LAB 10 - The chappellu.com/nothere.html page really isn't available as we've moved the site and are using HTTPS now. Try going to packet-level.com/nothere.html. We are keeping that site running under HTTP and you'll get your 404 error message for Lab 10 on that site.

​

PAGE 155 (Thanks to Patrick for catching this one.)

On page 155 of this second edition, I addressed the dangers of using the http filter rather than tcp.port==80. The http filter won't show you the TCP handshake, ACKs, teardown, etc. I always want to see these things.

​

In the book, I referred to the different number of packets that you would see in these cases:

• TCP reassembly disabled: 12 packets match the http filter

• TCP reassembly enabled: 85 packets matche the http filter

​

The second result is now outdated as changes have been made to the HTTP dissector. Wireshark used to only show packets that contain an HTTP request or response code - it would ignore the data packets seen when an object is uploaded/downloaded. This is why we would only see 85 packets with the http filter. Now, Wireshark recognizes that when an object upload/download requires multiple packets, those packets can still be considered part of the HTTP communication and they are displayed with the http filter.

​

If you want to avoid this confusion completely, just use the tcp.port==x filter format for TCP-based applications.

​

Page 195
Step 4 and Step 5 of the book mention and depict the Filter Expressions area within the preferences file.

Wireshark now places the filter expression button settings into a file called dfilter_buttons.

If you created your profile with Wireshark v3 or later, look inside the dfilter_buttons file. If you created your profile with an earlier version of Wireshark, look inside the preferences file for the Filter Expressions area, as shown in the book.