{"slug": "wireshark", "name": "Wireshark", "category": "networking", "category_name": "Networking and VPN", "description": "", "recommenders": 7, "commenters": 29, "warners": 0, "score": 11.441, "rising": -2.29, "first": "2025-11-04", "latest": "2026-10-12", "why": "This is how it handles TLS decryption [1], which works beautifully.", "why_is_quote": true, "has_verdict": false, "sentiment": {"recommend": 7, "neutral": 18, "compare": 4, "warn": 0}, "spark": [1, 0, 2, 1, 1, 0, 0, 2, 0, 0, 0, 0], "listed": true, "loved": [], "caveat": "", "short_quote": "This is how it handles TLS decryption [1], which works beautifully.", "kind": "", "icon": true, "domain": "wireshark.org", "github_repo": null, "official_url": "https://www.wireshark.org", "pricing": "", "aliases": ["Wireshark"], "verdict": null, "praise": [{"label": "", "summary": "", "quotes": [{"id": 777037297, "item_id": 48564831, "url": "https://news.ycombinator.com/item?id=48564831", "by": "anitil", "date": "2026-06-16", "version": null, "stance": "recommend", "quote": "But that dynamism really helped with the early stages along with wireshark", "excerpt": "I feel like scapy is a bit of a special case though. It's unusually dynamic because it allows kind of arbitrarily crazy things. I feel like it's maily best for prototyping. I've had 1000x speedups (100s of milliseconds to dozens of microseconds) just by removing dynamism. In our case we used scapy to work out the packet shapes we cared about and then just implemented just that subset (still in Python!). But that dyna", "context": "", "use_case": "packet analysis", "switched_from": "", "story": "Making ast.walk 220x Faster"}, {"id": 774793952, "item_id": 48424622, "url": "https://news.ycombinator.com/item?id=48424622", "by": "tisdadd", "date": "2026-06-06", "version": null, "stance": "recommend", "quote": "Wireshark was very simple to use", "excerpt": "There could be better, but this looked reasonable at first glance if you also have a Mac. https://www.thequantizer.com/tutorials/wireshark-iphone-traffic-capture/ It has been a while since I personally did such traces, but Wireshark was very simple to use and once the network is exposed, it has lots of information available online if you need more. I found bypassing your VPN particularly appalling, as is the whole th", "context": "", "use_case": "Network traffic capture", "switched_from": "", "story": "The Smart TV in Your LivingRoom Is a Node in the AIScraping Economy"}, {"id": 749629185, "item_id": 46851824, "url": "https://news.ycombinator.com/item?id=46851824", "by": "guessmyname", "date": "2026-02-01", "version": null, "stance": "recommend", "quote": "You can easily inspect the packet with tools like Wireshark or Burp Suite Professional", "excerpt": "I don\u2019t get it, why don\u2019t you all\u2014absolutely all of you reading\u2014use Little Snitch? [1] It really doesn\u2019t compute in my head why would any macOS user not use a network firewall like this, or similar, to block unwanted outgoing HTTP(s) requests. You can easily inspect the packet with tools like Wireshark or Burp Suite Professional (or Community) edition, or any other proxy tool, of which there are many in the macOS eco", "context": "", "use_case": "", "switched_from": "", "story": "Notepad++ hijacked by state-sponsored actors"}, {"id": 747847201, "item_id": 46740450, "url": "https://news.ycombinator.com/item?id=46740450", "by": "gerdesj", "date": "2026-01-23", "version": null, "stance": "recommend", "quote": "After that you will need nmap and wireshark.", "excerpt": "Good skills - you are well on the way to Engineer with a capital E. You cannot see network traffic. You'd be amazed at how many people think they can diagnose a network fault without using tools like this. Everyone is an expert until they prove themselves to be a bit of a twit! At layer 1 you have electrical issues to deal with and that will need some hardware. Obviously you need to pick your network model too. Here ", "context": "", "use_case": "network diagnosis", "switched_from": "", "story": "Show HN: Whosthere: A LAN discovery tool with a modern TUI, written in Go"}, {"id": 747648384, "item_id": 46728024, "url": "https://news.ycombinator.com/item?id=46728024", "by": "JohnLeitch", "date": "2026-01-22", "version": null, "stance": "recommend", "quote": "This