@@ -27,7 +27,7 @@ detail.
2727### Application problems
2828
2929To start debugging such problems, it helps to understand how Zui opens flows
30- extracted from pcaps. Once the [ 5-tuple] ( https://nordvpn.com/cybersecurity/glossary/5-tuple/ ) , connection start time, and connection
30+ extracted from pcaps. Once the 5-tuple, connection start time, and connection
3131duration are isolated from the Zeek ` conn ` record for the flow, Zui
3232invokes ` brimcap search ` to extract the packets for the target flow
3333into a temporary file. Once this temporary file has been written to the local
@@ -86,8 +86,7 @@ Stream_ or _Follow UDP Stream_, which will apply a filter of the format
8686` tcp.stream eq N ` or ` udp.stream eq N ` , where ` N ` is a number ` 0 ` , ` 1 ` , etc.
8787based on which flow within the pcap is being isolated. When this is done,
8888Wireshark appears to treat all packets as part of the same flow if they
89- share the same [ 5-tuple] ( https://nordvpn.com/cybersecurity/glossary/5-tuple/ ) ,
90- regardless of how long the flow lasts.
89+ share the same 5-tuple, regardless of how long the flow lasts.
9190
9291To similarly attempt to isolate flows, Zui relies on Zeek's ` conn ` event,
9392which includes the ` id ` and ` proto ` fields that capture the 5-tuple for a
0 commit comments