Browse Library
Sign In Start Free Trial
Close icon Search icon
Account
Browse Library Sign In Start Free Trial

Add to playlist

Create a Playlist

Modal Close icon
You need to login to use this feature.
  • Book Overview & Buying Wireshark Essentials
  • Table Of Contents Toc
Wireshark Essentials

Wireshark Essentials

By : James H. Baxter
3.8 (5)
Buy this Book
close
close
Wireshark Essentials

Wireshark Essentials

3.8 (5)
By: James H. Baxter
Buy this Book

Overview of this book

This book is aimed at IT professionals who want to develop or enhance their packet analysis skills. Basic familiarity with common network and application services terms and technologies is assumed; however, expertise in advanced networking topics or protocols is not required. Readers in any IT field can develop the analysis skills specifically needed to complement and support their respective areas of responsibility and interest.
Table of Contents (10 chapters)
close
close
close
Preface
Icon
Preface
Icon
What this book covers
Icon
What you need for this book
Icon
Who this book is for
Icon
Conventions
Icon
Reader feedback
Icon
Customer support
Lock Free Chapter
1
1. Getting Acquainted with Wireshark
Icon
1. Getting Acquainted with Wireshark
Icon
Installing Wireshark
Icon
Performing your first packet capture
Icon
Summary
2
2. Networking for Packet Analysts
Icon
2. Networking for Packet Analysts
Icon
The OSI model – why it matters
Icon
IP networks and subnets
Icon
Switching and routing packets
Icon
WAN links
Icon
Wireless networking
Icon
Summary
3
3. Capturing All the Right Packets
Icon
3. Capturing All the Right Packets
Icon
Picking the best capture point
Icon
Test Access Ports and switch port mirroring
Icon
Capturing interfaces, filters, and options
Icon
Verifying a good capture
Icon
Saving the bulk capture file
Icon
Isolating conversations of interest
Icon
Using the Conversations window
Icon
Wireshark display filters
Icon
Filter Expression Buttons
Icon
Following TCP/UDP/SSL streams
Icon
Marking and ignoring packets
Icon
Saving the filtered traffic
Icon
Summary
4
4. Configuring Wireshark
chevron up
Icon
4. Configuring Wireshark
Icon
Working with packet timestamps
Icon
Colorization and coloring rules
Icon
Wireshark preferences
Icon
Wireshark profiles
Icon
Summary
5
5. Network Protocols
Icon
5. Network Protocols
Icon
The OSI and DARPA reference models
Icon
Transport layer protocols
Icon
Application layer protocols
Icon
Summary
6
6. Troubleshooting and Performance Analysis
Icon
6. Troubleshooting and Performance Analysis
Icon
Troubleshooting methodology
Icon
Troubleshooting connectivity issues
Icon
Troubleshooting functional issues
Icon
Performance analysis methodology
Icon
Summary
7
7. Packet Analysis for Security Tasks
Icon
7. Packet Analysis for Security Tasks
Icon
Security analysis methodology
Icon
Security assessment tools
Icon
Identifying unacceptable or suspicious traffic
Icon
Scans and sweeps
Icon
OS fingerprinting
Icon
Malformed packets
Icon
Phone home traffic
Icon
Password-cracking traffic
Icon
Unusual traffic
Icon
Summary
8
8. Command-line and Other Utilities
Icon
8. Command-line and Other Utilities
Icon
Wireshark command-line utilities
Icon
Capturing traffic with Dumpcap
Icon
Capturing traffic with Tshark
Icon
Editing trace files with Editcap
Icon
Merging trace files with Mergecap
Icon
Other helpful tools
Icon
Summary
9
Index
Icon
Index

Working with packet timestamps

Understanding how Wireshark handles time and using the right incarnation of packet timestamp displays is crucial to properly analyze packet flows and identify time-related anomalies.

How Wireshark saves timestamps

When packets are captured, Wireshark gives each packet a timestamp derived from the system clock of the machine from where the capture takes place. This timestamp is converted to Universal Coordinated Time (UTC) based on an offset calculated from the time zone setting and any Daylight Savings Time (DST) rules that apply for the capture machine, and then converted again to an epoch number (the UTC-based number of seconds since January 1, 1970). This is the time value that gets saved in the capture file for each packet. When Wireshark reads the capture file, it turns the epoch number back to the familiar date and time display, adjusted for the time zone and DST offsets for your machine.

This means that if a packet capture is conducted on a machine in...

CONTINUE READING
83
Tech Concepts
36
Programming languages
73
Tech Tools
Icon Unlimited access to the largest independent learning library in tech of over 8,000 expert-authored tech books and videos.
Icon Innovative learning tools, including AI book assistants, code context explainers, and text-to-speech.
Icon 50+ new titles added per month and exclusive early access to books as they are being written.
Wireshark Essentials
End of Section 4
Next Section
notes
bookmark Notes and Bookmarks search Search in title playlist Add to playlist font-size Font size

Change the font size

margin-width Margin width

Change margin width

day-mode Day/Sepia/Night Modes

Change background colour

Close icon Search
Country selected
Close icon Your notes and bookmarks

Confirmation

Modal Close icon
claim successful
Order Page Read Now

Buy this book with your credits?

Modal Close icon
Are you sure you want to buy this book with one of your credits?
Close
YES, BUY

Submit Your Feedback

Modal Close icon
Modal Close icon
Modal Close icon