(Thanks to Hansang Bae for showing this quick tip at Sharkfest!)
Once again, Sharkfest is here. Attendees are crunching packets, digging through traces, and refining their art of protocol analysis - If packets are your thing, there is no better place to be.
Within the first three minutes of the first packet analysis session I attended this morning, my appreciation for the Sharkfest Wireshark Users conference was renewed. Where else in the world can you get packet-level analysis tips from people who have been doing this for decades? Where else do you see instructors finishing their sessions then sitting down as students of the next one?
A quick tip I learned on day 1.
Hanging Bae was busy doing his thing, showing some of the custom filters he uses in one of his TCP analysis profiles. One of the columns he uses is called ACKFor. On any TCP ACK, this column shows the frame number of the packet that is being acknowledged.