Author name: Andrew Walding

Andrew Walding is the founder and president of CellStream, Inc., bringing more than 30 years of experience in telecommunications, broadband networking, Internet technologies, and technical education. His expertise spans network engineering, wireless and wireline communications, packet analysis, network operations, emerging technologies, and the design and delivery of advanced technical training programs. A Cisco-certified professional, IPv6-certified specialist, and CBRS Certified Professional Installer (CPI), he helps organizations and technology professionals understand, deploy, troubleshoot, and optimize modern communications networks.

What Can Wireshark Really Tell You About an Encrypted Signal Conversation?

Networking and Computing Tips and Tricks / By

Post Views: 624 Signal has a well-earned reputation as a secure messaging application. Messages, voice calls, video calls, files, and other Signal-to-Signal communications are protected using end-to-end encryption. Signal states that message and call contents cannot be accessed by Signal or other third parties because the communications are always end-to-end encrypted. So that raises an

What Can Wireshark Really Tell You About an Encrypted Signal Conversation? Read More »

, , , , ,

Why Your Wireshark Filter May Not Mean What You Think It Means

Networking and Computing Tips and Tricks / By

Post Views: 362 Wireshark display filters can look deceptively simple. For example: tcp.port > 1024 seems obvious. But a TCP packet normally has two port values: a source port and a destination port. That means Wireshark may be evaluating more than one value when you write a filter. Consider: This packet satisfies: tcp.port > 1024

Why Your Wireshark Filter May Not Mean What You Think It Means Read More »

, ,

The FAA Had a Backup Fiber Path. So Why Did Air Traffic Still Go Dark?

The CellStream Blog / By

Post Views: 605 Yesterday (9/21/2026) provided one of those networking lessons that is difficult to ignore. A telecommunications failure disrupted air traffic across one of the busiest regions in the United States. Flights were stopped or delayed at Newark Liberty, JFK, LaGuardia, Philadelphia and other airports after communications problems developed at the FAA’s Philadelphia Terminal

The FAA Had a Backup Fiber Path. So Why Did Air Traffic Still Go Dark? Read More »

, , , ,

Stop Rating Technical Training Like an Uber Ride

The CellStream Blog / By

Post Views: 210 I recently made this comment about teaching: When you teach classes on highly technical subjects with hands-on labs, you get evaluated every class. That can be two times a week. Evaluations are from people you have just met. Evaluations are specific to the class and content being taught, and are heavily influenced

Stop Rating Technical Training Like an Uber Ride Read More »

, , ,

10 Wireshark Display Filter Functions You’re Probably Not Using

Networking and Computing Tips and Tricks / By

Post Views: 346 Most Wireshark users learn display filters by comparing a field to a value: ip.addr == 192.168.1.10 tcp.port == 443 dns.qry.name contains “example” But modern Wireshark display filters can do much more than simple comparisons. The filter language includes functions that can measure field lengths, count repeated fields, manipulate text, compare values, and

10 Wireshark Display Filter Functions You’re Probably Not Using Read More »

, , ,

Synchronize Two Wireshark Captures by Correcting Clock Drift

Networking and Computing Tips and Tricks / By

Post Views: 533 I discussed correlating packet captures from multiple capture points last week. In that post, one of the things I promised was to dive deeper into clock offsets and clock drift. When troubleshooting from more than one capture point, it is common to compare traffic from places such as: Before those captures can

Synchronize Two Wireshark Captures by Correcting Clock Drift Read More »

, , , ,

Wireshark’s Slice Operator: Search Exact Bytes Without Writing a Dissector

Networking and Computing Tips and Tricks / By

Post Views: 469 Wireshark gives us thousands of protocol fields to filter on: But what happens when the exact information you want isn’t exposed as a field? That is where Wireshark’s Slice Operator becomes extremely useful. A slice lets you select specific bytes from a field, payload, protocol, or even the captured frame itself. For

Wireshark’s Slice Operator: Search Exact Bytes Without Writing a Dissector Read More »

, , , ,

Correlating Multiple Wireshark Captures: Follow the Same Packet Across the Network

Networking and Computing Tips and Tricks / By

Post Views: 646 So many times I have watched YouTube videos and read articles that jump right into Wireshark troubleshooting of multiple captures of a network conversation or event from multiple points in the network. To me, that can be unnecessarily overwhelming to those learning packet capture. In many videos, it never becomes clear why

Correlating Multiple Wireshark Captures: Follow the Same Packet Across the Network Read More »

, ,

sngrep: The SIP Troubleshooting Tool You Should Know

Networking and Computing Tips and Tricks / By

Post Views: 486 If you work with VoIP, and more specifically SIP long enough, eventually you find yourself staring at an INVITE, a handful of provisional responses, several IP addresses, a 200 OK, an ACK, and perhaps a BYE—and trying to mentally reconstruct what actually happened. Wireshark can certainly do this. In fact, Wireshark remains

sngrep: The SIP Troubleshooting Tool You Should Know Read More »

, , , , , , ,

Turn Wireshark Columns into Calculated Network Analytics

Networking and Computing Tips and Tricks / By

Post Views: 332 Most Wireshark users eventually discover Custom Columns. Instead of being limited to the standard Source, Destination, Protocol, Length, and Info columns, you can add useful fields such as: tcp.stream tcp.analysis.ack_rtt dns.qry.name vlan.id That alone can make packet analysis much easier. But in newer versions of Wireshark, Custom Columns can do much more

Turn Wireshark Columns into Calculated Network Analytics Read More »

, , ,

Native VLAN vs. Normal VLAN: What Is the Difference on a Cisco Switch?

Frequently Asked Questions / By

Post Views: 678 This is a great question that is answered in my courses that teach L2 Ethernet, but I have never answered here. So let’s dive in. VLANs are one of the fundamental building blocks of Ethernet switching. They allow us to divide a physical switched network into multiple logical Layer 2 broadcast domains.

Native VLAN vs. Normal VLAN: What Is the Difference on a Cisco Switch? Read More »

, , , , , , , , ,

The Wireshark # Operator: Filter the Inner vs. Outer IP Header

The CellStream Blog / By

Post Views: 704 Most Wireshark filters assume there is only one IP header in a packet. For example: ip.src == 10.1.1.10 works perfectly well in ordinary traffic. But what happens when the packet contains more than one IP header? That is common with technologies such as: A tunneled packet might look like this structure: Now

The Wireshark # Operator: Filter the Inner vs. Outer IP Header Read More »

, , , , ,

Where can I get PCAP Packet Captures for Learning and Exploration?

Frequently Asked Questions / By

Post Views: 7,202 I am often asked this question of where to access PCAP or PCAP-NG files so that folks can explore packet captures using Wireshark.  I have always provided these resources in my Wireshark classes at the Online School, but thought I should also just list them here for public consumption. Before you click!

Where can I get PCAP Packet Captures for Learning and Exploration? Read More »

, , , ,

The Wireshark $ Operator: Build Filters Around the Packet You Click

Networking and Computing Tips and Tricks / By

Post Views: 928 Most Wireshark display filters use values that you type manually. For example: ip.addr == 192.168.1.100 or: tcp.stream == 14 But Wireshark has a lesser-known capability that lets you build a filter using values from the packet you currently have selected. That capability is called a field reference, and it uses the $

The Wireshark $ Operator: Build Filters Around the Packet You Click Read More »

, , ,
Scroll to Top