-11-23 00:32:46 +0000 🔗

Hi Loris,

Thanks for posting this. I’ve been thinking about using a sniffer on my iTouch too. (Don’t want to pay for upgrade to 3.0 though :)).

This proves either I’m not an idiot or not the only idiot to think that up 😀

BTW I’m not going for ChromeOS at all after watching them explain how only web browser will take care of my PC experience…

Varun

Comment by ME! on 2009-11-24 16:21:19 +0000 🔗

I guess you’re not cool enough for ChromeOS.
🙁

Comment by Terry on 2009-12-09 19:30:12 +0000 🔗

Loris, You are not alone. Going a bit beyond using applications like Wireshark, the cloud paradigm will have a boundary established by financial interest or technical and legal limitations. A recent example is the I Phone and the attempt to use a voip application not licensed by Apple. In the Chrome cloud Google not the individual or group will determine what is permitted. It will be cheaper for those doing email, Facebook, desktop publishing. The cost will increase for anyone using a standalone OS. I hope the Chrome like goes away quickly.

Comment by Yuval Levy on 2010-01-16 11:39:31 +0000 🔗

Loris, you’re not alone. All of these freebies are cool candies to attract consumers into selling their souls. I rather have a known price tag in US$ than an unknown price tag in relinquishing control over core strategical and personal things. Call me uncool.

I wanted to thank you for wireshark. I am trying to use it to reverse engineer USB camera communication, although with little success so far. My Ubuntu 9.10 system freezes a few seconds after I start sniffing. I’ll keep googling for a solution – that’s what I like google for.

Autosuggestive

Wed, 18 Nov 2009 17:37:22 +0000

walmart

wikipedia

Does Wired 96.5 have a morning zoo?

walmart beat weather. wtf?

Comments 🔗

Comment by Chris on 2009-12-02 16:53:31 +0000 🔗

way cool on #1 suggestion for wir as wireshark.
wow for walmart.

btw, eth yields:
ethan allen
ethanol
ethics
ethos
ethel kennedy
ether
ethiopia
ethereal
ethnicity
ethnocentrism

#8 isn’t too bad either, especially considering that it’s essentially been dead for ~3 1/2 years.

New Document Icons

Tue, 17 Nov 2009 17:46:00 +0000

Thanks to Elliott Aldrich the next release of Wireshark will have great-looking document icons. Here’s a preview:

It's a trace file, not a commentary on PayPal.

Thanks Elliott!

Comments 🔗

Comment by Elliott Aldrich on 2009-11-18 21:22:16 +0000 🔗

My pleasure! I always enjoy making icons and I am proud to contribute to the Wireshark project.

Elliott.
http://www.aldrichart.com/

Javascript Background Animation

Fri, 13 Nov 2009 05:11:26 +0000

The Windows 7 taskbar does this nifty little background animation when you mouse over an open application’s icon. I wanted to see if the effect could be duplicated on a web page.

Suppose we have a couple of inline elements:

<div>
  <img class="bgmove" src="wsbadge-empty.png">
</div>

<h1>
  <span class="bgmove">Packets!</span>
</h1>

The image is mostly transparent:

We have a background that’s slightly larger than our elements, which lets us position it using negative offsets:

.bgmove {
  background-image: url('wsbadge-bg.png');
  background-repeat: no-repeat;
  background-position: -50px -20px;
}

jQuery lets us do two important things: track mouse motion and determine an element’s dimensions. This lets us shift the backround around when we mouse over each element:

$(document).ready(function(){
  $("div img.bgmove").pngFix();
    $(".bgmove").mousemove(function(e){
    var elWidth = $(e.target).outerWidth();
    var elHeight = $(e.target).outerHeight();
    var bgWidth = 279;
    var bgHeight = 95;
    var x = e.pageX - this.offsetLeft;
    var y = e.pageY - this.offsetTop;
    //var offX = -1 * (x * (bgWidth - elWidth) / elWidth);  // Against the mouse
    var offX = (x * (bgWidth - elWidth) / elWidth) - (bgWidth - elWidth);  // With the mouse
    var offY = -1 * (y * (bgHeight - elHeight) / elHeight); // Against the mouse
    //var offY = (y * (bgHeight - elHeight) / elHeight) - (bgHeight - elHeight);  // With the mouse
    bgPos = offX + 'px ' + offY + 'px';
    this.style.backgroundPosition = bgPos;
    });
})

You can see it all in action on the demo page. Combining this with jQuery animation is left as an exercise for the reader. The effect works in Firefox, Safari, Chrome, and IE 7+. IE 6 has trouble with the transparent PNG.

