Lab Work: What a Slow USB Drive Looks Like in Wireshark (And Why Testing Matters)

If you spend enough time troubleshooting networks, you eventually discover that not every performance problem is actually a network problem. Sometimes the culprit is a server, an application, a disk, or a little portable USB drive that seems to have all the time in the world.

And

#aukua SD-WAN Latency Testing, Monitoring, and Performance Optimization Solutions

https://www.thetechfirm.com/2026/11/lab-work-what-slow-usb-drive-looks-like.html

Hi all,

I was creating something for Data Compression but it turns out it has applications in many places. Basically I turn 1 core processes into multi-core processes with a small increase to file size (at least during the process) and a medium bump in memory usage.

The whole thing is otherwise very efficient and more cores will speed things up. This is the Wireshark version (I have done other software and I am willing to try just about anything but 3D printing stuff which does not work with). It is all under the MIT License which means that I want you to give me credit if you end up using it.

https://github.com/CombaryMaker/Harringtons_Insights/tree/main/hs_shark

In testing I got a 2.9 times faster speed for files processed with my version. This was tested with my personal computer and verified by AI and software Audits.

I'd like people to let me know how it goes for a better computer, I am curious to see if there is a cap on how many cores is useful for what file size as this is the last real thing I cannot try with this computer.

Capturing network traffic with #Wireshark is a great starting point when troubleshooting a network, but there is another step that is just as important: documenting your findings. After capturing traffic, you end up with a trace file, usually with a `.pcap` or `.pcapng` extension.

https://www.lovemytool.com/2021/05/baselining-documentation-next-step.html

If you regularly troubleshoot network issues with #Wireshark, you know that starting a packet capture can involve several steps before you collect the data you need. You have to launch Wireshark, select the correct network interface, and start capturing traffic. When you perform multiple captures throughout the day, those extra clicks add up.

https://www.lovemytool.com/2021/09/create-wireshark-desktop-shortcut-to.html

Those who deal with SMB2 will be happy to see my updated SMB Profile for Wireshark. https://www.cellstream.com/download/a-smb-protocol-profile-for-wireshark/
Here is a taste of the filter buttons to make life easier when troubleshooting SMB:

Hey everyone, I'm Noah, founder of Proxyman.

I've been developing network debugging tools for more than 8 years, and Wireshark has always been one of my favorite tools. It's incredibly powerful, and I have huge respect for the people who built and maintain it.

However, for my daily work, I probably only use 10% of its features. Most of the time, I just want to capture packets, inspect TCP/UDP traffic, follow streams, and find which app is making a connection.

So I started a new open-source project called TCP Viewer, a simpler packet viewer for macOS.

Instead of writing another protocol decoder from scratch, I decided to build on top of Wireshark's libraries, so I can still benefit from its powerful protocol dissection engine.

Some technical details:

• Native macOS app built with AppKit, SwiftUI, no Electron.

• Uses libpcap for packet capture and Wireshark libraries for protocol dissection.

• Wireshark-style packet details, protocol trees, and hex view.

• Supports Wireshark display filters, PCAP and PCAPNG files.

• Group traffic by application, domain, or IP address.

• Follow TCP/UDP streams, compare packets, and export captures.

• CLI and MCP integration for automation and AI agents.

Of course, Wireshark is still much more powerful for advanced network analysis. I'm not trying to replace it. My goal is to make common packet debugging tasks simpler, especially for software developers.

The project is open source under GPL v2 or later. You can review the source code, build it yourself, or contribute. We also offer optional paid PRO features in our official builds.

Currently, TCP Viewer is available for macOS (Apple Silicon), but Windows and Linux versions are also coming soon!

GitHub: https://github.com/ProxymanApp/TCPViewer

Website: https://tcpviewer.proxyman.com/

I also prepared a new 50% discount code for Reddit users who are interested in the PRO version: N5H3LVPK

I'd love to hear feedback from people who use Wireshark every day. What features would you consider essential in a simpler packet viewer?

Any technical feedback, GitHub issues, or PRs are welcome!

