25

I have a complicated low level networking question and I have captured two (good/bad) instances using Wireshark.

How is it recommended to post the Wireshark capture data? Should I just show a couple of screenshots or attach the actual capture file (how)?

12
  • Can you copy-paste the relevant info into the post itself? Feb 25, 2016 at 7:27
  • 36
    Stack Overflow is for programming questions, not low-level networking questions (unless they're about your code that's driving that low-level network stuff). Are you sure your question is on-topic?
    – Mat
    Feb 25, 2016 at 7:57
  • 4
    I'm guessing that the best way would be to copy the relevant info into the post, as text. (Not as a screenshot). Feb 25, 2016 at 8:09
  • 1
    No I am not sure Stack Overflow is the right forum but I did see quite a few TCP/IP related posts. Is there a better forum for in depth networking?
    – David G
    Feb 25, 2016 at 10:35
  • 13
    Depending on the question, it might belong on Super User, Server Fault, or Network Engineering. The full list of available SE sites is at stackexchange.com/sites.
    – S.L. Barth
    Feb 25, 2016 at 11:03
  • 4
    If the data required is too much to fit into a question, then your question is too broad. Work on narrowing it down to a question that can be asked in a reasonable amount of space. Doing so may also reveal the answer.
    – user1228
    Feb 25, 2016 at 13:41
  • 1
    If you can add more details about the nature of your question, we might be able to help advise on which site is most appropriate for your question. Feb 25, 2016 at 15:51
  • 3
    You can run the capture file through tshark to get output that looks just like wireshark's graphical interface, and you can apply a filter using the wireshark display filter syntax.
    – user2404501
    Feb 25, 2016 at 16:37
  • 1
    Network Engineering would be a better site for this IMHO.
    – TylerH
    Feb 25, 2016 at 16:38
  • Where do I find tshark? It looks like Network Engineering is where I should go. The problem is an Arduino board connecting to a PC app (Win7) but occasionally the connection is failing. Thanks for the comments.
    – David G
    Feb 25, 2016 at 20:56
  • 2
    Also, just wondering what might be sensitive in this case. It is a laptop directly connected to an Arduino Ethernet shield, and there are no passwords or such. Are MAC addresses considered sensitive?
    – David G
    Feb 25, 2016 at 21:02
  • Cloudshark used to have a pastebin-like, free functionality for packet captures. That'd be handy, although probably not a full substitute for adding the necessary info to the question (to avoid links going dead etc).
    – m01
    Feb 26, 2016 at 17:08

2 Answers 2

30

Screenshots are generally discouraged. Text is better, because we can search through it.

I suggest using code markdown for the capture. This will preserve the formatting.

The drawback of text is that it may also be indexed by search engines. So take care if there is any sensitive data in your capture.

If the capture files are very big, provide us with representative samples instead. Remember that posts on Stack Exchange should not require us to visit other sites. It's OK to post the full captures elsewhere, and link us there - as long as we're not required to visit the other site to answer the question.

1
  • 21
    Sensitive data should be redacted no matter what, even if you're posting an image. Text has a clear advantage for redaction, too: you can easily replace it with a similar, non-sensitive string without having to obliterate a large area.
    – Cody Gray Mod
    Feb 25, 2016 at 10:59
11

I recently saw a question that I think gets it mostly right:

SSL connection failing with no Certificate Request from the server, connecting to Nginx on AWS from a local Websphere AS running on Java 6

That is, copy Wireshark's dissection into the question, with code formatting, redacting sensitive parts.

In that case, you could probably remove the part until Secure Sockets Layer, since the Ethernet / IP / TCP parts are most likely not relevant to the problem, and thus just make the question harder to read. You never know when they might be relevant, though...

(And don't post screenshots. They are hard to read, and not searchable.)

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .