Re: [Wireshark-users] Wireshark doesnt recognize RTP packets when i decode

2008-03-05 Thread Jehanzeb Khan
Hello Fabiana I am not sure what do you mean by trying to decode rtcp/rtp packets to udp. As far as i know rtp/rtcp packets should be carried over udp which should be carried over ip (rtp/udp/ip). Do you see any UDP packets when capturing the data? Regards Jehanzeb Khan - Original Me

Re: [Wireshark-users] (resolved) troubleshooting ftp timeout using wireshark

2008-03-05 Thread luis pena
Hasang, Thank you for your response. It turned out that FTP traffic was still routing through our old Internet connection (at Site B) and our old firewall. The firewall configs were corrupt, and in fact there was no longer remote access to the PIX. I wish I could give more info but I don't have

Re: [Wireshark-users] Wireshark only capturing TCP handshake

2008-03-05 Thread Hansang Bae
John Temples wrote: > I'm trying to capture some incoming HTTP connections with Wireshark > 0.99.8 on a Windows Server 2003 system. The only thing Wireshark > captures is the three packets in the three-way handshake of the TCP > connection; no other packets related to the connection are captured.

Re: [Wireshark-users] Wireshark doesnt recognize RTP packets when i decode

2008-03-05 Thread Fabiana moreno
Well it's my final year project and i need to analyse the QoS parameters when streaming over wireless lan. I'm streaming an mpeg4 video from a server to my client (the last one is the one where wireshark is installed) So im trying to to capture all the packets im getting when streaming. My server s

Re: [Wireshark-users] Wireshark doesnt recognize RTP packets when i decode

2008-03-05 Thread Jaap Keuter
Well, I dont' really understand what you do, but the PT=unknown is from the fact that this packet type is dynamically assigned, negotiated between parties. If Wireshark doesn't see the negotiations, it can't make out which codec goes with PT 96. So yes, it can happen you see this. Thanx, Jaap

Re: [Wireshark-users] Integrating a CORBA dissector

2008-03-05 Thread Jaap Keuter
Hi Benjamin, What this tool does is create a dissector module for you. So the resulting file, called packet-YourProtocolName.c, goes into epan/dissectors in your wirehshark build tree. The referenced Makefiles are also in that directory. Put the name of your dissector in between the others and h

[Wireshark-users] Wireshark doesnt recognize RTP packets when i decode

2008-03-05 Thread Fabiana moreno
hello!!! I'm streaming an mpeg4 video with darwin streamer server trhough my WLAN. I'm using wireshark to analyse the packets im receiving. I see TCP/RTSP packets but when i decode to UDP and then to RTP to anlyse it, wireshark shows the following in all the packets, here a sample: 340.253327

[Wireshark-users] Integrating a CORBA dissector

2008-03-05 Thread Ben B.
Hi there, At the moment I am trying to integrate a CORBA dissector. Using the instructions at http://www.wireshark.org/docs/wsug_html_chunked/AppToolsidl2wrs.html I produced a C file from the IDL. The next step is to build Wireshark with the new C file integrated. Here the instructions read: edi

Re: [Wireshark-users] filter for snmp doesn't work (also shows ICMP???)

2008-03-05 Thread leonardo . lagos
Jim, Thanks very much for your explanation. Precisely, it's a port unreachable message. I'll look further into it. Regards, Leo -Original Message- From: [EMAIL PROTECTED] [mailto:wireshark-users- [EMAIL PROTECTED] On Behalf Of Jim Young Sent: Wednesday, March 05, 2008 11:39 AM To: wir

Re: [Wireshark-users] IO Graphs cumulative plot

2008-03-05 Thread Stig Bjørlykke
2008/3/5, Stephen Fisher <[EMAIL PROTECTED]>: > On Wed, Mar 05, 2008 at 08:34:10PM +0100, Stig Bjørlykke wrote: > > > We already have the cumulative number of bytes in the frame dissector > > (used for the cumulative column), so it's just a matter of adding this > > as a generated frame field. >

Re: [Wireshark-users] IO Graphs cumulative plot

2008-03-05 Thread Stephen Fisher
On Wed, Mar 05, 2008 at 08:34:10PM +0100, Stig Bjørlykke wrote: > We already have the cumulative number of bytes in the frame dissector > (used for the cumulative column), so it's just a matter of adding this > as a generated frame field. Do we? The Cumulative Bytes column is pulled out of pi

Re: [Wireshark-users] IO Graphs cumulative plot

2008-03-05 Thread Stig Bjørlykke
On 5. mars. 2008, at 18.32, Stephen Fisher wrote: > On Wed, Mar 05, 2008 at 02:11:46PM +0100, Michele Pedrolli wrote: > >> Is there a way to plot this graph with IO Graphs? > > I don't think there is right now. There would have to be a frame > dissector field that stored the cumulative number of

Re: [Wireshark-users] filter for snmp doesn't work (also shows ICMP???)

2008-03-05 Thread Jim Young
>>> "Jim Young" <[EMAIL PROTECTED]> 03/05/08 12:39 PM >>> >>> <[EMAIL PROTECTED]> 03/05/08 12:07 PM >>> >> Hi, >> >> I have a capture file where I have added the following filter: >> >> ip.proto==0x11 and udp.port==162 >> >> This filter works, and show my SNMP traps, but also shows an ICMP > pa

Re: [Wireshark-users] filter for snmp doesn't work (also shows ICMP???)

