Sign In Start Free Trial

Book Overview & Buying
Table Of Contents

Wireshark Essentials

By : James H. Baxter

3.8 (5)

Wireshark Essentials

3.8 (5)

By: James H. Baxter

Overview of this book

This book is aimed at IT professionals who want to develop or enhance their packet analysis skills. Basic familiarity with common network and application services terms and technologies is assumed; however, expertise in advanced networking topics or protocols is not required. Readers in any IT field can develop the analysis skills specifically needed to complement and support their respective areas of responsibility and interest.

Preface

Preface

What this book covers

What you need for this book

Who this book is for

Conventions

Reader feedback

Customer support

Free Chapter

1. Getting Acquainted with Wireshark

1. Getting Acquainted with Wireshark

Installing Wireshark

Performing your first packet capture

Summary

2. Networking for Packet Analysts

2. Networking for Packet Analysts

The OSI model – why it matters

IP networks and subnets

Switching and routing packets

WAN links

Wireless networking

Summary

3. Capturing All the Right Packets

3. Capturing All the Right Packets

Picking the best capture point

Test Access Ports and switch port mirroring

Capturing interfaces, filters, and options

Verifying a good capture

Saving the bulk capture file

Isolating conversations of interest

Using the Conversations window

Wireshark display filters

Filter Expression Buttons

Following TCP/UDP/SSL streams

Marking and ignoring packets

Saving the filtered traffic

Summary

4. Configuring Wireshark

4. Configuring Wireshark

Working with packet timestamps

Colorization and coloring rules

Wireshark preferences

Wireshark profiles

Summary

5. Network Protocols

5. Network Protocols

The OSI and DARPA reference models

Transport layer protocols

Application layer protocols

Summary

6. Troubleshooting and Performance Analysis

6. Troubleshooting and Performance Analysis

Troubleshooting methodology

Troubleshooting connectivity issues

Troubleshooting functional issues

Performance analysis methodology

Summary

7. Packet Analysis for Security Tasks

7. Packet Analysis for Security Tasks

Security analysis methodology

Security assessment tools

Identifying unacceptable or suspicious traffic

Scans and sweeps

OS fingerprinting

Malformed packets

Phone home traffic

Password-cracking traffic

Unusual traffic

Summary

8. Command-line and Other Utilities

8. Command-line and Other Utilities

Wireshark command-line utilities

Capturing traffic with Dumpcap

Capturing traffic with Tshark

Editing trace files with Editcap

Merging trace files with Mergecap

Other helpful tools

Summary

Index

Index

Chapter 2. Networking for Packet Analysts

Packet analysis is all about analyzing how applications transfer useful data from point A to point B over networks. So, an understanding of how networks function is essential.

In this chapter, we will cover the following topics:

Why the seven-layer OSI model matters
IP networks and subnets
Switching and routing packets
Ethernet frames and switches
IP addresses and routers
WAN links
Wireless networking

The seven-layer OSI model will be mapped to the most common networking terms, and we'll review frames, switching, IP addressing, routing, and a few other networking topics of interest. The goal is to develop a mental model of networking that lends itself well to packet-level analysis.

CONTINUE READING

83

Tech Concepts

36

Programming languages

73

Tech Tools

Unlimited access to the largest independent learning library in tech of over 8,000 expert-authored tech books and videos.

Innovative learning tools, including AI book assistants, code context explainers, and text-to-speech.

50+ new titles added per month and exclusive early access to books as they are being written.

Wireshark Essentials

Search

Your notes and bookmarks