Is this you? As a journalist, you can create a free Muck Rack account to customize your profile, list your contact preferences, and upload a portfolio of your best work.
Claim your profile
Articles by Timmy Brolin
90GB pcap file get last frame time stamp
Wireshark mailing list archives By Date By Thread Re: 90GB pcap file get last frame time stamp From: Timmy Brolin <tib () hms se> Date: Fri, 26 Feb 2021 17:50:14 +0000 The pcapng file format supports "backwards" reading.
pcapng decoding error when preamble is shortened
Wireshark mailing list archives By Date By Thread Re: pcapng decoding error when preamble is shortened From: Timmy Brolin <tib () hms se> Date: Mon, 22 Feb 2021 02:09:22 +0000 It’s not a matter of *what* the program is reading, but *where* it's reading in the buffer. This makes it usable for *all* programs reading this file format, not just Wireshark. Prefixing it with zero padding (even a nibble) would achieve that.
pcapng decoding error when preamble is shortened
Wireshark mailing list archives By Date By Thread Re: pcapng decoding error when preamble is shortened From: Timmy Brolin <tib () hms se> Date: Thu, 18 Feb 2021 09:27:00 +0000 In practice, this is what I would propose: * Wireshark dissector made capable of accepting any whole-byte preamble length mPackets. * mPacket capture devices are made responsible for detecting any frames with non-integer preamble, and correct for it by adding 4 bits extra preamble at the beginning.
pcapng decoding error when preamble is shortened
Wireshark mailing list archives By Date By Thread Re: pcapng decoding error when preamble is shortened From: Timmy Brolin <tib () hms se> Date: Wed, 17 Feb 2021 20:43:25 +0000 I have submitted a proposal here: https://gitlab.com/wireshark/wireshark/-/merge_requests/2137 * Added support for dissecting mPackets with arbitrary preamble length, in accordance with IEEE 802.3br-2016 Changed fpp.preamble type from FT_UINT64 to FT_BYTES * Use PACK_FLAGS_UNALIGNED_FRAME to signal non-integer preamble...
pcapng decoding error when preamble is shortened
Wireshark mailing list archives By Date By Thread Re: pcapng decoding error when preamble is shortened From: Timmy Brolin <tib () hms se> Date: Tue, 16 Feb 2021 12:03:24 +0000 Section 12.9.2 "DTE timing" of IEEE Std 802.3-2018 says: DTEs shall correctly receive frames that are preceded by 13 or more bits of preamble plus 8 bits of <sfd>.
pcapng decoding error when preamble is shortened
Wireshark mailing list archives By Date By Thread Re: pcapng decoding error when preamble is shortened From: Timmy Brolin <tib () hms se> Date: Tue, 16 Feb 2021 09:05:40 +0000 Hi, Would anyone mind if I submit a merge request which makes Wireshark capable of dissecting all valid Ethernet mPackets according to IEEE 802.3br? It is a reasonably small change. But I don’t want to put in the effort if the merge request would be blocked.
pcapng decoding error when preamble is shortened
Wireshark mailing list archives By Date By Thread Re: pcapng decoding error when preamble is shortened From: Timmy Brolin <tib () hms se> Date: Sat, 13 Feb 2021 23:57:18 +0000 Yes, the capture device is indeed capturing data completely accurately. You are referring to the transmission section of IEEE 802.3br-2016. If you look at the receive section on page 51, you will find that receivers are required to accept any length preamble.
How to properly finalize capture in a Wireshark extcap plugin?
Wireshark mailing list archives By Date By Thread Re: How to properly finalize capture in a Wireshark extcap plugin? From: Timmy Brolin <tib () hms se> Date: Thu, 11 Feb 2021 16:41:36 +0000 Proposed solution I have investigated this in more depth and found that Wireshark simply does not do any kind of graceful termination of extcaps. It always kills extcaps forcefully, which causes loss of data on the capture pipe.
pcapng decoding error when preamble is shortened
Wireshark mailing list archives By Date By Thread pcapng decoding error when preamble is shortened From: Timmy Brolin <tib () hms se> Date: Tue, 9 Feb 2021 10:21:39 +0000 Hi, It seems Wireshark fails to decode captured packets with shortened preamble? Normally Ethernet packets have a preamble and SFD like this: 55555555555555D5 But during transmission over Ethernet, sometimes the preamble arrives slightly shorter at the receiving end.
How to properly finalize capture in a Wireshark extcap plugin?
Wireshark mailing list archives By Date By Thread Re: How to properly finalize capture in a Wireshark extcap plugin? From: Timmy Brolin <tib () hms se> Date: Tue, 24 Nov 2020 08:44:07 +0000 There seems to exist several alternative ways of doing it in Windows. Such as sending WM_QUIT or WM_CLOSE on the message queue, This assumes that the program you're trying to tell to terminate *has* a message queue to which it pays attention.
How to properly finalize capture in a Wireshark extcap plugin?
Wireshark mailing list archives By Date By Thread How to properly finalize capture in a Wireshark extcap plugin? From: Timmy Brolin <tib () hms se> Date: Mon, 23 Nov 2020 09:30:52 +0000 I am writing a extcap plugin for Wireshark (Windows version). The documentation on how Wireshark stops a extcap capture is a bit sketchy, but it seems it simply terminates the extcap plugin. If I run the extcap binary standalone, and stops it with Ctrl+C, everything works as expected.
Show More
loading
Actions
Is this you?
As a journalist, you can create a free Muck Rack account to customize your profile, list your contact preferences, and upload a portfolio of your best work.Get in touch with Timmy
Contact Timmy, search articles and posts on X, monitor coverage, and track replies from one place.
Learn more about Muck Rack