is how it handles TLS decryption [1], which works beautifully.", "excerpt": ">Is that because wireshark can't do that just from packet captures? Well, not quite. I think it's more that nobody has taken the time to implement it. That's not to say such an implementation would automatically decrypt the traffic from a capture with no extra leg work, of course. Wireshark dissectors have user configurable preferences, and presumably this would be where captured secrets could be set for use. This is", "context": "", "use_case": "Packet analysis", "switched_from": "", "story": "Why does SSH send 100 packets per keystroke?"}]}], "caveats": [], "who": [], "tags": [], "use_cases": ["packet analysis", "packet capture", "inspecting network traffic", "usb packet capture", "network traffic capture", "reverse engineering device protocol"], "compared": [{"slug": "claude-code", "name": "Claude Code", "co": 3, "switched_from": 0, "switched_to": 1}, {"slug": "burp-suite", "name": "Burp Suite", "co": 2, "switched_from": 0, "switched_to": 0}, {"slug": "little-snitch", "name": "Little Snitch", "co": 2, "switched_from": 0, "switched_to": 0}], "makers": [{"id": 751259553, "item_id": 46953722, "url": "https://news.ycombinator.com/item?id=46953722", "by": "bondolo", "date": "2026-02-09", "version": null, "stance": "neutral", "quote": "submitted my first PR", "excerpt": "I recently retired after 37 years of working in tech so of course I am working on open source. My retirement treat was to spend three months learning OpenGL and 3D game programming by porting a classic Java RTS game, Tribal Trouble, to more modern OpenGL and Java. I learn much better working with real code and this was a great experience. It was certainly a different experience than it would have been without an LLM ", "context": "", "use_case": "Accessibility contributions", "switched_from": "", "story": "Ask HN: What Are You Working On? (February 2026)"}], "threads": [{"url": "https://news.ycombinator.com/item?id=47894747", "title": "My audio interface has SSH enabled by default", "mentions": 2}, {"url": "https://news.ycombinator.com/item?id=46851548", "title": "Notepad++ hijacked by state-sponsored actors", "mentions": 2}, {"url": "https://news.ycombinator.com/item?id=46723990", "title": "Why does SSH send 100 packets per keystroke?", "mentions": 2}, {"url": "https://news.ycombinator.com/item?id=50059446", "title": "Feds got warrants to use fake cell towers to hunt down Don Lemon's producer", "mentions": 1}, {"url": "https://news.ycombinator.com/item?id=49656225", "title": "Claude is only available to people over 18 years", "mentions": 1}, {"url": "https://news.ycombinator.com/item?id=49365841", "title": "Unlocking a locked/deactivated e-waste Cricut Maker", "mentions": 1}], "sentiment_by_month": {"2025-11": {"neutral": 4, "recommend": 1}, "2025-12": {"compare": 1, "neutral": 1}, "2026-01": {"neutral": 2, "recommend": 2}, "2026-02": {"recommend": 1, "neutral": 2}, "2026-03": {"neutral": 1, "recommend": 1}, "2026-04": {"compare": 2, "neutral": 1}, "2026-05": {}, "2026-06": {"neutral": 1, "recommend": 2}, "2026-07": {"neutral": 3}, "2026-08": {"compare": 1, "neutral": 1}, "2026-09": {"neutral": 1}, "2026-10": {"neutral": 1}}, "versions": [], "version_unnamed": 0, "family_ref": null, "runs_on": null, "lines": [], "quotes": [{"id": 800973393, "item_id": 50060837, "url": "https://news.ycombinator.com/item?id=50060837", "by": "oger", "date": "2026-10-12", "version": null, "stance": "neutral", "quote": "you get a pcap file that you can dissect using Wireshark", "excerpt": "Yes there absolutely are! The EFF has the Rayhunter project at https://github.com/EFForg/rayhunter - it is basically an IMSI catcher catcher. You install it on a pocket router and it detects typical signatures that IMSI catchers use, for example telling your mobile to downgrade from LTE to 2G making it easy for them to tell your device to join THEIR network and read the IMSI / IMEI for your device and possibly route ", "context": "", "use_case": "packet analysis", "switched_from": "", "story": "Feds got warrants to use fake cell towers to hunt down Don Lemon's producer"}, {"id": 794662896, "item_id": 49666431, "url": "https://news.ycombinator.com/item?id=49666431", "by": "Retro_Dev", "date": "2026-09-11", "version": null, "stance": "neutral", "quote": "I decided to record network packets with wireshark", "excerpt": "I used a similar (same?) service that claimed no data was uploaded and \"all processing happens on-device\"... I decided to record network packets with wireshark and found out the tool DID upload a significant amount of data (about 2 megabytes) through its lifetime. I wouldn't trust these tools farther than you can throw them.", "context": "", "use_case": "inspecting network traffic", "switched_from": "", "story": "Claude is only available to people over 18 years"}, {"id": 789899361, "item_id": 49368710, "url": "https://news.ycombinator.com/item?id=49368710", "by": "timhh", "date": "2026-08-19", "version": null, "stance": "neutral", "quote": "I just used a USB sniffer and wireshark.", "excerpt": "I don't have a Cameo Pro 4 to test, but I have reverse engineered software to control some of their other devices. It's a little janky but if you want to help I'd appreciate it! https://robocut.org/ I believe there is (or once was) also an Inkscape plugin somewhere but I never tried it. As for how I reverse engineered it, I just used a USB sniffer and wireshark. I don't think there's a big risk of bricking these devi", "context": "", "use_case": "", "switched_from": "", "story": "Unlocking a locked/deactivated e-waste Cricut Maker"}, {"id": 787753009, "item_id": 49234563, "url": "https://news.ycombinator.com/item?id=49234563", "by": "nghiatran_uit", "date": "2026-08-09", "version": null, "stance": "compare", "quote": "so you can see the packet details like Wireshark", "excerpt": "I spent few months to buil the alternative to Wireshark. Native macOS app, built with Cocoa (Sorry SwiftUI), on top of libwireshark, so you can see the packet details like Wireshark. Support TCP, UDP, DNS, HTTP2, ... https://tcpviewer.proxyman.com/", "context": "", "use_case": "packet analysis", "switched_from": "", "story": "Ask HN: What are you working on? (August 2026)"}, {"id": 781046752, "item_id": 48815422, "url": "https://news.ycombinator.com/item?id=48815422", "by": "pogue", "date": "2026-07-07", "version": null, "stance": "neutral", "quote": "", "excerpt": "The article links to this page, which was shared on HN yesterday. [1] I feel like using wireshark to look at what's being sent back and forth from Windows telemetry, when using Edge, Chrome & etc should reveal what's being sent and recieved. Using MITM SSL spoofing should be able to intercept the packets. [1] https://github.com/SmtimesIWndr/gdid-reversal", "context": "", "use_case": "", "switched_from": "", "story": "Microsoft Can Track Users via a Windows Device ID"}, {"id": 781002577, "item_id": 48812661, "url": "https://news.ycombinator.com/item?id=48812661", "by": "alaudet", "date": "2026-07-06", "version": null, "stance": "neutral", "quote": "tcpdump for ssh dump with wireshark", "excerpt": "Been using Openwrt for years, router and access points. Any new AP I buy has to has to be supported by Openwrt. I have probably bought 7 or 8 old AP's at yard sales over the years for $5/$10 and turned them into decent wifi access points back to an Openwrt router running vlans, bandwidth monitoring, QoS, tcpdump for ssh dump with wireshark. Just excellent, some pretty smart people in the Openwrt forum as well if you ", "context": "", "use_case": "packet analysis", "switched_from": "", "story": "OpenWrt One \u2013 Open Hardware Router"}, {"id": 780512592, "item_id": 48782037, "url": "https://news.ycombinator.com/item?id=48782037", "by": "matheusmoreira", "date": "2026-07-03", "version": null, "stance": "neutral", "quote": "Reversed it by capturing packets with wireshark", "excerpt": "> this is the terribly written software that you need to turn off all the obnoxious lights on your MB and DRAM You should reverse engineer it and write a free software replacement! I did this for my Clevo laptop's keyboard LEDs: https://github.com/matheusmoreira/ite-829x Still one of my most satisfying projects and I use it to this day. These manufacturer apps are so bad. Clevo control center would take over a minute", "context": "", "use_case": "USB