Which port is he on ??

 I run into this quite often where the client isn't sure which port the client is connected to.

In many cases, I do not have access to their network management system, or the network is down or worse, the documentation is dated and inaccurate. I think every network analyst should know how to do basic tasks like this one.

Troubleshooting with the Time Column in Wireshark (chris greer)

 

Hey Packet People!

Learning how to use the time column goes a long way when troubleshooting network issues. It is very important for analysts to learn how to configure it to represent time in different ways, start and stop time references, and to add specific TCP timers.

Layer 1 – gets them all the time

 I was doing some work on-site when the client asks me if I can help with his IP cameras.

The vendor helped over the phone and they determined that 2 cameras probably need to be replaced. The client explained that he is not that technical and wanted someone else to take a look before he goes through all the trouble of taking them down and sending them back.

I started with a quick look around and determined that the camera is POE and the cable runs to a patch panel, then to the DVR, which is also providing the POE.

How to Use TShark's Autostop Duration Parameter: A Quick Wireshark CLI Tutorial

If you work with network traffic analysis, this short tutorial on TShark's autostop duration option is worth a watch. TShark, the command-line counterpart to Wireshark, gives network admins and security analysts a powerful way to capture packets without needing the full graphical interface — ideal for headless servers and remote environments. This video walks through the `-a duration` flag, which tells TShark to automatically stop a packet capture once a specified number of seconds has elapsed, saving you from having to manually interrupt long-running captures.

The autostop duration parameter is one of several capture-control options available in TShark, alongside conditions like file size and file count limits. By pairing `-a duration:<seconds>` with the `-w` flag, you can launch a timed capture that writes straight to a `.pcapng` file for later review in the full Wireshark GUI.

Wireshark Name Resolution: Make IP Addresses Easier to Understand (Chris Greer)

If you've ever opened a large Wireshark capture and found yourself staring at thousands of IP addresses, you already know how difficult packet analysis can become. Trying to remember which address belongs to a server, workstation, router or application can quickly turn a simple troubleshooting job into a spreadsheet exercise. That's where Wireshark Name Resolution can make a big difference. Instead of displaying only numerical addresses, Wireshark can translate addresses into hostnames, making a packet capture much easier to read and understand. It doesn't change the traffic in the capture—it simply makes the information already being displayed more useful to the person analyzing it.