This is a static archive of our old Q&A Site. Please post any new questions and answers at ask.wireshark.org.

Tshark -Windows, disable internal ports number resolution

0
tshark -Nt -f "host abc.com"

this command in Windows will be make internal and external ports number resolution:

  1   0.000000    10.0.2.15 -> 92.223.112.104 TCP 62 ardus-cntl https [SYN] Seq=0 Win=64240 Len=0 MSS=1460 SACK_PERM=1
  2   0.020856 92.223.112.104 -> 10.0.2.15    TCP 60 https ardus-cntl [SYN, ACK] Seq=0 Ack=1 Win=65535 Len=0 MSS=1460
  3   0.020914    10.0.2.15 -> 92.223.112.104 TCP 54 ardus-cntl https [ACK] Seq=1 Ack=1 Win=64240 Len=0
  4   0.022235    10.0.2.15 -> 92.223.112.104 SSL 376 Continuation Data

but in Ubuntu happen only external ports number resolution

0.000000    10.0.2.15 -> 92.223.112.104 TCP 62 1116 https [SYN] Seq=0 Win=64240 Len=0 MSS=1460 SACK_PERM=1
0.020856 92.223.112.104 -> 10.0.2.15    TCP 60 https 1116 [SYN, ACK] Seq=0 Ack=1 Win=65535 Len=0 MSS=1460
0.020914    10.0.2.15 -> 92.223.112.104 TCP 54 1116 https [ACK] Seq=1 Ack=1 Win=64240 Len=0
0.022235    10.0.2.15 -> 92.223.112.104 SSL 376 Continuation Data

How to make only external ports number resolution in Windows?

asked 18 Dec '14, 06:53

regexmix's gravatar image

regexmix
11224
accept rate: 0%

What versions are you using on the two OS's? What do you mean by "internal" and "external" ports"?

(18 Dec '14, 07:52) grahamb ♦
1   0.000000    10.0.2.15 -> 92.223.112.104 TCP 62 ardus-cntl https [SYN] Seq=0 Win=64240 Len=0 MSS=1460 SACK_PERM=1

here is:

ardus-cntl ->internal port

https ->external port


Windows XP

TShark 1.6.7

wireshark 1.6.7

(18 Dec '14, 08:09) regexmix

One Answer:

0

You can just turn the resolution on or off not select if it should be for only SRC or DST.

answered 18 Dec '14, 07:47

Anders's gravatar image

Anders ♦
4.6k952
accept rate: 17%

edited 18 Dec '14, 07:47