packet capture", "switched_from": "", "story": "MSI Center \u2013 How to gain SYSTEM privileges in seconds"}, {"id": 777037297, "item_id": 48564831, "url": "https://news.ycombinator.com/item?id=48564831", "by": "anitil", "date": "2026-06-16", "version": null, "stance": "recommend", "quote": "But that dynamism really helped with the early stages along with wireshark", "excerpt": "I feel like scapy is a bit of a special case though. It's unusually dynamic because it allows kind of arbitrarily crazy things. I feel like it's maily best for prototyping. I've had 1000x speedups (100s of milliseconds to dozens of microseconds) just by removing dynamism. In our case we used scapy to work out the packet shapes we cared about and then just implemented just that subset (still in Python!). But that dyna", "context": "", "use_case": "packet analysis", "switched_from": "", "story": "Making ast.walk 220x Faster"}, {"id": 774793952, "item_id": 48424622, "url": "https://news.ycombinator.com/item?id=48424622", "by": "tisdadd", "date": "2026-06-06", "version": null, "stance": "recommend", "quote": "Wireshark was very simple to use", "excerpt": "There could be better, but this looked reasonable at first glance if you also have a Mac. https://www.thequantizer.com/tutorials/wireshark-iphone-traffic-capture/ It has been a while since I personally did such traces, but Wireshark was very simple to use and once the network is exposed, it has lots of information available online if you need more. I found bypassing your VPN particularly appalling, as is the whole th", "context": "", "use_case": "Network traffic capture", "switched_from": "", "story": "The Smart TV in Your LivingRoom Is a Node in the AIScraping Economy"}, {"id": 774128224, "item_id": 48383014, "url": "https://news.ycombinator.com/item?id=48383014", "by": "asimovDev", "date": "2026-06-03", "version": null, "stance": "neutral", "quote": "I used Wireshark to sniff out the LED and EQ packets", "excerpt": "I also did some reverse engineering, although mine was a soundcard which seemed to use an older version of this software (GUI was different). I used Wireshark to sniff out the LED and EQ packets and then wrote a CLI utility with hidapi library in C. It doesn't have bluetooth so thankfully something like this wouldn't happen with mine. It's crazy that there's no auth at all for Bluetooth. I was reversing my e-scooter ", "context": "", "use_case": "reverse engineering device protocol", "switched_from": "", "story": "Hacking your PC using your speaker without ever touching it"}, {"id": 766398305, "item_id": 47899894, "url": "https://news.ycombinator.com/item?id=47899894", "by": "kolinko", "date": "2026-04-25", "version": null, "stance": "compare", "quote": "I used Wireshark to analyze various things (mostly smart home) over the years", "excerpt": "> a bit of time A bit of time is an understatement. I used Wireshark to analyze various things (mostly smart home) over the years, but now CC does in minutes what it would take me a few hours before - and provides dedicated, custom made panels for whatever I want. As an example - debugging KNX magistrale in my home, previously it was either wireshark and a ton of regexes, handwritten scripts (or official software tha", "context": "", "use_case": "", "switched_from": "", "story": "My audio interface has SSH enabled by default"}, {"id": 766384512, "item_id": 47899032, "url": "https://news.ycombinator.com/item?id=47899032", "by": "hhh", "date": "2026-04-24", "version": null, "stance": "neutral", "quote": "I used wireshark to capture the traffic", "excerpt": "I used wireshark to capture the traffic, and looked thru the pcap for the area that looked like the updating, and gave the packet numbers and the pcap to claude code to find the details of how it worked instead of scribbling notes for an hour or two i\u2019d guess I\u2019m very used to doing this stuff manually for various devices and software, but am also interested in tracking llm progress, and it seemed simple enough to get", "context": "", "use_case": "Packet capture", "switched_from": "", "story": "My audio interface has SSH enabled by default"}, {"id": 764765745, "item_id": 