3. Capturing All the Right Packets | Wireshark Essentials

Sign In Start Free Trial

Book Overview & Buying
Table Of Contents

Wireshark Essentials

By : James H. Baxter

3.8 (5)

Wireshark Essentials

3.8 (5)

By: James H. Baxter

Overview of this book

This book is aimed at IT professionals who want to develop or enhance their packet analysis skills. Basic familiarity with common network and application services terms and technologies is assumed; however, expertise in advanced networking topics or protocols is not required. Readers in any IT field can develop the analysis skills specifically needed to complement and support their respective areas of responsibility and interest.

Preface

Preface

What this book covers

What you need for this book

Who this book is for

Conventions

Reader feedback

Customer support

Free Chapter

1. Getting Acquainted with Wireshark

1. Getting Acquainted with Wireshark

Installing Wireshark

Performing your first packet capture

Summary

2. Networking for Packet Analysts

2. Networking for Packet Analysts

The OSI model – why it matters

IP networks and subnets

Switching and routing packets

WAN links

Wireless networking

Summary

3. Capturing All the Right Packets

3. Capturing All the Right Packets

Picking the best capture point

Test Access Ports and switch port mirroring

Capturing interfaces, filters, and options

Verifying a good capture

Saving the bulk capture file

Isolating conversations of interest

Using the Conversations window

Wireshark display filters

Filter Expression Buttons

Following TCP/UDP/SSL streams

Marking and ignoring packets

Saving the filtered traffic

Summary

4. Configuring Wireshark

4. Configuring Wireshark

Working with packet timestamps

Colorization and coloring rules

Wireshark preferences

Wireshark profiles

Summary

5. Network Protocols

5. Network Protocols

The OSI and DARPA reference models

Transport layer protocols

Application layer protocols

Summary

6. Troubleshooting and Performance Analysis

6. Troubleshooting and Performance Analysis

Troubleshooting methodology

Troubleshooting connectivity issues

Troubleshooting functional issues

Performance analysis methodology

Summary

7. Packet Analysis for Security Tasks

7. Packet Analysis for Security Tasks

Security analysis methodology

Security assessment tools

Identifying unacceptable or suspicious traffic

Scans and sweeps

OS fingerprinting

Malformed packets

Phone home traffic

Password-cracking traffic

Unusual traffic

Summary

8. Command-line and Other Utilities

8. Command-line and Other Utilities

Wireshark command-line utilities

Capturing traffic with Dumpcap

Capturing traffic with Tshark

Editing trace files with Editcap

Merging trace files with Mergecap

Other helpful tools

Summary

Index

Index

Verifying a good capture

After a capture is complete, you should scroll through and inspect the packets in the Packet List pane to ensure that you're seeing the traffic you were expecting—usually traffic to and from a specific host.

You should also ensure there were no dropped packets, which would be displayed in the Packet Information section of the Status Bar at the bottom center of the Wireshark user interface. Dropped packets indicate that Wireshark or the selected NIC could not keep up with the traffic volume and had to discard packets, which could of course affect the quality of your analysis. If dropped packets occur, you may need to use a higher performance workstation to perform the captures or select a lower traffic volume capture location.

CONTINUE READING

83

Tech Concepts

36

Programming languages

73

Tech Tools

Unlimited access to the largest independent learning library in tech of over 8,000 expert-authored tech books and videos.

Innovative learning tools, including AI book assistants, code context explainers, and text-to-speech.

50+ new titles added per month and exclusive early access to books as they are being written.

Wireshark Essentials

Search

Your notes and bookmarks