Follow-up to my post a couple of weeks ago about a 2.5 GB PCAP that took 6-7 hours to process. Streaming tshark's output into Go got it to 70 minutes, but it was still single-threaded. The most common response here was: why not just add goroutines?

Turns out you can't, and the reason is that tshark's dissection is linear state. What it reads in one packet determines how it decodes the next — TCP reassembly, connection tracking, anything under tcp.analysis.* reads and updates shared conversation tables as it goes. Strict ordering isn't a design choice, it's what dissection requires. Goroutines on the consuming side don't help because the bottleneck was never there.

So the concurrency has to happen before tshark sees the file. Not by splitting on size — a TCP stream cut mid-conversation loses the state the dissector needs — but by session, so each chunk holds complete conversations and nothing crosses a boundary. Then N tshark processes run in parallel.

The detour: I was using PcapSplitter from PcapPlusPlus in connection mode, which holds one output file open per flow. At 95-125 flows it started producing corrupted output. Two distinct failure signatures, reproduced on master and v25.05, on both pcapng and legacy pcap. pcapfix said the source was clean. Reimplemented the split in-process with gopacket and it went away.

Honest ending: splitting only triggers above 100k packets, and 3 of the 57 files this pipeline actually handles cross that threshold.

Full writeup: https://robinhayer.dev/concurrency-without-a-parallel-parser

Hi,

I'm looking to study for the WCA course, to gain a better understanding of how Wireshark works and how it can be better utilised to help in my day to day job as a Network Engineer.

Wireshark's website states that the test costs approx $349 per attempt but I'm looking for a 'package' which includes training material and the exam as well.

Is anyone able to advise on a route to take with this? Any solid recommendation for learning material, if a package doesn't exist?

Thanks

I'm running Wireshark 4.7.2 on Arch Linux, and I was noticing that it is somehow able to decrypt the TLS Client Hellos of QUIC packets sent and received by Firefox while browsing the web.

I thought QUIC headers were encrypted, and I don't think I gave Wireshark any encryption keys for QUIC. How is Wireshark decrypting these headers?

Hi everyone,

I’ve been developing Pcap Flow Lab, an open-source PCAP/PCAPNG analyzer built around a flow-based workflow.

GitHub: https://github.com/AlexeyVasilev/PcapFlowLab

Instead of starting from a flat packet list, Pcap Flow Lab indexes a capture into flows first. From there, you can narrow down the traffic you care about and inspect packets, reconstructed TCP streams, structured protocol details, bytes, and statistics.

The project originally grew out of working with larger captures, where I wanted a faster way to reduce the dataset to the flows of interest before going deeper.

Current features include:

• reusable capture indexes;
• flow-based navigation;
• protocol-path analysis for nested and tunneled traffic;
• TCP stream reconstruction;
• structured packet and stream summaries;
• TLS and QUIC inspection;
• statistics views;
• CLI support.

The analysis backend is written in C++, and the main desktop UI is currently built with Qt.

I don’t see it as a replacement for Wireshark. I use Wireshark extensively, and I see Pcap Flow Lab as a complementary tool with a different workflow: first narrow the capture by flows, then drill into the packets and protocols that matter.

I’d especially appreciate feedback from experienced Wireshark users:

• Does a flow-first workflow like this solve any problems you run into with captures?
• What would you expect a complementary tool like this to do particularly well?
• Are there parts of the presentation or workflow that you think should be different?

Technical feedback is very welcome.

If you’ve spent years working with web applications, APIs, and load balancers, you’re probably used to the classic HTTP verbs: GET, POST, PUT, DELETE, and a few others. In 2026, the IETF officially added a new method called QUERY, and it’s a bigger deal than it sounds. 

https://www.lovemytool.com/2026/08/http-gets-new-method-what-you-need-to.html

Using Wireshark to Analyze PowerShell Test-Connection

If you’ve ever run PowerShell’s `Test-Connection` command and wondered what is actually happening on the network, Wireshark is the perfect tool to answer that question.

And

#netscout What does a resilient cybersecurity strategy actually look like?

https://www.lovemytool.com/2026/08/using-wireshark-to-analyze-powershell.html

 r/wireshark

A few years ago I used to be able to see detailed breakdown of Ethernet UDS traffic in Wireshark traces. I could see the commands identified in the main table (TesterPresent, RoutineControl, TransferData, etc) and a thorough breakdown of different data fields in multiple layers in the bottom-left pane. Now there's almost nothing.

This is from a pcapng that I too in October 2021. I know for a fact that I got a detailed breakdown for this because I took these traces myself and used them to help develop one of our programs here at work. and now that same file (and every other one from back then that I've tried) is breaking down nothing.

It's been a few years since I did that work, and now that I'm going to be working on something similar I tried to dust these off for to refresh my memory of some things and they are not helpful at all.