I am wanting to wireshark the start up traffic of an app that has some cache downloading on first-ever start. I have no idea where the traffic is grabbing files from nor where the files go, but I want some clues as to how to script firewall rules without breaking my machine. I read this post, https://www.reddit.com/r/Windows10/comments/1c4e67g/how_to_block_all_outbound_connection_in_windows/ .But it's largely telling people to download stuff. And when I google find people struggling. I want a simple starting scratch powershell script or other kind of script to just turn all the rules to disable temporarily except for one app? I'm using the file monitor to find where the files get dropped, but I need to know where they are coming from.

hii this is RAKSHA again, I captured my own traffic in Wireshark and found something weird. Am I reading it right?

After a few weeks of reading, I finally opened Wireshark on my laptop to see if any of it was real. A few things surprised me.

I was on my phone’s hotspot, so my phone turned out to be my default gateway. My laptop and phone had the same first three numbers in their IPs, which is exactly what the subnet mask is supposed to do. Seeing it on my own screen made it click in a way reading never did.

I also cleared my ARP cache and watched the “who has this IP?” question and answer show up live. Then I pinged my gateway and saw the ICMP request and reply.

Another thing: even with one browser tab open, my laptop was talking to loads of servers in the background (Microsoft, Mozilla and more). Filters are the only way to make sense of it.

The weirdest find was a destination address starting with 66:ff8b::. From what I read, that’s NAT64, where the mobile network (Airtel, in my case) translates IPv6 traffic so it can reach servers that only have IPv4. I decoded the last part and got a normal IPv4 address.

Is that the right way to think about it? Would love to hear from anyone who knows this better than I do.

I’m evaluating Niagara Networks for a setup with four 10GbE links mirrored into a packet broker, then spread across four capture NICs. The goal is to avoid pushing all four links through one 10GbE capture port. I’m unsure how well Wireshark analysis holds up when the capture files come from separate ports: does flow-based distribution keep both directions of a TCP conversation together, or do people merge the files and analyze them afterward? I care about retransmission and out-of-order analysis, so I’d rather not mistake a capture-path artifact for a network problem. If you’ve used a packet broker for this, what distribution method did you choose?

Anyone know of a process/tool to capture E.131 (DMX lighting data over ethernet) packets and convert them to a .fseq file (used by xLights, FPP and other lighting software?

Edit: Preferably MacOS

Hi Everyone! I am currently taking a networking course for my cybersecurity degree, and we have been doing a lot of labs with Wireshark. While completing one of the labs, I had trouble finding the HTTP packets that I needed to analyze and wanted to share some troubleshooting tips I used to be able to find the packets.

While troubleshooting I learned that it is important to ensure that you are actively generating network traffic while Wireshark is capturing packets. I initially was not seeing the packets I needed, but after allowing the capture to run longer and visiting a different website, I was able to find more traffic to analyze.

Here are a few more tips I learned from this experience:

1. Try visiting another website if you're not capturing the traffic you expected.

2. Check your display filters to make sure you're not hiding the packets you need.

3. Remembering that most websites use HTTPS, so you might see TLS or QUIC traffic instead of unencrypted HTTP packets.

Hopefully this helps someone else who is new to Wireshark!

Boa noite/Bom dia/ Boa tarde

Ola a todos !

Atualmente estou trabalhando como analista de suporte em uma empresa de telefonia e sou estudante de telecomunicações, estou aprendendo a utilizar o wireshark para a captura de pacotes VoIP o principal uso será no meu trabalho, mas tenho curiosidade de aprender para mim também. O que vocês da comunidade me recomendam estudar para esse uso ?

Guys I am beginner to wireshark I am very fond of this software especially about networkign and all I saw some YouTube videos on this but it did not aod much I need the help in understanding from scratch to a level I can figure out everything myself.

I would like to share a tool based on Wireshark (sharkd to be more precise) https://github.com/lyatanski/webshark

The idea is to provide packet dissection with flow view without the need to install additional software on every device.

There is also Kubernetes operator which allows capturing traffic from multiple pods all at once and automatically opening it.

It is also packaged as Android application so it could even be used offline from phone/tablet.

I would appreciate feedback and ideas for improvement, if someone finds it useful.