47797859, "url": "https://news.ycombinator.com/item?id=47797859", "by": "alexblackwell_", "date": "2026-04-16", "version": null, "stance": "compare", "quote": "closer to a MITM proxy like Proxyman than Wireshark", "excerpt": "Yep essentially. I would argue that we're probably closer to a MITM proxy like Proxyman than Wireshark. We don't do general packet sniffing (yet), although internally we use our own packet sniffing tools for reverse engineering on-prem installations.", "context": "", "use_case": "", "switched_from": "", "story": "Launch HN: Kampala (YC W26) \u2013 Reverse-Engineer Apps into APIs"}, {"id": 759592272, "item_id": 47474517, "url": "https://news.ycombinator.com/item?id=47474517", "by": "eru", "date": "2026-03-21", "version": null, "stance": "recommend", "quote": "", "excerpt": "> Flakey internet connection: most of current 'soy devs' would be useless. We used to make the same jokes about Googling Stackoverflow since before many users on this site were born.", "context": "", "use_case": "packet analysis", "switched_from": "", "story": "We rewrote our Rust WASM Parser in TypeScript \u2013 and it got 3x Faster"}, {"id": 758000209, "item_id": 47375013, "url": "https://news.ycombinator.com/item?id=47375013", "by": "gucci-on-fleek", "date": "2026-03-14", "version": null, "stance": "neutral", "quote": "tracing stuff with Wireshark", "excerpt": "Yes, you can simultaneously use full-quality source and sink (speaker and microphone) streams [0]. And from personal experience, this works exactly as you would expect. As you've seen, the documentation on LE Audio is rather horrible. The Android documentation [1] is semi-useful even on other platforms, and the official book [2] is also helpful if you're willing to wade through a ton of dense technical details, but t", "context": "", "use_case": "Packet capture", "switched_from": "", "story": "Wired headphone sales are exploding. What's with the Bluetooth backlash?"}, {"id": 751397312, "item_id": 46962332, "url": "https://news.ycombinator.com/item?id=46962332", "by": "n1sni", "date": "2026-02-10", "version": null, "stance": "neutral", "quote": "I use stuff outside the app store every day (Wireshark, Ekahau, etc.)", "excerpt": "I have considered it, but it would lose a lot of features. It would have to be a \"lite\" version. To get what we need, we would have to use an external device (think Raspberry Pi) to get the information needed. It's something we are looking at... but as a network guy, I use stuff outside the app store every day (Wireshark, Ekahau, etc.) and have no issue with it.", "context": "", "use_case": "", "switched_from": "", "story": "Show HN: I built a macOS tool for network engineers \u2013 it's called NetViews"}, {"id": 749662402, "item_id": 46853900, "url": "https://news.ycombinator.com/item?id=46853900", "by": "efreak", "date": "2026-02-02", "version": null, "stance": "neutral", "quote": "", "excerpt": "I used to love Zone Alarm's ability to notify me on an application's first attempt to connect to the internet, and allow me to approve or deny it. I really wish there was still such an interface today. Having said that, I absolutely despised the implementation that stole keyboard focus; if it popped up when I was typing it frequently disappeared before I head a chance to read it and I had to go into settings to try a", "context": "", "use_case": "", "switched_from": "", "story": "Notepad++ hijacked by state-sponsored actors"}, {"id": 749629185, "item_id": 46851824, "url": "https://news.ycombinator.com/item?id=46851824", "by": "guessmyname", "date": "2026-02-01", "version": null, "stance": "recommend", "quote": "You can easily inspect the packet with tools like Wireshark or Burp Suite Professional", "excerpt": "I don\u2019t get it, why don\u2019t you all\u2014absolutely all of you reading\u2014use Little Snitch? [1] It really doesn\u2019t compute in my head why would any macOS user not use a network firewall like this, or similar, to block unwanted outgoing HTTP(s) requests. You can easily inspect the packet with tools like Wireshark or Burp Suite Professional (or Community) edition, or any other proxy tool, of which there are many in the macOS eco", "context": "", "use_case": "", "switched_from": "", "story": "Notepad++ hijacked by state-sponsored actors"}, {"id": 