Search the Community

Link: Wireshark Is 25: The email that started it all and the lessons learned along the way | Sniff free or die I remember being nervous and excited at the time, wondering what the reaction would be. I had spent the previous few months working on a protocol analyzer, which was something I needed at work. There are a couple of things to note: the name wasn’t Wireshark (we changed the name in 2006) and at the time of this email, protocol analyzers were rare, you could even say a precious thing. Back then, if you wanted to see what was happening on your network, command line tools like tcpdump and snoop were available at no cost, but if you wanted a GUI analyzer, you had to pay for a product that might cost the equivalent of a luxury car. I needed an analyzer to do my job, so I ended up writing a simple one and releasing it as open source. As it turned out, other people needed an analyzer too. A couple of days after I sent this email, I received a patch. Then another, and another. This quickly blossomed into a thriving developer community which has kept me busy ever since. In the intervening years, the project and its community have grown beyond any expectation that I could have had. Today, Wireshark is used by people around the world to make their networks fast, reliable, and secure, and educators use it to teach the next generation of security and network engineers about the low-level aspects of networks. What does it take to keep a project successful for so long? It would be nice to be able to say that from the very beginning, there was a grand, clear vision of how everything would evolve and unfold. However, as with any significant endeavor, you have to learn to adapt and apply the resources at hand as effectively as you can. In retrospect, Neils Bohr’s quote “An expert is a person who has made all the mistakes that can be made in a very narrow field.” rings especially true in our case. I did manage to learn that in order for an open source project to grow and thrive, you have to ensure that needs are met in the following categories: User support. Living, breathing people make use of your project, and sometimes need assistance. They might be daily power users or novices, and their needs vary. Educator support. Experts and power users can teach others how to get the most out of your project, and need assistance as well. Developer support. The easier you can make it for people to contribute code or otherwise improve the project, the healthier the project and community will be. Attorneys and accountants. Until GitHub and GitLab add “intellectual property law” or “travel reimbursement” buttons, you’re going to need to find outside help for the regulatory, legal, and financial aspects of your project. Infrastructure. You need servers, containers, and services that provide an online presence and allow for collaboration. GitHub or GitLab may or may not be sufficient for this depending on your specific needs. This isn’t quite a Maslow-style hierarchy of needs for open source, but it’s close. The lines between users, educators, and developers can be blurry, but in general, users and educators depend on the output that developers produce, and the project as a whole needs a solid infrastructure in order for everyone to collaborate. It also doesn’t apply uniformly to all projects. For example, a small, single-purpose image processing library might only need infrastructure and developers, and its user community would likely be other developers. A hosting service like GitHub or GitLab would be sufficient for the project’s infrastructure. On the other hand, a large, feature-rich image editing application might have extensive needs in all five categories along with a business model to fund the project. Wireshark falls into the latter group, and needs quite a bit of care and feeding. Until recently, the business model for meeting these needs has been “ask my employer if they’ll host the project,” which worked surprisingly well. My employers (CACE Technology, Riverbed and now Sysdig) provided the resources for Wireshark that go way beyond what GitHub and GitLab can offer, such as SharkFest, a conference dedicated to protocol analysis. In recent years, it became clear that the project would best meet its needs by standing on its own, and with the help of Sysdig, we moved the project to the Wireshark Foundation earlier this year so that the project can continue to grow and serve its community. 25 years ago when I sent that email, I never thought I would be blogging about the project today! If you’ve ever thought about starting an open source project, don’t hesitate to do so. Supporting and managing Wireshark has given me a wonderful career, and opportunities to meet and work with brilliant, inspiring people. If I had to distill everything I’ve learned down to a couple of pieces of advice, it would be this: The community has valuable insights to share. Let them do that. Don’t be afraid to start something new. You never know where it might take you 25 years from now. Finally, I can’t thank you all enough for using and contributing to Wireshark over the years. I can’t wait to see what the future brings. Cheers!

Need some help! We are getting poor ping replies from switches in a new building cabinet, which im guessing is related to some issue we are having with slow network & timeouts from a couple of computers in that building, i've plugged laptops into the port the computers use and get the same results so am confident it's not the computers. In the cab is a top, middle and bottom switch as follows Top switch - 10.11.229.106 Netgear GS748Tv3 : Connected via fibre to core switch : 25 connected devices Middle Switch - 10.11.227.111 Netgear FS752TS (Standalone/Not Stacked) : Connected via fibre core switch : 28 connected devices Bottom switch - 10.11.227.122 Netgear FS752TS (Standalone/Not stacked) : Connected to middle switch via RJ45 gig ports : 15 connected devices All the switches have been reset back to factory default, given a static IP and latest firmware upgraded, here is an example of the ping replies i'm getting from the top, middle and bottom switches [ATTACH=CONFIG]12666[/ATTACH] i've tried wireshark and seen nothing that is sending broadcast packets to 255.255.255.255 other than DHCP requests, but to be honest dont know what else I should be looking for on wireshark, does anyone have any suggestions please?

Hi everyone We've got a weird problem that has cropped up. Hoping someone has suggestions about where to look. Our trust has some web based services hosted at Site A which are have been working perfectly for years, including at Site B and site C. Recently site A has switched from a leased line to an FTTP connection and also switched firewall from Endian to smoothwall. The port forwards, DNS, etc have been setup to host the services on the new FTTP connection. After doing this, the hosted services work everywhere (including from home, etc) except site B. To be clear, there's no VPN's or any such other connectivity than the Internet connecting the sites. At site B, http versions of the services load just fine, but when switching to https, the page fails to load and eventually times out. I've tried using openssl to diagnose, but got nowhere. All the sites being smoothwall, I've tried using tcpdump and confirmed that data isn't being blocked by any firewall rule. In the end, I've installed wireshark on a PC at Site B and then made a test request to the https site. In wireshark, I can see the request going out and coming back in, but the browser is just eventually timing out. When I try using openssl, it looks like it never gets a response from the server, even though I can see a packet of data coming back. Specifically, the last 2 entries in wireshark show the client pc sending a 'Client Hello' packet and a response packet from the server. Anyone got any suggestions about how to diagnose further or what might be happening? Many thanks in advance, Meldrew.

It's like WireShark, but in reverse. Website / Download http://i.imgur.com/nduxS9X.png http://i.imgur.com/ed6ibyF.png

Hey guys, I have a local internet provider. They are a co-op. Since the summer I've had problems with the speed dropping so low that google won't open. When the speed drops I get "request timed out" like 6-10 in a row before speed will start to come back up. It happens throughout the day morning, noon, and evening throughout the night. My ISP wouldn't do anything to help so I downloaded WireShark. When the speed dropped, I noticed that there were 5-10 second differences on the ICMP Protocol packets. I don't know anything about ICMP so I was wondering if anyone could help me out. I don't know if the problem is me or my ISP. Any help? Thanks.