I don't know if this is something that happened because of updates in the 5 years since these traces were made or something I might have done. Other than doing the software updates the biggest change I can remember making was installing an Intrepid plugin ICS CAP (https://intrepidcs.com/products/software/ics-cap/) so I could use Wireshark with their hardware for CAN and LIN traces. Could the plugin have screwed with some things? I've tried searching documentation and google for answers but it's hard to find anything when you don't even know if you're wording your search correctly. Does anyone know what I can try?

Edit: forgot which menu, but enabling all protocols worked. Don't know how since I checked before that Doip and UDS were both already selected, but it did.

I am working in a manufacturing plant and this weekend while they were not in production, I installed a SharkTap between the PLC and a managed switch. I tested the WireShark and was able to see communication to and from the PLC.

Now that they are in production, every capture I take is only seeing the communication From the PLC. I know that the PLC is receiving packet because stuff is working.

I have tried 2 different computers to run the WireShark. Both computer with Windows 11. The SharkTap is connected to a Gigabit Wired Tap Port. I have also replaced the Tap Port Network Cable.

Does anyone have any suggestions or thoughts?

Hello,

I'm trying to use wireshark to learn more about the communication between some of my company's proprietary software and some of their hardware. (Because it's my company's stuff, I'd rather not share the raw capture.) I thought this might be faster than finding out through my own company because I've previously found that they don't like to share source code or design details across departments. I've exported a wireshark capture to csv because I'm new to using wireshark and it was easier for me to browse that way. I used this command:

tshark.exe -r "input.pcapng" -T fields -e frame.number -e frame.time_relative -e ip.src -e ip.dst -e frame.len -e data.data -e tcp.payload -e udp.payload -E header=y -E separator=, > "output.csv"

The problem is, for most of the data frames, the "length" of the frame is not matching the raw data that I'm seeing. For example, there are many rows where "tcp.payload" is completely blank, but "frame.len" isn't 0, so that tells me there's something missing. I want to make sure I'm really capturing all communciation between the hardware unit and the laptop running the software. How can I make sure I'm really seeing everything? (After error correction has been performed.)

I'm really just looking to see that the frame length matches the raw data I have.

Also, if it's not obvious already, I'm very new to using this program, so if anyone else has experience with what I described in the title, (reverse engineering with little outside info), I'd very much like to hear about it.

Thanks!

I had a Go CLI that wrapped tshark for PCAP analysis. Worked fine until I hit a 2.5 GB file — 1.9 million packets, 6-7 hours, then OOM crashes.

Two problems, found in sequence.

First, I was running three separate tshark queries against the same file (analytics, rows, full dissection). Three full passes over 2.5 GB. Consolidating them into one query took it to 1-2 hours.

The OOM was still there though, because I was asking for full JSON dissection — tshark building the whole output in memory, then my program parsing all of it in memory. So I piped tshark's stdout directly into my program's stdin and switched to -T fields/-T ek with only the fields I needed. Memory went flat, processing dropped to ~70 minutes.

Still single-threaded, which is the next problem. Curious whether anyone's found a good approach for parallelising tshark work beyond splitting the input file.

Full writeup: https://robinhayer.dev/the-2-5-gb-wall

Hi everyone,

I'm hoping somebody with strong Layer 2/Wireshark experience might be able to take a look at the attached packet capture and point me in the right direction.

We've been chasing a very strange issue for several months and have now narrowed it down to what appears to be an interaction between Paxton Net2 door controllers and Ruijie managed switches.

Network

The production network is a fairly large corporate Ethernet network consisting of:

• Paxton Net2 access control
• Motorola CCTV
• Windows servers
• Multiple managed switches
• Static IP addressing for the Paxton equipment

Everything had been operating correctly until we expanded the access control system using additional Ruijie managed switches and newer Paxton Net2 Plus door controllers.

The problem

Only certain Paxton Net2 Plus controllers are affected. Interestingly, they all appear to be newer hardware (serial numbers beginning with "9"). Older controllers continue to operate normally.

The affected controllers:

• Connect to the network successfully.
• Respond to ARP and ICMP.
• Connect to the Net2 server without issue.
• Download their configuration correctly.
• Remain online for approximately 4–5 minutes.
• Then disappear completely from the network.

Once the fault occurs:

• The controller no longer responds to ARP.
• It cannot be pinged.
• Net2 reports it as offline.
• The Ethernet link LEDs remain illuminated.
• A power cycle immediately restores operation, but only for another 4–5 minutes before the fault repeats.

What we've already ruled out

We've spent a considerable amount of time narrowing this down.

The exact same controller will operate indefinitely when:

• Connected directly to a laptop.
• Connected through alternative managed switches.
• Connected through a simple unmanaged switch.

