challenge.101 3.4 question How many frames have the TCP SYN bit set to 1? frame matches"(?!)set-cookie" is in the display filter when I hit enter it the sample capture comes in blank. How do I get the capture to display ?
When a filter is 'green', it means that there is no syntax error in the filter itself. The result can still be empty.
Only if you filter for something that is actually present in the capture, the list won't be 'blank'.
TCP SYN bit set to 1: tcp.flags.syn==1
frame matches"(?!)set-cookie": did you mean contains? "(?!)" = Negative Lookahead, why?
If filtering from challenge 3-1 q&a why would the capture be blank ?
If filtering from challenge 3-1 q&a
As asked before: where does the challenge question comes from?
why would the capture be blank ?
Only if you filter for something that is actually present in the capture, the list won't be 'blank'.
What you mean where the question comes from. The question is How many frames comes to and from 80.78.246.209. This is just a simple ip.addr==80.78.246.209 I apply the filter and the capture comes back blank.
What you mean where the question comes from.
To quote grahamb comment on May 28th: "Can you add a link to the website where the challenge question comes from?"
You cannot assume we know about all challenges / trainings / courses / books out there that contain the word "Wireshark" in the title... So if you want support on a network capture you'll have to provide that here by sharing a link.
So you used ip.addr==80.78.246.209 as a display filter, then the answer is still valid:
Comments
Can you add a link to the website where the challenge question comes from?