Sake Blok
LightNews LightNews
banner
syn-bit.nl
Sake Blok
@syn-bit.nl
160 followers 220 following 100 posts
Relational therapist for computer systems with a passion for Network Analysis, Protocol Analysis, bug chasing and problem solving. (he/him)
Posts Replies Media Videos
syn-bit.nl
The past two days there were pre-conference classes, but we’re now officially started. Hello Warsaw, here is #sf25eu
November 5, 2025 at 8:12 AM
syn-bit.nl
Ready for my first #NLNOG day, which will start any minute now (after a non-network technical issue )
NLNOG stage with sponsor banners and speaker desk, people setting Klup for the first session
September 30, 2025 at 7:37 AM
syn-bit.nl
Heldere docu over het ontstaan en de verspreiding van PFAS, thanks.

We wonen nou niet echt op een handige plek zo te zien :-(

Petetie getekend!
July 28, 2025 at 10:20 AM
syn-bit.nl
June 11, 2025 at 10:56 PM
syn-bit.nl
He has a good point!
June 11, 2025 at 6:45 PM
syn-bit.nl
While indeed there is no Export menu item for TLS certificates, pointing to a certificate in the packet details and then using "export packet bytes" can easily export a certificate from a pcap(ng) file...
May 5, 2025 at 4:57 PM
syn-bit.nl
Ja maar... die wil ik ook!

....

10 minuten later:
April 25, 2025 at 4:37 PM
syn-bit.nl
Oh nice, I did not know you can add multiple ‘-a <file>’ arguments…. TIL 💪🏻
sake@Mac16:~$ echo "Test" | tee -a f1 -a f2 -a f3 Test sake@Mac16:~$ cat f? Test Test Test sake@Mac16:~$
April 15, 2025 at 2:26 PM
syn-bit.nl
(had to use translate as my German is not that good, so responding in Englis)

Yes, you can use the '-T fields' option to only print certain fields and then use '-e tcp.payload' to print the content of each TCP segment. The output is in hex, so you might want to post process through 'xxd -r -p'
sake@Mac16:~/_tmp$ for line in $(tshark -r mqtt.pcapng -Y 'tcp.len>2' -T fields -e tcp.payload ); do echo $line | xxd -r -p; echo ""; done | head 0hoera10jaar/wageningengreen 0hoera10jaar/denhaagred 0hoera10jaar/denhaaggreen 0oera10jaar/wageningenred 0hoera10jaar/denhaagred 0hoera10jaar/heerlenred 0hoera10jaar/amsterdamred 0hoera10jaar/denhaaggreen 0hoera10jaar/arnhemgreen 0oera10jaar/enschedegreen sake@Mac16:~/_tmp$
April 14, 2025 at 5:33 PM
syn-bit.nl
Yay! My Stratoshark talk for the #NLUUG spring conference on May 22nd in Utrecht has been accepted.

Looking forward to see you there for an introduction to #Stratoshark and how it can be to system calls what #Wireshark is to network packets.

See: nluug.nl/evenementen/...
Stratoshark logo
March 14, 2025 at 1:37 PM
syn-bit.nl
Are you worried about being able to create them? Or about the working of large BPF filters when using them. Creating them is no problem, see this example of an 8100 element BPF filter (in bash on MacOS).

I have no real life experience with the performance, but there will be (a small) impact.
sake@Mac16:~/_tmp$ for i in {10..99}; do for j in {10..99}; do echo "ether host 00:00:00:00:$i:$j"; done; done | awk '{printf("%s%s",sep,$0);sep=" or "}' | wc 0 32399 259196 sake@Mac16:~/_tmp$ tshark -ien0 -w x.pcapng -f "$(for i in {10..99}; do for j in {10..99}; do echo "ether host 00:00:00:00:$i:$j"; done; done | awk '{printf("%s%s",sep,$0);sep=" or "}')" Capturing on 'Wi-Fi: en0' ^C sake@Mac16:~/_tmp$ sake@Mac16:~/_tmp$
February 23, 2025 at 3:49 PM
syn-bit.nl
Happy little coincidences :-)
January 7, 2025 at 7:56 AM
syn-bit.nl
Dank voor de tip, ga ik naar kijken.

Bij meshtastic staat een link naar de T-echo, die lijkt me ook wel wat. Ook wel handig formaat voor eventueel minder tech-savvies (zoals mijn moeder).

meshtastic.org/docs/hardwar...
November 30, 2024 at 12:23 PM