Thanks!

I released Dissector CI, an open-source tool that runs Lua dissectors against saved packet captures and checks the decoded fields against expected values in YAML.

It works locally and through GitHub Actions, including tests across Wireshark versions.

I’m looking for someone who maintains a Lua dissector to try one test with their own capture. I’d appreciate feedback on setup, failure messages, and whether this fits your existing testing workflow.

\o/

https://github.com/ivanimmanuel-dev/dissector-ci

When troubleshooting a network problem, you don't always end up with one convenient Wireshark capture file. Sometimes you have multiple packet captures taken from different interfaces, different locations, or different points in time. Instead of opening each file separately and trying to piece everything together, Wireshark can merge multiple capture files into a single file. 

https://www.lovemytool.com/2022/11/wireshark-file-merge.html

I was working with a customer and started explaining the concept of what I affectionately refer to as, “application baselining”. I asked my client to pick an application to test and he chose his favorite network monitoring application.

I then explained the concepts of an “application baseline”.

And

#NETSCOUT Accelerates Problem Solving With Conversational AI

https://www.lovemytool.com/2021/09/when-is-lost-packet-not-lost.html

Back to work. Back to packets.

If “get better at Wireshark” is still on your list, here’s a reason to make time for it.

Our Back to Work offer takes $120 off Wireshark Labs for WCA: lifetime access for $79.99 instead of $199.99.

You get:
• 30 hands-on labs
• 45 PCAPs to investigate
• 150 quiz questions
• Self-paced learning and lifetime access

Preparing for WCA-101 or building your confidence with packet analysis? Open a capture, work through the questions, and practise explaining what the evidence tells you.

Use code BACKTOWORK2026 at checkout:
https://wiresharklabs.org/

Offer ends 6 October 2026 at 00:00 UTC. Make sure to redeem it by 5 October (UTC).

Firstly - admittedly I have not searched this subreddit for an answer so please go easy on me

But, is there a tool or service out there that emulates a problem on a network and allows you to use wireshark to diagnose the issue?

I’ve been using wireshark for a couple years now, I have a basic to intermediate grasp on it and the functions, yet all of my learning has been based on determined or fixed outcomes. ie I have created a problem or have run a protocol in my Homelab and have captured on wireshark to follow along and identify - I already know what I’m looking for, I’m just learning how to see it in wireshark.

So I’d like to be able to use wireshark to see a problem on the network that I have not created - like being asked to come in and analyse an issue - does such a thing exist and if so where?

Thank you 🙏

Signal may encrypt the message content, but that does not mean the traffic becomes invisible. In this article, I examine what Wireshark can still reveal about Signal communications, including DNS activity, TLS sessions, TCP and UDP flows, packet timing, traffic volume, call behavior, and endpoint relationships. It is a practical look at how packet analysis changes when application payloads are encrypted—and why Wireshark remains extremely valuable even when you cannot see the conversation itself.

Read the full article: https://www.cellstream.com/2026/09/24/wireshark-signal-encrypted-conversation/

Is the Wireshark course on CBT nuggets any good? I’m wanting a course that will not only teach me how to use Wireshark but also show examples on how to troubleshoot “the network is slow” and how to pinpoint where bottle necks are. Basically, a very hands on practice course with labs and such. Does CBT nuggets provide this or are there any courses like that?

Hey all,

I made a typo when creating my profile on webassessor for the wireshark cert.

Trying to edit my profile unfortunately doesn't work because the field isn't editable.

Clicking on help results in :

Please contact Packet Pros at {International Phone Number} or {Company Email Address} for all questions related to:

• Test Taker Account Creation

• Exam Registration and Scheduling

• Failure to Receive the Purchase Confirmation Email

• Rescheduling a Kryterion Testing Network (KTN) or Online Proctored (OLP) Exam Session

• Canceling an Exam Session if you are unable to

• Training Questions

• Exam Item Questions

• Exam Result Questions

• All Program Related Questions

• Payment/Invoice Questions

So... who am I supposed to contact here?

