Simson L. Garfinkel

icon indicating a website link https://simson.net/ icon indicating an email [email protected]

icon company BasisTech, LLC icon location Somerville, MA icon location I'm an author, programmer, former associate professor, and a part-time US Government employee. That photo is more than 30 years old. ORCID 0000-0003-1294-283

Results 853 comments of Simson L. Garfinkel

Is there a way to find media file's HTTP link of non web browser app?

Hi. I do not understand what you mean by "media source file's HTTP link." Do you mean that you want to do a forensic analysis of a phone's memory and...

Is there a way to find media file's HTTP link of non web browser app?

I'm sorry. What do you mean by "media source file" ? Where is this file? How are you getting the IP packets? Could you please be more descriptive? Specifically: 1....

"Zero-length" frames result in incorrectly extracted streams

Can you give me an RFC reference for this TCP behavior? Thanks ---- Sent from my phone. > On Jan 3, 2017, at 8:27 AM, Phil Hagen wrote: > >...

"Zero-length" frames result in incorrectly extracted streams

Okay. I don’t think that I can fix this without packets, but if you submit a fix, I’m happy to look at it! > On Jan 4, 2017, at 10:15...

"Zero-length" frames result in incorrectly extracted streams

Please use my gmail address. > On Jan 5, 2017, at 12:31 PM, Phil Hagen wrote: > > The colleague who brought this to my attention has a pcap that...

"Zero-length" frames result in incorrectly extracted streams

What’s TSO? > On Dec 15, 2019, at 4:16 AM, alaertegv wrote: > > Hi, we are having same issue: the third segment has length zero, caused by TSO. We...

Unexpectedly large flow files generated

Thanks for your comments on this. I will appreciate any comments you have on the code. > On Sep 8, 2015, at 11:22 AM, FusionFC [email protected] wrote: > > When...

DFXML should indicate if a connection was closed or left open.

Agreed. Feel free to add it. Sent from my iPhone > On Sep 4, 2015, at 10:35 AM, Benjamen Meyer [email protected] wrote: > > Would be nice if it also...

[enhancement request] add functionality similar to "tcpdump -c count"

Sure. What would you like the option to do? DO you want to implement it? On Mar 21, 2014, at 7:04 AM, christias [email protected] wrote: > Hello, > > We...

[enhancement request] add functionality similar to "tcpdump -c count"

-c is already used for another option. On Mar 21, 2014, at 7:04 AM, christias [email protected] wrote: > Hello, > > We usually use tcpflow in our transparent proxy during...