Skip to content

Commit 8ab7020

Browse files
authored
Stop using a link when we mention 5-tuples (#358)
1 parent 0ee5faf commit 8ab7020

File tree

1 file changed

+2
-3
lines changed

1 file changed

+2
-3
lines changed

docs/Troubleshooting.md

Lines changed: 2 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -27,7 +27,7 @@ detail.
2727
### Application problems
2828

2929
To start debugging such problems, it helps to understand how Zui opens flows
30-
extracted from pcaps. Once the [5-tuple](https://nordvpn.com/cybersecurity/glossary/5-tuple/), connection start time, and connection
30+
extracted from pcaps. Once the 5-tuple, connection start time, and connection
3131
duration are isolated from the Zeek `conn` record for the flow, Zui
3232
invokes `brimcap search` to extract the packets for the target flow
3333
into a temporary file. Once this temporary file has been written to the local
@@ -86,8 +86,7 @@ Stream_ or _Follow UDP Stream_, which will apply a filter of the format
8686
`tcp.stream eq N` or `udp.stream eq N`, where `N` is a number `0`, `1`, etc.
8787
based on which flow within the pcap is being isolated. When this is done,
8888
Wireshark appears to treat all packets as part of the same flow if they
89-
share the same [5-tuple](https://nordvpn.com/cybersecurity/glossary/5-tuple/),
90-
regardless of how long the flow lasts.
89+
share the same 5-tuple, regardless of how long the flow lasts.
9190

9291
To similarly attempt to isolate flows, Zui relies on Zeek's `conn` event,
9392
which includes the `id` and `proto` fields that capture the 5-tuple for a

0 commit comments

Comments
 (0)