Slice It Smart: Extend Your Capture Time With Packet Slicing

I would say packet slicing is one of the most critical techniques to understand.

Back in the day when we had hard drives with limited disk space and we needed to capture for long periods of time, we used packet slicing.

Packet slicing in Wireshark is one of those features that doesn’t get much love, but once you use it, you wonder how you ever captured packets without it. The basic idea is simple: instead of grabbing the entire packet payload, you only capture the first N bytes. For many troubleshooting and analysis tasks, that’s more than enough to see headers, flags, and protocol behavior without hauling around a ton of unnecessary data.

A Random Walk(*) with Artificial Intelligence (by Paul W. Smith)

 

My wife and I recently joined some of the last homeowners to contribute to the $11 billion robot vacuum industry. Since I am usually the one who does the vacuuming, I liked the idea of completing this chore with the simple push of a button. It was an exciting day when I took our new Roomba out of the box, placed it on it’s little charging dock (which we located in the laundry room for our convenience), and then stood back and pressed “Clean” on my iPhone app.

Using Wireshark to Find the HTTP Login Decode

 

In past articles I covered how to search for HTTP login credentials. After some feedback, I wanted to cover another approach used to find login credentials. Just want to start with a simple statement.

"Packet Capture Accuracy: Why Timestamps Matter More Than No Packet Loss" (Chris Greer)

I just wanted to take a few minutes to share the results of some of the "Capture Limit" testing I have been doing in my lab. These results were shared at Sharkfest Europe 2019 in Estoril, Portugal. The purpose of the session was to discuss the considerations of building your own capture appliance. I am not trying to promote any specific product; rather my goal is to demonstrate the limits where the accuracy of a capture on a laptop becomes questionable. 

During my performance testing, I found that there was a huge difference between capturing everything (no packet loss) and capturing everything correctly (packet timing is accurate). Before getting into the results of the testing, let me tell you a bit about my setup. 

"How AI Is Changing Human Thinking, Memory, and Culture" (by Paul W. Smith)

 

"Never underestimate the power of stupid people in large groups.” – George Carlin

Judging from the number of times we use the word “stupid” in our daily discourse, you might conclude that it’s on our minds a lot. It should come as no surprise that Merriam-Webster has numerous definitions for stupid. We have all vilified a stupid computer that loses our work, or one that insists on peppering us with stupid popups. Exasperating events, as well as those which hold no interest for us, happen much too often.