Laura Chappell
Analyze Multiple SACK Blocks
Selective ACKs reduce the number of retransmissions on the network - enabling a receiver to indicate the missing Sequence Numbers while...
top of page
Search
Laura Chappell
Reading a Selective ACK (SACK) Block
If you've been capturing traffic for a while, you've likely encountered some Selective Acknowledgment blocks. Selective Acknowledgment...
Laura Chappell
NEW: Wireshark Auto-Switch Profiles
Wireshark version 4.4.0 just dropped last week and it has a cool new feature in it: auto-switch profiles! This may change how I use...
Laura Chappell
Uber Humorous Wireshark
Last weekend, I settled in to watch the final episodes of Super Pumped: The Battle For Uber on Netflix. After a week of intense work on...
Laura Chappell
Importing Buttons into a Wireshark Profile
Buttons, buttons, buttons... one of the coolest features added to Wireshark. In the last blog, I showed you how to create a button. Now...
Laura Chappell
Wireshark Tip: Make a Button for That!
Have you created buttons for Wireshark yet? Buttons enable you to apply your favorite display filters to your trace files quickly. When...
Laura Chappell
Wireshark Expert Explained: ACKed Segment that wasn't Captured
Should you be concerned if you see this Expert warning in your trace file? Maybe. There are several possible reasons these may be in your...
Laura Chappell
Wireshark Challenge 01 Answers
Did you get a chance to try out last week's Wireshark Challenge based on the chappell-WChallenge012024.pcapng? Too easy? If you didn't -...
Laura Chappell
A Quick Wireshark Challenge
Test your Wireshark skills. Answers will be posted next week. Grab chappell-WChallenge012024.pcapng and take a few moments to answer the...
Laura Chappell
Free Lab: Wireshark Layered Display Filters
The ability to look for a field or a field value at a specific layer is one of the many cool display filter enhancements recently added...
Laura Chappell
The Must-Have Wireshark Column
The first column I add to every one of my custom Wireshark profiles is a "stream" column - a single column that indicates the index...
Laura Chappell
It's TCP/IP's Birthday!
In 1974, the world was focused on the Rumble in the Jungle and Richard Nixon's resignation in disgrace. In that same year (in May), Vint...
Laura Chappell
Why Should You Learn TCP/IP?
If you understand TCP/IP and how your network communications work, you understand where to look when things go wrong. You also understand...
Laura Chappell
How to Improve Wireshark's "TCP Errors" Graph Line
The "Bad TCP" designation is seen in the coloring rules, while the "TCP Errors" designation is seen in the IO Graph. Are they the same?...
Laura Chappell
Quickly Add IO Graph Items in Wireshark
This is a quick tip that you'll love. By default, Wireshark's IO Graph depicts the packets per second rate of all traffic and "Bad TCP"...
Laura Chappell
TCP Sequence Number in ACK Scans
During a recent class, I received a question related to ACK scans. "What Sequence Number would you see on the response to an ACK scan?"...
Laura Chappell
In the Wake of XZ - 3 Steps to Use Wireshark Securely
The discovery of malicious code in the XZ utils tarball has shaken up a lot of folks. XZ utils have been removed from Github and the...
Laura Chappell
Watch for a New DNS Type: HTTPS
You've captured some DNS traffic and are perusing through the packets. You see the regular Resource Record (RR) Type A requests for IPv4...
Laura Chappell
Check Out the Ultimate .pcapng
Are you looking to test Wireshark with a variety of packet types? Do you need to show someone the packet structure a specific protocol...
Laura Chappell
Where Did Wireshark's "manuf" File Go?
Prior to Wireshark 4, you would find the manuf file in the Wireshark program directory. The manuf file was a simple text file containing...
bottom of page