Vladimir

Wireshark, Networking

[Vladimir @Packet_vlad]

@majornetwork @rknall @PacketBomb @alagoutte @SimonLindermann @packetpioneer All sessions from Chris Greer @packetpioneer : comprehensive and structured approach

[Vladimir @Packet_vlad]

@Profitap And now PRO question: can you solve this task *without* looking on MSS field (there is one more sign leading to the same conclusion)?

#wireshark @SYNbit

[Vladimir @Packet_vlad]

@SYNbit @editingemily Cool try, but no, I won't disclose mine 😀

[Vladimir @Packet_vlad]

@PacketJay @Peter_Paluch @danieldibswe And also capture point location can turn 'retransmission' into 'spurious retransmission' as Wireshark sees it:

[Vladimir @Packet_vlad]

@davidbombal @gns3 We can only assume it's bgp but cannot guarantee this because anyone can put any L7 protocol on top of port 179 TCP packet having TTL of 1.

[Vladimir @Packet_vlad]

@packetfoo @PacketJay Impressive! What task did you try to do with such dataset?

[Vladimir @Packet_vlad]

@showipintbri @PacketJay @packetpioneer Check if reassembling is turned on in dissector settings.

[Vladimir @Packet_vlad]

@rknall For me just a possibility to create something like groups/folders with custom names would be enough. Nested groups structure - even more than I need. I could name the groups 'BIFs/RWINs', 'RTTs/Timings' etc. Very handy if you have 20+ lines.

[Vladimir @Packet_vlad]

@mvankleij_nl Am I right thinking they used unicast until DR/BDR election happened? And then switched to multicast?

[Vladimir @Packet_vlad]

@mvankleij_nl Because of 224.0.0.6 IP which appears only if DR is present. So 10.1.12.1 is BDR (sends to 224.0.0.6) and 10.1.12.2 is DR (sends to all OSPF routers 224.0.0.5)

[Vladimir @Packet_vlad]

@mvankleij_nl Or more like DR to DRother..

[Vladimir @Packet_vlad]

@mvankleij_nl DR-BDR on Broadcast?

[Vladimir @Packet_vlad]

SharkFest'19 US picture gallery is online at https://t.co/SDDV7YJyn2 #wireshark #sf19us

[Vladimir @Packet_vlad]

@PacketJay @SharkFest_2019 You've just discovered what 5,5 hours RTT means.. 😄
https://t.co/3qTAIrLBGH

[Vladimir @Packet_vlad]

Simple funny case about how we needed to set up remote access to locked IP camera 😄
https://t.co/TSpjxX7HVE

[Vladimir @Packet_vlad]

@mpennac @Apposite_Tech Hi Mike, will it be recorded as always? Sharkfest is happening on this date, so a lot of packet folks won't be able to attend..

[Vladimir @Packet_vlad]

@SYNbit @PacketJay This is a good idea, I often catch myself forgetting to check the comments.

[Vladimir @Packet_vlad]

Some cool details about IP fragmenting. Although the feature is rarely used, but an analyst has to be prepared to interpret everything :)

[Vladimir @Packet_vlad]

@SYNbit Ok, I was digging into wrong RFC - 791 :) So they weren't dropped, but just not reported of. Cool details!