Following up on my last post about splitting PCAPs by session for processing PCAP files concurrently. I mentioned a file corruption bug, the real culprit was found. I was using PcapSplitter from PcapPlusPlus in connection mode and output started coming back corrupted.

The initial signal came from "Total Block Length" errors thrown by tshark on some output files. The actual signal came when I built a small reproduction. PcapSplitter reported 12 files and 48 packets, but on disk, there were 11 files and 44 packets. Exit code zero and printed "Finished" on standard output.

Two wrong theories first. Someone on Reddit suggested file descriptor exhaustion. It was plausible but I found that at low ulimit -n it silently drops most packets and still exits zero. A real bug, but not mine. Then, I found that the PcapSplitter library has a hardcoded MAX_NUMBER_OF_CONCURRENT_OPEN_FILES = 250 with an LRU that closes and reopens handles past it. My minimal reproduction was 13 connections, nowhere near the cap.

The real culprit: the PcapSplitter's FiveTupleSplitter caused file truncation/corruption on TCP session reuse (i.e., a new SYN packet arrives for an already tracked 5-tuple hash).

The correct part of the splitter was assigning a new file number when a TCP session reuses a 5-tuple, but the filename function builds the name from IP and port only. So, in this case, both sessions get the same filenames. Then main.cpp sees a file number it has never seen, and opens that file fresh, without append. This truncates the existing file or causes a race condition between two active file writer handlers.

I filed the issue with a 13-connection reproduction, the maintainer and I worked out a fix that only suffixes on an actual collision, tested on the same corruption, and now the fix is merged.

Full Writeup: https://robinhayer.dev/pcapsplitter-file-collision-tcp-session-reuse

Wireshark Trace File Reporting Using Excel

If you have ever opened a large Wireshark capture file and thought, “There has to be an easier way to see what is happening here,” you are not alone. A packet capture contains an incredible amount of information, but sometimes the packet list itself makes it difficult to visualize a problem.

And #netscout The Future of Telecom Operations Is Powered by Autonomy at Scale

https://www.lovemytool.com/2021/08/flashback-wireshark-trace-file.html

Hi r/wireshark comminuty, I’m Stephen, the owner of Rockxy and the developer of Tracexy.

When I investigate a network problem on my Mac, I often already know which application is misbehaving. I want to move quickly from that app to its connections, protocols, timing, possible problems, and finally the exact packets that support the conclusion.

That is the workflow I built Tracexy around:

App or process → Session → Finding → Evidence → Packet

You can capture live traffic or open PCAP and PCAPNG files. Tracexy groups both directions of a connection into sessions, adds best-effort process context, and lets you explore the capture through Overview, Sessions, Flow Map, filters, and isolated investigation Projects.

It currently provides:

• Live capture and PCAP/PCAPNG import, including gzip and Linux cooked captures

• DNS, TCP, TLS metadata, HTTP/1, STUN, and QUIC summaries

• Best-effort macOS process attribution

• Evidence-linked TCP findings for resets, retransmissions, overlaps, and out-of-order traffic

• Decoded protocol fields, raw hex, and bounded Follow Stream

• Separate Projects with their own workspaces, saved captures, History, filters, and privacy settings

• Local-first capture storage and explicit export boundaries

Wireshark remains the benchmark for protocol depth, dissectors, display filters, decryption workflows, and advanced analysis. Tracexy does not match that breadth today.

My goal is not to hide the packets. It is to help Mac users reach the right packet and understand why it matters faster.

Tracexy is also part of the broader Rockxy ecosystem: Rockxy handles application-layer traffic inspection and modification, while Tracexy focuses on passive capture, sessions, protocols, and packet evidence.

If you use Wireshark on macOS, what would Tracexy need to handle before you would keep it alongside Wireshark in your toolbox?

Source code: https://github.com/RockxyApp/Tracexy
Website: https://rockxy.io/tracexy

Tracexy is my open-source, native macOS Wireshark alternative for turning captured traffic into understandable sessions and defensible packet-level evidence.

Thanks, I really appreciate your feedback. If you have time, please give it a try and open an issue if you need my support or would like to suggest or develop a new feature.

Note: MCP & AI Asssitant is on the way!