Content that refers to the Wireshark packet analysis tool.
Post Views: 1,663 Adaptive Bitrate Streaming (ABR) is a video delivery method that dynamically adjusts the quality of a stream in real time based on three things: network conditions, device capability, and player performance. Instead of delivering a single fixed-quality, and therefore fixed transfer rate video, ABR continuously selects the most appropriate bitrate to maintain
What Is Adaptive Bitrate Streaming (ABR)? Read More »
Post Views: 871 The following is a step by step lab exercise to examine ABR – Adaptive Bit Rate used in modern video content delivery. I won’t explain ABR here – you can read about ABR and what it is, and how it works here in a recent post. We will analyze a synthetic but
A Synthetic ABR Lab Exercise Read More »
Post Views: 3,529 Most people do not know this, but TCP CUBIC is the dominant congestion control algorithm used in modern TCP/IP networks. It is designed to efficiently utilize high-speed, long-distance links while maintaining fairness across flows with different round-trip times (RTTs). Today, it is the default congestion control algorithm in most Linux systems, and
What is TCP CUBIC and Why so popular? Read More »
Post Views: 2,517 I have been teaching Wireshark classes since the early 2000’s, and using it since it was called Ethereal. My usage has primarily focused around troubleshooting network issues that have a packet capture associated with them. My fellow troubleshooters will tell you that this is not always the case. But, if we are
Create your own Wireshark Labs with AI Read More »
Post Views: 1,820 Check out these great references as well: Our custom profiles repository for Wireshark Our Udemy course on Wireshark Our Udemy course on Wireless Packet capture In our previous post I showed you how to use Wireshark’s Ring Buffer feature. I think we can all agree how great that feature is. In this
Combining Wireshark Ring Buffers with Capture Filters for Performance Read More »
Post Views: 3,536 Check out these great references: Our custom profiles repository for Wireshark Our Udemy course on Wireshark Our Udemy course on Wireless Packet capture Wireshark’s Ring Buffer feature is a capture mechanism feature that automatically rotates packet capture files based on size or time limits, overwriting the oldest files when a defined limit
Wireshark Ring Buffer Capture Feature Read More »
Post Views: 2,192 I provide this information for reference when examining TLS in Wireshark. The TLS 1.2 protocol ladder (also called the TLS handshake ladder) describes the step-by-step sequence of message exchanges between a client and server as they negotiate a secure, encrypted connection. Think of it as a “ladder” where each side alternates rungs
The TLS 1.2 Protocol Ladder Read More »
Post Views: 9,385 Using a loopback adapter (also called a local loopback interface) for packet capture in Wireshark allows you to capture traffic that stays within your own computer — for example, packets exchanged between local applications via localhost or 127.0.0.1. Normally, this traffic never reaches a physical network interface, so a loopback capture is
What is the Adapter for loopback traffic capture in Wireshark? Read More »
Post Views: 4,612 Many technicians and network engineering staff, as well as IT staff, often need to “tap” into the Ethernet to capture and troubleshoot network traffic. A full-duplex tap (also called a network tap) is a hardware device placed inline on an Ethernet link that allows network engineers to capture all traffic traveling in
Ethernet Taps to Capture Network Traffic Read More »
Post Views: 7,472 I am a ChatGPT subscriber to the basic (not PRO) service. I saw the following post on LinkedIn and was fascinated: Think about the implications. You don’t need to know how to use Wireshark other than to do a capture. You certainly don’t need to know how to troubleshoot packet captures as
Can ChatGPT 5 analyze PCAP’s? Read More »
Post Views: 3,054 Great question. In one sentence it is a purple tool, meaning both! Wireshark itself is a passive tool, it is non-intrusive — it doesn’t create attacks — but it’s a force multiplier for both Red and Blue Teams depending on who controls the capture point and how the data is used. Let
Is Wireshark a Red Team or Blue Team Tool? Read More »
Post Views: 3,855 RFMON stands for Radio Frequency MONitor mode. It is a special mode for wireless network interfaces that allows a device to capture all radio traffic it can receive on a wireless channel, regardless of the intended recipient. All Wi-Fi radios can go into different modes, but that does not mean you can
Post Views: 3,704 As a frequent reader here will know, my Wi-Fi Analyzer of choice is called WinFi. It has been around many years as is fabulous. In version 2, and the new version 3, you can capture Wi-Fi Beacon Frames and examine them. This post will explain what you can capture and how this
Capturing Wi-Fi Beacon Frames with WinFi Read More »
Post Views: 48,386 In this tutorial I am going to make you a pro at using and leveraging the Wireshark TCP Graphing tools. As many of you who have taken my Wireshark Courses know, I am a big fan of visualizing what is going on in a given packet capture or conversation. My #2 troubleshooting
Zero to Hero with Wireshark TCP Graphs: A Tutorial Read More »
Post Views: 14,151 A Wireshark TCP Analysis Flags cheat sheet is essential because TCP is the foundation of most modern network communications, and Wireshark’s built-in TCP Analysis engine automatically identifies performance problems, retransmissions, latency conditions, packet loss, flow-control issues, and connection anomalies that would otherwise require deep manual packet inspection. For many users, the TCP
Wireshark TCP Analysis Flags Cheat Sheet Read More »