2008-03-05 Thread Jim Young
Hello Leo, >>> <[EMAIL PROTECTED]> 03/05/08 12:07 PM >>> > Hi, > > I have a capture file where I have added the following filter: > > ip.proto==0x11 and udp.port==162 > > This filter works, and show my SNMP traps, but also shows an ICMP > packet.. However, ip.proto for ICMP is 0x01, not 0x11..

Re: [Wireshark-users] (no subject)

2008-03-05 Thread Stephen Fisher
On Wed, Mar 05, 2008 at 09:44:11AM -0400, bubba dudley wrote: > Hi, I noticed how one of my friends has been spying on me & tracking > what I am doing on the net. I know he is using a packet sniffer. So I > was wondering if this software can do that and or can protect me from > being watched. >

Re: [Wireshark-users] IO Graphs cumulative plot

2008-03-05 Thread Stephen Fisher
On Wed, Mar 05, 2008 at 02:11:46PM +0100, Michele Pedrolli wrote: > I was looking for a way to plot with IO Graphs a graph with cumulative > bytes lenght on Y axis. > I tried to manually define the unit of the Y axis using the 'Advanced' > feature, choosing from the Calc box the SUM(*) function

Re: [Wireshark-users] filter for snmp doesn't work (also shows ICMP???)

2008-03-05 Thread Sake Blok
On Wed, Mar 05, 2008 at 11:07:36AM -0600, [EMAIL PROTECTED] wrote: > Hi, > > I have a capture file where I have added the following filter: > > ip.proto==0x11 and udp.port==162 Actually, the filter udp.port==162 implies that the packet needs to contain udp traffic (ie ip.proto==0x11). So the fil

[Wireshark-users] filter for snmp doesn't work (also shows ICMP???)

2008-03-05 Thread leonardo . lagos
Hi, I have a capture file where I have added the following filter: ip.proto==0x11 and udp.port==162 This filter works, and show my SNMP traps, but also shows an ICMP packet.. However, ip.proto for ICMP is 0x01, not 0x11 I can attach screenshot if someone wants to have a better look... Reg

Re: [Wireshark-users] Fwd: Remote manager for wireshark dump?

2008-03-05 Thread Jason
flavio wrote: > Thanks for your reply, but it's not enough :-) > I can also use tshark -r file.pcap in order to open pcap file in an > ssh remote session but I cannot apply any filter to analyze it or make > some SIP call flow. > Maybe any advanced tool about does exist? man tshark tshark -r some

[Wireshark-users] (no subject)

2008-03-05 Thread bubba dudley
Hi, I noticed how one of my friends has been spying on me & tracking what I am doing on the net. I know he is using a packet sniffer. So I was wondering if this software can do that and or can protect me from being watched. We are not on the same network, I believe he bought one because usual

Re: [Wireshark-users] Fwd: Remote manager for wireshark dump?

2008-03-05 Thread flavio
Thanks for your reply, but it's not enough :-) I can also use tshark -r file.pcap in order to open pcap file in an ssh remote session but I cannot apply any filter to analyze it or make some SIP call flow. Maybe any advanced tool about does exist? Flavio 2008/3/5, Michele Pedrolli <[EMAIL PROTECT

Re: [Wireshark-users] Fwd: Remote manager for wireshark dump?

2008-03-05 Thread Michele Pedrolli
On Wed, March 5, 2008 3:00 pm, flavio wrote: > I've just a little question for you: can anyone indicate me some tool > to open wireshark dump file (i.e. .pcap files or .cap files) from > remote? You can open your dump files with 'tcpdump -r dumpfile' in a ssh remote session and then perform a

[Wireshark-users] Fwd: Remote manager for wireshark dump?

2008-03-05 Thread flavio
Hi to all, Anyone can help me about my question? Thanx a lot Flavio -- Forwarded message -- From: flavio <[EMAIL PROTECTED]> Date: 3-mar-2008 16.21 Subject: Remote manager for wireshark dump? To: wireshark-users@wireshark.org Hi to all, I'm a newbie for this list but I've plea

[Wireshark-users] IO Graphs cumulative plot

2008-03-05 Thread Michele Pedrolli
Hi, I was looking for a way to plot with IO Graphs a graph with cumulative bytes lenght on Y axis. I tried to manually define the unit of the Y axis using the 'Advanced' feature, choosing from the Calc box the SUM(*) function for the "frame.len" field. But I wasn't able to obtain the desired cumula

[Wireshark-users] Fwd: capturing data when streaming, help please

2008-03-05 Thread Fabiana moreno
Hi all I am writting because I need help using wireshar, im still a bit confused with the software and im totally new Well this is my case - I am streaming an mpeg-4 video over a WLAN which wireshark is capturing all package when the streaming is on (im running wireshark on my client computer) - I

Re: [Wireshark-users] wimax question

2008-03-05 Thread Martin Mathieson
Hi, The M2M plugin has been part of Wireshark since at least 0.99.7. The M2M plugin will only work for you if your equipment is framing the WiMAX traffic over ethernet using the simple ethernet protocol that M2M/Intel uses. Otherwise, you'll need to find out how your messages are framed over eth