Sharkfest ’10 – Mark your calendar

Mon, 09 Nov 2009 22:06:49 +0000

Sharkfest ’10 will take place at Stanford University from June 14 to 18. I’ll follow up when I have more details.

Chappell Seminars Summit 09 – Mark your calendar

Thu, 05 Nov 2009 23:57:16 +0000

Laura Chappell will be hosting another tools, troubleshooting, and security summit in Santa Clara, CA December 7th, 8th, and 9th where I’ll be a special guest. See you there!

SSL / TLS Renegotiation Bug

Thu, 05 Nov 2009 23:17:45 +0000

Marsh Ray and Steve Dispensa have an excellent writeup of the recently-discovered renegotiation bug in SSL and TLS. It really is excellent, too. I’m not just saying so because they provide a bunch of sample captures showing renegotiation in action or because Wireshark is prominently featured in their discussion.

In related news, the secure web is no longer secure and civilization will soon collapse.

Comments 🔗

Comment by Marsh Ray on 2009-11-07 00:09:03 +0000 🔗

I could not have done it without Wireshark.

Re: “In related news, the secure web is no longer secure and civilization will soon collapse.”

Please note that our research yielded little in support of that theory about civilization!

Comment by Kelt on 2009-11-18 11:52:43 +0000 🔗

I just wanted to say kudos to Marsh and Steve for finding this vulnerability. Now I have to go figure out a workaround for a few 1000 servers until a patch is released. 😉

And I’d like to point out the obvious statement: Wireshark is awesome. I used to use Ethereal and pcap but switched over to the shark. Keep up the good work guys.

We made the Today Show! (Sort of)

Thu, 29 Oct 2009 17:20:16 +0000

If you look closely and don’t blink you can see an AirPcap NX and Wireshark in a recent Today Show segment.

Comments 🔗

Comment by Ryan on 2009-11-03 11:32:22 +0000 🔗

I found it amusing how that video calls Wardiving ‘new’.

Comment by Patrick Gryciuk on 2009-11-04 03:06:06 +0000 🔗

bahaha I love it :D. I’ve been using wireshark for a long time (long before it changed it’s name from ethereal.) I just wanted to thank all the developers for their contributions to the project. When I have more free time on my hands I’ll definitely try to join the development group.. or at the very least make a donation.

Comment by jc on 2009-11-05 11:02:41 +0000 🔗

@Ryan: ‘wardiving’? Is that using SCUBA gear to hunt for underwater WiFi networks?

Using Wireshark to track a botnet

Wed, 28 Oct 2009 19:05:19 +0000

Security researchers have written a Wireshark dissector that will decrypt the command and control protocol used by the Mariposa botnet. More information at Palo Alto Networks and Defence Intelligence.

Comments 🔗

Comment by ManOnFire on 2009-11-02 08:05:48 +0000 🔗

Anyone have a packet capture for mariposa C&C? I would like to test the decryption plugin. Thanks!

Comment by Gerald Combs on 2009-11-04 13:47:55 +0000 🔗

You might try contacting Palo Alto Networks or Defence Intelligence. I don’t see any capture file downloads on either site.

Fluffy Shark

Thu, 22 Oct 2009 20:12:17 +0000

Reader Ro sent in the following pictures:

See the complete set at Flickr. The shark-with-a-tube-of-frosting frightens and confuses me.

Comments 🔗

Comment by maddy on 2009-10-27 12:00:08 +0000 🔗

I have the wireshark analyzer installed on my laptop, when I start to capture interface packets, It shows me my entire network/subnet desktop packets, which are not belongs to my ip also.

My pc ip is 10.173.X.34 but you can see the other desktop traffic also.which is not related to my laptop. Can you please help me why this is happening?

Comment by Gerald Combs on 2009-10-28 11:44:57 +0000 🔗

That sounds like what you should normally see when you capture on a LAN connected via a hub. Even in a switched environment you will see spillover from time to time, such as broadcast or multicast packets, or unicast packets to destinations that the switch hasn’t yet learned.

I’m hoping to have a video out in the next few weeks that shows what happens when you capture on hubs vs switches. Hopefully it will explain what you’re seeing.