747847201, "item_id": 46740450, "url": "https://news.ycombinator.com/item?id=46740450", "by": "gerdesj", "date": "2026-01-23", "version": null, "stance": "recommend", "quote": "After that you will need nmap and wireshark.", "excerpt": "Good skills - you are well on the way to Engineer with a capital E. You cannot see network traffic. You'd be amazed at how many people think they can diagnose a network fault without using tools like this. Everyone is an expert until they prove themselves to be a bit of a twit! At layer 1 you have electrical issues to deal with and that will need some hardware. Obviously you need to pick your network model too. Here ", "context": "", "use_case": "network diagnosis", "switched_from": "", "story": "Show HN: Whosthere: A LAN discovery tool with a modern TUI, written in Go"}, {"id": 747750768, "item_id": 46734423, "url": "https://news.ycombinator.com/item?id=46734423", "by": "Nauxuron", "date": "2026-01-23", "version": null, "stance": "neutral", "quote": "Wireshark can import those to decrypt everything.", "excerpt": "This really does not need to be that hard. For TLS, many tools support setting the SSLKEYLOGFILE environment variable to log the session keys used in connections. Wireshark can import those to decrypt everything. [1] Unfortunately, nothing exists for SSH (yet?). [2] I do agree that if you design a protocol that enforces encryption, you should include some debugging interface. It is much more straightforward to do thi", "context": "", "use_case": "Packet capture and decryption", "switched_from": "", "story": "Why does SSH send 100 packets per keystroke?"}, {"id": 747648384, "item_id": 46728024, "url": "https://news.ycombinator.com/item?id=46728024", "by": "JohnLeitch", "date": "2026-01-22", "version": null, "stance": "recommend", "quote": "This is how it handles TLS decryption [1], which works beautifully.", "excerpt": ">Is that because wireshark can't do that just from packet captures? Well, not quite. I think it's more that nobody has taken the time to implement it. That's not to say such an implementation would automatically decrypt the traffic from a capture with no extra leg work, of course. Wireshark dissectors have user configurable preferences, and presumably this would be where captured secrets could be set for use. This is", "context": "", "use_case": "Packet analysis", "switched_from": "", "story": "Why does SSH send 100 packets per keystroke?"}, {"id": 747146976, "item_id": 46696686, "url": "https://news.ycombinator.com/item?id=46696686", "by": "loeg", "date": "2026-01-20", "version": null, "stance": "neutral", "quote": "https://github.com/antmicro/wireshark-pcie-dissector", "excerpt": "https://github.com/antmicro/wireshark-pcie-dissector or https://github.com/sora/wireshark-pcie/blob/master/plugins/pcie.lua (The PCIe wire format consists of TLPs and DLLPs. Context: https://xillybus.com/tutorials/pci-express-tlp-pcie-primer-tutorial-guide-2 )", "context": "", "use_case": "PCIe packet analysis", "switched_from": "", "story": "Linux kernel framework for PCIe device emulation, in userspace"}, {"id": 742207715, "item_id": 46387982, "url": "https://news.ycombinator.com/item?id=46387982", "by": "gettingoverit", "date": "2025-12-25", "version": null, "stance": "neutral", "quote": "Spin up Wireshark and take a look at activity of Firefox.", "excerpt": "It isn't competitive. They are paid by Google. Worse, it's ridden with spyware, and is merely a honeypot for security-aware people that are not sufficiently paranoid to check any of the claims. Like, those VPNs from YT ads that use your IP to give AI companies residential proxies, the same kind of scam. Spin up Wireshark and take a look at activity of Firefox. Try to shut the browser up. It won't work. Even if they w", "context": "", "use_case": "", "switched_from": "", "story": "Mattermost restricted access to old messages after 10000 limit is reached"}, {"id": 741346482, "item_id": 46334155, "url": "https://news.ycombinator.com/item?id=46334155", "by": "cientifico", "date": "2025-12-19", "version": null, "stance": "compare", "quote": "but that is too generic and with a bigger learning curve.", "excerpt": "One hidden gem. The closest free alternative is https://www.mitmproxy.org/ that is not even close. And off course, https://www.wireshark.org/ but that is too generic and with a bigger learning curve. Worth the money. And no subscription (or there weren't a subscription back then)", "context": "", "use_case": "", "switched_from": "", "story": "Charles Proxy"}, {"id": 736678721, "item_id": 46042420, "url": "https://news.ycombinator.com/item?id=46042420", "by": "Joel_Mckay", "date": "2025-11-24", "version": null, "stance": "neutral", "quote": "Dumping local traffic with wireshark or iftop", "excerpt": ">I don't have a filter list for compromised proxy servers and VPNs. Someone just joined the nuisance forums, and grabs the same Socks/Telegram proxy list they all use (mostly old infected/open servers.) When it comes to firewall rules it is a sensitive matter, and depends on the firewall setup (black-hole bans are generally considered rude, as even handshakes are lost.) For fairly recent personal ban lists could try:", "context": "", "use_case": "", "switched_from": "", "story": "The Cloudflare outage might be a good thing"}, {"id": 736352930, "item_id": 46022058, "url": "https://news.ycombinator.com/item?id=46022058", "by": "rft", "date": "2025-11-23", "version": null, "stance": "neutral", "quote": "TCP retransmits in Wireshark", "excerpt": "At this point escalating, or threatening to, might be the better option. But I can't help trying to figure out how to solve a people/organizational problem with a technological solution. Github is still famously IPv4 only. I don't know if there is a split between the SSH (if you use SSH to access the repos) and HTTPS (the tarballs) setup on their end, so maybe you get full speed on IPv6 and limited on IPv4 (or the ot", "context": "", "use_case": "Packet capture", "switched_from": "", "story": "A monopoly ISP refuses to fix upstream infrastructure"}, {"id": 735251986, "item_id": 45953249, "url": "https://news.ycombinator.com/item?id=45953249", "by": "mananaysiempre", "date": "2025-11-17", "version": null, "stance": "neutral", "quote": "In Wireshark, the latter appears as ICMPv4 packets on the lo interface", "excerpt": "I think I know what's going on: iputils[1] ping can't ping IPv6-mapped IPv4 addresses, but inetutils[2] ping can. And look inside the parens: $ ping ::ffff:127.0.0.1 PING ::ffff:127.0.0.1 (::ffff:127.0.0.1) 56 data bytes says the non-working one, $ ping ::ffff:127.0.0.1 PING ::ffff:127.0.0.1 (127.0.0.1): 56 data bytes says the working one. In Wireshark, the latter appears as ICMPv4 packets on the lo interface, wherea", "context": "", "use_case": "packet capture", "switched_from": "", "story": "SocketAddrV6 is not roundtrip serializable"}, {"id": 733349856, "item_id": 45834366, "url": "https://news.ycombinator.com/item?id=45834366", "by": "bartread", "date": "2025-11-06", "version": null, "stance": "recommend", "quote": "I ended up installing Wireshark to see why he was experiencing massive latency", "excerpt": "I don't know that it ever held that much water. I used to work for a company building desktop tools that were distributed to, depending on the tool, on the low end tens of thousands of users, and on the high end, hundreds of thousands. We had one tool that was nominally used by about a million people but, in actuality, the real number of active users each month was more like 300k. I was at the company for 10 years an", "context": "", "use_case": "", "switched_from": "", "story": "AI's Dial-Up Era"}, {"id": 733089585, "item_id": 45818099, "url": "https://news.ycombinator.com/item?id=45818099", "by": "z3ugma", "date": "2025-11-04", "version": null, "stance": "neutral", "quote": "discovered through WireShark", "excerpt": "After you flash the exploit and SSH into the thermostat you can see it at https://github.com/codykociemba/NoLongerEvil-Thermostat/issues/8#issuecomment-3487833119 It's a boot script called /bin/nolongerevil.sh that supplies its own trust material and redirects traffic intended for frontdoor.nest.com to a hard-coded IP 15.204.110.215. 99.9% of this image is the original copyrighted Nest image. Maybe it's enough for th", "context": "", "use_case": "network traffic analysis", "switched_from": "", "story": "NoLongerEvil-Thermostat \u2013 Nest Generation 1 and 2 Firmware"}]}