[Wireshark-dev] Re: Feature Request: Process-Aware Packet Filtering and Captur

2025-05-24 Thread Josh Clark
Hi Ayub, Have you seen ptcpdump on Github? https://github.com/mozillazg/ptcpdump That project seems like it would meet your needs, at least on a *nix OS. It is not integrated into Wireshark, so you would need to separate your capture and analysis workflows for the time being. To help the dev tea

Re: [Wireshark-dev] seeking advice on how to reconcile two packet captures

2023-08-28 Thread Josh Clark
Sure, I can take a look. On Mon, Aug 28, 2023 at 14:07 Brian Reichert wrote: > On Mon, Aug 28, 2023 at 08:54:39AM -0700, Josh Clark wrote: > > Personally, as long as there are no firewalls, proxies, or NATs in the > way, > > I would hash together source IP, destinati

Re: [Wireshark-dev] seeking advice on how to reconcile two packet captures

2023-08-28 Thread Josh Clark
, and I would also check the time stamp of the packet to prevent accidental correlations when that field rolls over and restarts (maybe just ensure that the time stamps of the packets are within 5 minutes of each other). I hope that helps! Regards, Josh Clark On Mon, Aug 28, 2023 at 08:22 Brian

Re: [Wireshark-dev] Rough consensus and quiet humming

2021-04-22 Thread Josh Clark
h On 4/22/21 05:56, Francesco Fondelli wrote: Meetecho team introduced the "virtual hum tool"... there should be a draft somewhere describing it. Hmm. On Thu, Apr 22, 2021 at 10:39 AM Graham Bloice mailto:graham.blo...@trihedral.com>> wrote: In a covid pandemic, working from home wo

Re: [Wireshark-dev] 90GB pcap file get last frame time stamp

2021-02-26 Thread Josh Clark
I tried to respond, but used the wrong email somehow. Here's the text of it The tricky part of it is how the PCAP headers are structured. If you look at the packet header format, there's nothing that by default says that it's a packet header. So to make sure we can return the timestamp of the last

[Wireshark-dev] Enhancement Idea: "TCP SACK" instead of "TCP Dup ACK"

2021-01-19 Thread Josh Clark
baked-in Default profile to distinguish duplicate vs selective I would appreciate your comments on my plan, and your assistance getting me off the ground in making some edits. Regards, Josh Clark ___ Sent via:Wireshark-d