Debugging SSL Servers Over IPv6

Fri, 16 Oct 2009 21:00:50 +0000

An old-school method of debugging TCP-based services is to use telnet:

$ telnet www.wireshark.org 80
Trying 67.228.110.120...
Connected to www.wireshark.org.
Escape character is '^]'.
HEAD / HTTP/1.0
Host: www.wireshark.org

HTTP/1.1 200 OK
Date: Fri, 16 Oct 2009 19:31:47 GMT
Server: Apache
Accept-Ranges: bytes
Cache-Control: max-age=3600
Vary: Accept-Encoding
X-Slogan: Be good. You never know who's running Wireshark nearby.
Content-Length: 9628
Connection: close
Content-Type: text/html

Connection closed by foreign host.

It’s like giving your web server a big ol’ hug.

Most telnet clients do something very clever here. If you connect to a port other than 23 (or whatever getservbyname returns when you feed it “telnet”) they will disable telnet protocol negotiation and switch to line mode. This gives you a raw, line-based connection which is just the thing you need to interact with an HTTP, POP, IMAP, FTP, or NNTP server.

Adding SSL and IPv6 to the mix complicates things. I’m in the process of making Wireshark’s public-facing services available over IPv6. It would be helpful to be able to test connectivity to each service before adding its corresponding AAAA record. Standard telnet clients support 6, but not SSL. OpenSSL’s s_client command speaks SSL, but not over IPv6 (not on my systems, at least):

$ openssl s_client -connect '[2607:f0d0:2001:e:1::123]:443'
getservbyname failure for f0d0:2001:e:1::123]:443

$ openssl s_client -connect ipv6.wireshark.org:443
gethostbyname failure
connect:errno=110

Luckily Fyodor released Nmap 5 a while back. Nmap 5 includes ncat, which lets you connect over SSL+IPv6. It is now my new favorite service-poking utility.

$ ncat -6 --ssl -v 2607:f0d0:2001:e:1::123 443
Ncat version 5.00 ( http://nmap.org/ncat )
SSL connection to 2607:f0d0:2001:e:1::123:443. bugs.wireshark.org
SHA-1 fingerprint: F6BA 2EE9 DEEF 74D3 B4B0 86D7 F5DB 6237 FF7F 896A
HEAD /bugzilla/ HTTP/1.0
Host: bugs.wireshark.org

HTTP/1.1 200 OK
Date: Fri, 16 Oct 2009 20:26:23 GMT
Server: Apache
Vary: Accept-Encoding
Connection: close
Content-Type: text/html; charset=UTF-8

On many Linux distributions you can also use telnet-ssl:

telnet-ssl -z ssl 2607:f0d0:2001:e:1::123 443

Comments 🔗

Comment by Martijn Pepping on 2009-10-19 08:40:32 +0000 🔗

Instead of the telnet-ssl command the openssl command can be used, which is more likely to be available on a system.

For example, the openssl command can be used as:
$ openssl s_client -connect hostname:443

In which ‘443’ represents the tcp-portnumber the SSL-service is listening on.

Comment by Gerald Combs on 2009-10-19 08:42:49 +0000 🔗

Does ‘openssl s_client -connect’ support IPv6 on your system? It doesn’t on any of mine. See the red error text in the post.

Comment by SSL Star on 2009-11-04 08:23:42 +0000 🔗

Great advice. I dont know how many times I have to tell people the very same things. Glad I’m not the only one.

IPv4 Exhaustion FAQ

Wed, 07 Oct 2009 13:15:49 +0000

Q: What does IPv4 exhaustion mean? Can’t you give IPv4 some Red Bull?

A: As everyone knows, the Internet was constructed by Theodore Roosevelt in 1895 using an old-growth forest and a thousand buffalo hides. He created a giant “pool” to hold all of the Internet’s numbers. While quite large for its time, the pool is much too small to handle the demands of today’s Internet.

Q: When will the pool run out?

A: In about eight and a half minutes.

Q: What will happen then?

A: The entire Internet will grind to a halt. It will shudder comically as it does so.

Q: But how will I get to Twitter? I gotta have my tweets.

A: In recognition of its role as the most important web site ever, the final IP address will be reserved for Twitter. In order to get there you will have to defeat an opponent in a cage match. You will get to choose between a crowd shouting “Two packets enter! One packet leaves!” or the Star Trek fight theme.

Q: Can’t I have something cool like Eye of the Tiger or that one Van Halen song that sounds like a motivational poster?

