wireshark

Sure, it'll look bad in wireshark, but you can simply disable the reporting of OOO, and the stream is perfectly interpretable anyway.

While digging through everything is fun and worthwhile, this could have been checked much quicker with wireshark.

We can disprove the existence of strong encryption with a wireshark, but cannot prove it.

You can use a filter like these in wireshark GUI: ip.addr==127.0.0.1 But not in tcpdump $ sudo tcpdump 'ip.addr==127.0.0.1' syntax error.

Just as that's the advantage of text networking protocols over binary protocols (you can read them with wireshark or even use telnet).

I think that packet is encrypted, though -- at least, it looks like that in Wireshark to me.

I learned large swaths of SSLv3 and TLS just using Ethereal and later WireShark to watch handshakes.

My quick session with Wireshark and layman's protocol/crypto understanding says probably not.

Ah, my issue was I didn't have Wireshark installed, so tshark was not found.

And I suppose it adds another setup step to wireshark (if you need to debug neat bugs), but that's a set-it-up-once-and-forget-about-it thing.

You still essentially need Wireshark to read it.

Well, wireshark + decompilation of existing software.

You'd also need solid networking skills (which come in handy even in web dev; I'm annoyed/surprised that many "web developers" are unable to diagnose basic network issues with Wireshark).

I am mostly going off of what Wireshark's protocol decoders tell me, though, so I could be wrong.

Wireshark allows two different filtering languages in two different places, used at different times.

Other projects that lack bug bounties have found similar numbers of bugs (Wireshark and ClamAV to name a few) due to their complexity.