The problem only occurs when connected through our Ruijie switch infrastructure.

To confirm this, we completely removed the Ruijie switches from site and replaced them with another manufacturer's managed switches. This immediately resolved the issue on the live system.

We then recreated the problem back at our office.

Test setup used for the attached capture

The attached Wireshark capture was taken on a completely isolated test network.

The setup consisted of:

• Eight Ruijie managed switches connected together exactly as they would be in the field.
• Laptop connected at one end.
• Single Paxton Net2 Plus ACU connected at the opposite end.
• No internet connection.
• No wireless.
• No other network devices.
• Static IP addressing only.

Laptop:
192.168.81.200

Paxton ACU:
192.168.81.57

The only devices on the network were the laptop and the ACU, connected through the Ruijie switches.

Packet capture

Wireshark was started before the controller connected.

The capture therefore contains:

1. Initial discovery and successful connection.
2. Normal operation for approximately 4–5 minutes.
3. Controller disappearing from the network.
4. Manual power cycle of the controller.
5. Successful reconnection.
6. Approximately another 4–5 minutes of operation.
7. Second failure.

The second failure occurs at approximately packet 8187.

At this point the controller simply disappears from the network until it is power cycled.

What I'm hoping someone can help identify

I'm not looking for general troubleshooting advice—we've already confirmed the issue only exists when the controller is connected through the Ruijie switches.

Instead, I'm hoping somebody experienced with Wireshark or Layer 2 switching can identify whether there is something in the capture that stands out, such as:

• STP/RSTP events
• RLDP or proprietary Ruijie traffic
• ARP issues
• Broadcast or multicast behaviour
• TCP anomalies
• Any packets that could cause an embedded Ethernet stack to stop responding
• Anything else unusual around the point the controller drops offline

We're particularly interested in understanding whether there is a specific protocol or switch feature that could be triggering the issue, so that we can either disable it or report it to Ruijie and/or Paxton.

Any observations or ideas would be hugely appreciated.

Thanks very much for taking the time to look.

If I eg open yt on the pc I have wireshark on it detects it but if I open yt on my phone it’s like it never happens what to do?

I have a question about network security.

Someone is connected to my Wi-Fi network, but they do not have access to my router admin page (192.168.1.1). I am worried they may be using Android tools or apps such as NetCut or other network monitoring tools.

I want to understand what they can realistically see:

If they use tools like NetCut, ARP spoofing, or other Android network tools, can they see the websites I visit?

Can they see my Google searches, or only the domain names (for example, seeing "google.com" or "youtube.com")?

If I visit an HTTPS website, what information is still visible to someone on the same Wi-Fi?

Would using a VPN completely hide my browsing activity from someone on the same network?

What are the best ways to detect if someone is trying to intercept my traffic?

I am trying to understand the real risks, not just theoretical attacks. Thanks.

Core question: What'd be the recommended setup to audit network traffic of an app within Windows sandbox?

So far I've only considered applying filter to ignore DNS and some Windows domains/IPs. As far as I know, Wireshark doesn't allow filtering by PID, so I may look into other methods available. ARP scans might be another potential filter I am considering, although I am also considering the fact an app may try to do network discovery when it shouldn't.

Don't need an in-depth method, just "good enough" approach.

I have a weird problem with tshark and was wondering if anyone had any ideas or has experienced something similar:

I have a .bat file with a 10 min tshark command in it. A SQL agent job runs this .bat file every 10 min from 18:00 - 18:40 and then again from 01:30 - 03:50.

4 log files are saved from the 18:00 window, but none from the early morning window. All SQL agent jobs end reporting success. Having /wait in the .bat file and saving output and errors shows no errors. I output the errorlevel and see it's 0 for all instances. Windows event logs show no errors or warnings.

TLDR: Same .bat file will produce logs at one time of day, but not another. Any ideas?

.bat Tshark command:

start "" "<RedactedDirectoryPath>tshark.exe -i 2 -a duration:600 -w <RedactedDirectoryPath>capture%TIMESTAMP%.pcap.gz --compress gzip -Q

EDIT: Solved. The time stamp was putting a space into the filename for hours before 10am.

I'm dealing with a fairly bespoke protocol for an application I deal with at work (it's closed-source so I cannot really give specific details) that is able to provide a lot of extra data in pcaps, but it dumps them all to comments rather than any sort of additional annotations as a packet field.

Given that the way the comments are structured, which is very JSON-like, I should be able to use tshark to convert them into a data structure I can tack onto every given packet they're applied to, but now I'm wondering how difficult it'd be to actually write or (being honest here) hack together with some genAI.

Has anyone here ever written any themselves and can at least point me in the direction of some good reference resources on dissectors in general? I'm not sure if this would even need to be written in C++ or LUA, so anything helps.