A: No. Not nerdy enough.

Q: I don’t want to fight a nerd in a cage. Is there another way to get my tweets?

A: No. Gotta battle a nerd.

Q: Really?

A: Well…

Q: Well, what?

A: You could use IPv6.

Q: What’s IPv6?

A: It’s a newer, better Internet created by Matthew Broderick’s character in War Games in 1983. Its number pool is huge. The addresses should last for dozens of months at the very least.

Q: How do I use IPv6?

A: You have to have a modern computer. You also have to have an ISP that supports IPv6 or create a tunnel.

Q: OK. Tunnel’s all ready to go. Can I have my tweets now?

A: No.

Q: Why not?

A: Twitter doesn’t use IPv6.

Comments 🔗

Comment by Paul Nicholas Boylan on 2009-10-07 12:10:28 +0000 🔗

When I began reading this FAQ discussion, I got excited: not only did this page appear informative (I never realized Teddy Roosevelt created the first internet) but it also seemed I had FINALLY found an information source that would answer all of my nagging – and persistent – questions about whether I will still be able to tweet after the internet collapses, which we all know is imminent.

Imagine my consternation when I reached the end of the FAQ discussion to learn I would NOT be able to tweet after doomsday. Thank you SO much, Gerald Combs (if that IS your real name) and Wireshark for lifting my spirits up so high only to let those elevated spirits fall to crash and die on the rocks of bitter disappointment. You should be ashamed of yourselves.

Comment by Etherealmind on 2009-10-08 04:19:04 +0000 🔗

Class, absolute class.

Lets face it, running out of IPv4 addresses is a funny as a fart in a wetsuit.

More please.

Comment by david on 2009-10-11 18:09:17 +0000 🔗

the net came in the 60s

Comment by Ryan on 2009-10-13 23:21:05 +0000 🔗

IPv6 will never make it to the prom as long as her boyfriend NAT is around

Comment by lpic.lt on 2009-11-20 23:42:01 +0000 🔗

the end is near! my ip address is 249.200.17.130 so the end is NEAR!!!

Capture Filters and Offsets

Mon, 05 Oct 2009 13:03:53 +0000

A couple of questions have come up on the wireshark-users mailing list recently about using capture filters for MPLS and VLANs. Each user was having the same problem yet these are different network technologies — what do they have to do with each other?

The answer is offsets.

Let’s take an up-close and personal look at the capture filter “ip src host 10.16.32.48”. We can do this by running tcpdump -d, which takes a filter, compiles it, and dumps out the result. The dump of our filter looks like this:

(000) ldh      [12]
(001) jeq      #0x800           jt 2    jf 5
(002) ld       [26]
(003) jeq      #0xa102030       jt 4    jf 5
(004) ret      #96
(005) ret      #0

If this makes no sense don’t worry. You just need to know that the first two lines look for the IP ethertype (0x800) starting at byte 12 and the next two lines look for the IP address 10.16.32.48 (0xa102030) starting at byte 26. This is the minimum amount of checking required for that capture filter if you’re running IP over Ethernet.

What happens if you’re using 802.1q?

802.1q inserts an extra four bytes in front of the ethertype, so this filter won’t do what you want. The ethertype will be at offset 16 instead of 12, and the IP source address will be at offset 30 instead of 26. Libpcap and WinPcap don’t know you’re using .1q, and adding a check to the filter code would add a lot of unnecessary overhead. We have to add the word “vlan” to our filter to get the right offsets, e.g. “vlan and ip src host 10.16.32.48”:

(000) ldh      [12]
(001) jeq      #0x8100          jt 2    jf 7
(002) ldh      [16]
(003) jeq      #0x800           jt 4    jf 7
(004) ld       [30]
(005) jeq      #0xa102030       jt 6    jf 7
(006) ret      #96
(007) ret      #0

There’s a gotcha here, though. What if we change the “and” to an “or”?

(000) ldh      [12]
(001) jeq      #0x8100          jt 6    jf 2
(002) ldh      [16]
(003) jeq      #0x800           jt 4    jf 7
(004) ld       [30]
(005) jeq      #0xa102030       jt 6    jf 7
(006) ret      #96
(007) ret      #0

We’re looking for the IP address at byte 30. Shouldn’t we be looking at both 26 and 30?

