Nurah.lee

  Mark the packets File, export specified packets Windows above shown Select packet range n save the file

Ref:  https://www.securitronlinux.com/bejiitaswrath/filter-for-a-specific-time-frame-in-wireshark/

How to open Wireshark in Dark Mode. Download the latest Wireshark software. Open a command prompt and type this command  "C:\Program Files\Wireshark\Wireshark.exe" -platform windows:darkmode=2   Yay! Wireshark Dark Mode References: 

https://www.wireshark.org/lists/wireshark-users/201004/msg00032.html Tim Black wrote: > I would love to be able to customize the display of packets in an absolute > fashion, e.g. "Ignore this one" or "show only this one and this one". To me > this means there would be a Display Filter field for packet number. Is there > support for this hiding from me somewhere, or if not, is there at least a > plan to support this? To be clear, I am talking about Display Filtering by > the leftmost column entitled "No.". I hope this is not also the answer to my > question. ;-) How about Ctrl-M to mark either the packets you want to display, or the packets you want to ignore. Then: "frame.marked == 1" to display only the marked packets, or "frame.marked == 0" to ignore the marked packets and display only the unmarked packets.

Reference : https://osqa-ask.wireshark.org/questions/20423/pshack-wireshark-capture/ This is basic TCP communications flow. The ACK indicates that a host is acknowledging having received some data, and the PSH,ACK indicates the host is acknowledging receipt of some previous data and also transmitting some more data. Google will let you search for more info about basic TCP communication.   ACK means that the machine sending the packet with ACK is acknowledging data that it had received from the other machine. In TCP, once the connection is established,   all   packets sent by either side will contain an ACK, even if it's just re-acknowledging data that it's already acknowledged. PSH is an indication by the sender that, if the receiving machine's TCP implementation has not yet provided the data it's received to the code that's reading the data (program, or library used by a program), it should do so at that point. To quote  RFC 793 , the official specification for TCP