Since I got deep into CDP I noticed that I needed to update the repository profiles related to TCP. If you do any TCP troubleshooting like 3WHS analysis, SACK Analysis, SEQ Analysis, or just TCP troubleshooting in general, there are specific profiles that focus on these tasks so you as a Wireshark user can focus as well. Trying to do all this with a single profile is futile for me at least.

I start with the troubleshooting one, and then use the other afterwards.

Look if you like them - great. If you make them better, or you find they are missing something - please let me know. You will find them all in the repository: https://www.cellstream.com/wireshark-profiles-repository/

Went into an Enterprise Network with primarily Cisco Devices and they never knew how much information on their devices could be gleaned from CDP. I ended up really editing my basic CDP profile so they could leverage packet capture and network identification thanks to this great protocol. They loved it, and now you can too!
You will find it in the Wireshark Profiles Repository I started years ago: https://www.cellstream.com/wireshark-profiles-repository/ probably at the bottom of the list.

Enjoy!

Can someone teach me wireshark? Or how to learn it? Where to begin?

hello, I use the internet in Korea. I don't know why people keep asking about 172.30.1.60.

I would appreciate it if you could let me know if you have any good ideas.

Hi everyone,

I recently finished building a DoS & Simulated DDoS lab to better understand how different attacks affect a target service and how they appear in Wireshark.

The lab uses Kali Linux as the attacker and Metasploitable2 as the target. I tested ICMP, SYN, HTTP, TCP, and Ping of Death attacks, then repeated each one using multiple concurrent tmux sessions to simulate higher traffic volume from a single host.

I documented the entire project with screenshots, packet captures, diagrams, and traffic analysis for every stage.

One of the most interesting parts was comparing the captures from the single source DoS attacks with the simulated DDoS stages and seeing how the traffic patterns changed.

I'd appreciate any feedback or suggestions.

🔗 GitHub: https://github.com/yusuf-husayn/dos-ddos-lab

Thanks!

Hi everyone,

I'm trying to capture 802.11 management frames on my own WiFi network to inspect the RSN Information Element (specifically to check whether PMF / 802.11w is enabled).

My setup:

• MacBook Pro (Apple Silicon)
• macOS 26.3 (Tahoe)
• Broadcom BCM4388
• Wireshark 4.6.6
• ChmodBPF installed
• User is in the access_bpf group

Everything appears to be configured correctly.

wdutil info reports:

• Connected to my WiFi (WPA2 Personal)
• RSSI around -60 dBm
• Channel 153 (5 GHz)
• Sniffer Supported: YES

Wireshark allows me to enable Monitor Mode and sets the link-layer header to:

802.11 plus radiotap header

tcpdump also reports:

sudo tcpdump -I -i en0

Output:

listening on en0, link-type IEEE802_11_RADIO (802.11 plus radiotap header)

However, after waiting 30+ seconds:

0 packets captured
0 packets received by filter
0 packets dropped by kernel

No Beacons.
No Probe Requests.
No Probe Responses.
Nothing.

Things I've already verified:

• ChmodBPF installed correctly
• /dev/bpf* permissions are correct
• My user belongs to access_bpf
• Same behavior with both Wireshark and tcpdump
• Same behavior with NordVPN completely disabled
• I can ping my gateway normally
• tcpdump -D correctly shows:

​

en0 [Up, Running, Wireless, Associated]

At this point I'm wondering if this is:

• a macOS 26 limitation,
• a Broadcom BCM4388 driver limitation,
• a Wireshark/libpcap issue,
• or if Apple has effectively disabled monitor mode packet delivery on recent Apple Silicon Macs.

Has anyone successfully captured raw 802.11 frames on macOS 26 using the built-in WiFi adapter?

I'd really appreciate any insight. Thanks!

Hi,
I’m currently working on a PLC discovery/fingerprinting project and I’m analyzing PROFINET traffic with Wireshark.

Using the pn_dcp filter, I can see the PROFINET DCP Identify Request/Response packets and retrieve basic information such as:

• NameOfStation
• IP address
• subnet/gateway
• Vendor ID
• Device ID
• Device role
• generic device family, for example S7-1200

I would like to understand whether it is possible, through PROFINET traffic in Wireshark, to obtain more detailed PLC information such as:

• exact CPU model
• Siemens article/order number, for example 6ES7...
• firmware version
• hardware version
• serial number
• module identification data

From what I have seen so far, PROFINET DCP seems to provide mainly discovery and network configuration information, while more detailed CPU data may require S7/S7CommPlus communication over TCP port 102.

Could you confirm whether these detailed PLC identification fields can be obtained via PROFINET alone, or whether they must be retrieved through S7/S7CommPlus or TIA Portal diagnostic communication?