The filter compiler uses a base offset for fetching data from the packet. Any time you use “vlan”, “mpls”, or “pppoes” in a capture filter, this offset is increased from that point on. It’s also cumulative. That is, while all of these filters are logically equivalent, they’re not in practice:

ip src host 10.16.32.48 or vlan or vlan (Looks for 10.16.32.48 at offset 26)

vlan or ip src host 10.16.32.48 or vlan (Now it’s looking at offset 30)

vlan or vlan or ip src host 10.16.32.48 (Offset 34. When will it ever end?)

“vlan” and “mpls” increase the base offset by 4. “pppoes” increases it by 8.

Video: Custom Wireshark Shortcuts

Thu, 01 Oct 2009 21:28:04 +0000

I made a video that shows you how to create a Windows shortcut that starts capturing immediately.

Watch it now!

Using Shame and Embarrassment to Promote IPv6

Thu, 01 Oct 2009 21:27:34 +0000

In a previous post I proposed the terms “indoor plumbing” for native IPv6 access and “outdoor plumbing” for tunneled IPv6. I think terminology like this is important. It’s short, clear, and implies an easy-to-visualize hierarchy where anything less than native routing involves uncomfortable exposure to the elements and woodland creatures.

Which leads us to those poor souls with IPv4-only networks.

“Y-you mean to say that you don’t have any modern plumbing at all? (snork) BWAHAHAHAHAHA!”

We could use something similar for unsecured wireless connections.

We are here at www.wireshark.org…

Tue, 29 Sep 2009 23:17:57 +0000

…where we’ve secretly replaced the Internet Explorer we usually serve with Chrome Frame.

Enjoy.

Polycom IP Phone Boot Analysis

Mon, 28 Sep 2009 21:20:29 +0000

We use Polycom SoundPoint IP phones here at the CACE Technologies World Domination Secret Lair. While troubleshooting a different problem recently I noticed that the phones do something funny. During the boot process they obtain an IP address via DHCP, similar to most PCs. A DHCP option tells the phones to fetch their configuration and firmware from an FTP server. The funny part is that some of the FTP transfers were failing even though the phones booted up just fine:

SIP firmware download failure

At packet 175 the phone starts to download sip.ld, the SIP firmware image. The transfer starts at packet 177, but the phone cuts the transfer short at packet 181. The phone then behaves as if nothing is wrong. What’s going on here?

At this point the phone might have an up-to-date copy of the SIP firmware. It would be nice if it could avoid downloading this file every time it booted up. The file is 15 MB, so in some environments this would be really nice. (Imagine a thousand phones trying to download this file at the same time after a power outage. Over a fractional T1. That’s flapping.) Unfortunately methods for comparing files via FTP or HTTP to ones you already have are either rarely used or not supported at all.

Running the strings command on the firmware turns up the following tidbit at the beginning of the file:

Checksum=0x00008c5e

It looks like the phones look for the checksum in the firmware header and drop the connection once they’ve determined they already have an up-to-date copy.

This is a very roundabout way of showing that sometimes error conditions on your network are not only normal but beneficial.

Comments 🔗

Comment by bperkic on 2009-09-30 01:07:36 +0000 🔗

Good point! Thx

Comment by rogio on 2009-10-23 09:16:35 +0000 🔗

Great Read.

Comment by Oldcommguy on 2009-11-05 11:01:59 +0000 🔗

It is no longer a secret…now we know where you are at!!!!

Great article – Flapping indeed and an real OMG!

Wireshark’s Welcome Screen

Fri, 25 Sep 2009 16:04:28 +0000

Wireshark 1.2 added a nifty welcome screen which lets you start capturing, load a capture file, get help, and lots of other things. At the very top of the screen we brag about our popularity.

You can change that message to anything you like.

🔗

If you’re running Windows

Go to About→Wireshark→Folders.
Double-click on Personal Configuration.
Open preferences with a text editor, such as Notepad. Not a word processor, such as Word. This is a plain text file. Notepad good. Word bad. Very, very bad.

If you’re running OS X, Linux, or similar 🔗

Open ~/.wireshark/preferences in a text editor.

Now that you’re deep in the bowels of your preferences file 🔗

Find the following block of text:

# Custom start page title.

gui.start_title: The World's Most Popular Network Protocol Analyzer

# Show version in start page, can be useful in custom builds.

# TRUE or FALSE (case-insensitive).

gui.version_in_start_page: FALSE

Change gui.start_title to your custom message.
If you’d like the version to show up, change gui.version_in_start_page to TRUE.
Save the file and exit your editor.
Restart or start Wireshark.

Et voilà:

More Shark Pictures

Mon, 21 Sep 2009 23:05:59 +0000

Wireshark power user Joan Snelders sent in a couple of shark pictures:

Shark candy

More shark candy

Thanks, Joan!

Comments 🔗

Comment by Ro on 2009-10-18 07:16:26 +0000 🔗

– Hey fellows,

Attached is the link of another great shark user !

http://www.flickr.com/photos/43707902@N04/sets/72157622485731109/

-R

PS : Feel free to put photos on the site

Filtering DSCP

Mon, 21 Sep 2009 22:34:34 +0000

The second byte in the IPv4 header (aka “those bits you’ve probably never, ever looked at”) is used for Differentiated Services, or DiffServ. It’s split into two parts: the 6 most significant bits define the DSCP (differentiated services code point) and the two least significant bits are for ECN (explicit congestion notification). You can use DSCP to divide your traffic into different classes. For example, Asterisk might use the following DiffServ value, which corresponds EF (Expedited Forwarding):

DSCP  ECN
10111000

If your networking equipment is sufficiently aware, this traffic will receive preferential treatment.

You can filter these values pretty easily using the ip.dsfield.dscp display filter — just right-click on the DSCP field in the packet like so:

Applying a DSCP display filter

What if you need to use DSCP in a capture filter?

To match against a particular DSCP codepoint using BPF (WinPcap/libpcap’s filtering language) you need to take the bit pattern, left-shift it two places to account for the ECN, and mask out the ECN. For EF (101110) you’d have do something like this:

Take 101110 and shift it left two bits: 10111000
Convert it to hex: 0xb8
Create a filter, masking out the ECN bits:

ip[1] & 0xfc == 0xb8

Cisco has a list of code points at http://www.cisco.com/en/US/tech/tk543/tk757/technologies_tech_note09186a00800949f2.shtml

P.S. To make matters more confusing, the DiffServ field was originally called “Type of Service.”

Missing Packets and Chimnies

Thu, 17 Sep 2009 00:33:43 +0000

You’ve just fired up Wireshark on your Windows Server 2003 or 2008 system and you’re not seeing nearly the amount of traffic you should. What’s happening?

The Windows Server 2003 Scalable Networking Pack introduced a feature called TCP Chimney Offload. Chimney offloading lets the OS networking stack hand off established TCP connections to the NIC for processing. This frees up the CPU, bus, and memory for other things and lets you scale up the number of connections you can handle. Hooray! Once the OS hands a connection off to the NIC, that traffic completely bypasses WinPcap and therefore doesn’t show up in Wireshark. You see the TCP connection setup and non-TCP traffic but no TCP data. Oops.

How do you fix the problem? It depends on your environment.

You can disable chimney offloading as described in KB 91222 (Server 2003) or KB 951037 (Server 2008). If you have a gigabit NIC you can probably get away with leaving it disabled. If you have a 10 gig NIC this might affect your performance. You can also SPAN or tap in and capture on an external machine, assuming you’re sufficiently equipped.

Shark. Laser Beam.

Wed, 16 Sep 2009 04:03:55 +0000

Tip from Laura: SMB2 Vulnerability Wireshark Filter

Tue, 08 Sep 2009 20:38:19 +0000

The big tech news this morning was a recently-discovered SMB2 vulnerability in Windows Vista, 2008, and 7. Laura Chappell created a Wireshark display filter for identifying offending traffic:

((smb.cmd == 0x72) && (smb.flags.response == 0)) && !(smb.pid.high == 0)

See the full report on her site for more information.

Comments 🔗

Comment by Jay on 2009-10-07 14:19:26 +0000 🔗

Hi,
I am doing some Software Performance Test(thru network environment) and Im using Wireshark to analyze it.
My Capture filter is ether host xx:xx:xx and Display filter is smb2.
What is the filter syntax should I use to remove the packet using GUID handle file:xxx under smb2 protocol.
Please help.

Does IPv6 Adoption Depend on Akamai?

Mon, 07 Sep 2009 04:11:11 +0000

The ongoing effort to switch the entire planet over to IPv6 has a chicken-and-egg problem: there is little incentive to deploy it if no one else is using it. This is expected to change as IPv4 addresses become more scarce, but for the time being uptake is dismal (in the U.S. at least).

One easy way to measure IPv6 adoption is to see how many of Alexa’s top sites have AAAA records. Hurricane Electric and Lars Eggert do a good job of this. Following in their footsteps my own version of this data is shown below:

IPv6 Adoption - Alexa top 1000

It shows IPv6 adoption in Alexa’s top 1000 sites along with the number of sites using Akamai. The number of IPv6 sites is pretty small but the number of “testing” sites is encouraging. See the notes below for a detailed explanation and breakdown.

Who is Akamai? They’re a giant content and application delivery provider.

If you serve out a bajillion pages to users all over the world, Akamai can help you do it more effectively. They also don’t support IPv6. According to a response I received from them they have no plans to deploy it any time soon. As you can see, if

just one company added IPv6 support, it would have a huge impact on content availability.

Two Akamai users stick out: Apple and Microsoft. Apple’s Airport Extreme gives home users IPv6 automatically, but those users can’t access apple.com over IPv6. The same is true of microsoft.com —Windows Vista and 7 have excellent IPv6 support but you can’t use it to connect to Microsoft. Even worse, Microsoft has a test address (www.ipv6.microsoft.com) which is broken in two ways: it doesn’t follow accepted naming conventsions and it’s currently down.

When Akamai starts delivering IPv6 content, it will be a pretty big milestone.

Notes:

The graph was generated using Amazon’s “top 1 million sites” data from September 6, 2009.
Categories were tabulated thusly: “IPv6 Deployed” sites (5) had AAAA records for either domain.com or www.domain.com. “IPv6 Testing” sites (16) had AAAA records for ipv6.domain.com, www.ipv6.domain.com, or www6.domain.com. “Akamai” sites (108) had CNAMEs pointing to one of the many Akamai domains (akadns.net, edgekey.net, edgesuite.net, or d4p.net).
The data was fudged in two places due to overlap. Microsoft.com was categorized as “Akamai” for reasons discussed above. Sify.com had both test and production AAAA records. They were counted as “IPv6 Deployed.”
Alexa is more of a random number generator rather than an accurate measurement of top web sites. They get their data from people with the Alexa toolbar installed. These people tend to be overly-interested in things like web hosting and search engine optimization. For example, I really like SoftLayer but there’s no way in Hell they should be in the top 500.

Comments 🔗

Comment by Liberty Miller on 2009-09-17 00:34:23 +0000 🔗

Good article! (& better than NCC’s ” IPv6 Act Now” effort .. 😉

And this is HILARIOUS (in that ‘it’s-funny-because-it’s-so-true’ kind of way):

“Even worse, Microsoft has a test address which is broken in two ways…” (etc.)

Reminds me of how I couldn’t find Microsoft sites using Microsoft’s search engine…

Comment by epi on 2009-10-26 23:02:14 +0000 🔗

Scaricity is profitable. As you know money was once backed by scarce gold but currently it is only backed by the greed of hoarders. The limited ipv4 address space could change that and be used for creating a new monetary standard, unfortunately ipv6 would be inflationary.

Any Questions?

Wed, 05 Aug 2009 22:35:26 +0000

Wireshark.org and IPv6 plumbing

Mon, 03 Aug 2009 21:38:10 +0000

Wireshark has supported IPv6 since dirt was new. Unfortunately, the wireshark.org web site has only been available over IPv4. Until now, that is. If you are IPv6-enabled, you can reach the Wireshark web site at http://ipv6.wireshark.org. Nota bene:

The address above is only available over IPv6.
The main address for the site (http://www.wireshark.org) is still IPv4-only. We’ll add an AAAA record after a suitable evaluation period.
Other Wireshark sites (such as the bug tracker, wiki, and buildbot) are still IPv4-only for the time being.

In order to encourage the adoption of IPv6 I think the phrases “indoor plumbing” and “outdoor plumbing” should be used to refer to native and tunneled IPv6, respectively. Once you point out that an ISP has outdoor plumbing, they’ll want to add native IPv6 support out of shame.

Examples:

Wireshark.org is hosted at SoftLayer. They have indoor IPv6 plumbing.
Wave Broadband is so behind the times! I’m stuck with outdoor IPv6 plumbing at home!

Packets

Mon, 27 Jul 2009 23:49:56 +0000

Has anyone seen my packets? They were around here somewhere.

Comments 🔗

Comment by Joan Snelders on 2009-09-12 05:53:29 +0000 🔗

They are here!
http://wiki.wireshark.org/SampleCaptures