Sign In Start Free Trial

Book Overview & Buying
Table Of Contents

Wireshark Essentials

By : James H. Baxter

3.8 (5)

Wireshark Essentials

3.8 (5)

By: James H. Baxter

Overview of this book

This book is aimed at IT professionals who want to develop or enhance their packet analysis skills. Basic familiarity with common network and application services terms and technologies is assumed; however, expertise in advanced networking topics or protocols is not required. Readers in any IT field can develop the analysis skills specifically needed to complement and support their respective areas of responsibility and interest.

Preface

Preface

What this book covers

What you need for this book

Who this book is for

Conventions

Reader feedback

Customer support

Free Chapter

1. Getting Acquainted with Wireshark

1. Getting Acquainted with Wireshark

Installing Wireshark

Performing your first packet capture

Summary

2. Networking for Packet Analysts

2. Networking for Packet Analysts

The OSI model – why it matters

IP networks and subnets

Switching and routing packets

WAN links

Wireless networking

Summary

3. Capturing All the Right Packets

3. Capturing All the Right Packets

Picking the best capture point

Test Access Ports and switch port mirroring

Capturing interfaces, filters, and options

Verifying a good capture

Saving the bulk capture file

Isolating conversations of interest

Using the Conversations window

Wireshark display filters

Filter Expression Buttons

Following TCP/UDP/SSL streams

Marking and ignoring packets

Saving the filtered traffic

Summary

4. Configuring Wireshark

4. Configuring Wireshark

Working with packet timestamps

Colorization and coloring rules

Wireshark preferences

Wireshark profiles

Summary

5. Network Protocols

5. Network Protocols

The OSI and DARPA reference models

Transport layer protocols

Application layer protocols

Summary

6. Troubleshooting and Performance Analysis

6. Troubleshooting and Performance Analysis

Troubleshooting methodology

Troubleshooting connectivity issues

Troubleshooting functional issues

Performance analysis methodology

Summary

7. Packet Analysis for Security Tasks

7. Packet Analysis for Security Tasks

Security analysis methodology

Security assessment tools

Identifying unacceptable or suspicious traffic

Scans and sweeps

OS fingerprinting

Malformed packets

Phone home traffic

Password-cracking traffic

Unusual traffic

Summary

8. Command-line and Other Utilities

8. Command-line and Other Utilities

Wireshark command-line utilities

Capturing traffic with Dumpcap

Capturing traffic with Tshark

Editing trace files with Editcap

Merging trace files with Mergecap

Other helpful tools

Summary

Index

Index

Troubleshooting methodology

There are two fundamental reasons why you might be doing packet analysis:

Troubleshooting a connectivity or functionality problem (a user can't connect, an application doesn't work, or doesn't work right), which we'll just call troubleshooting
Analyzing a performance problem (the application works but is slow), which we'll call performance analysis

A third gray area is an application that basically works but is slow and occasionally times out, which could involve an underlying functional problem that causes the performance issue, or just simply be a really poor performance.

Troubleshooting a connectivity or functional issue is just a matter of comparing what normally works with what is going on, in the case you're working on.

A performance problem, on the other hand, requires determining where the majority of the time for a particular transaction to complete is being spent, measuring the delay and comparing that delay to what is normal...

CONTINUE READING

83

Tech Concepts

36

Programming languages

73

Tech Tools

Unlimited access to the largest independent learning library in tech of over 8,000 expert-authored tech books and videos.

Innovative learning tools, including AI book assistants, code context explainers, and text-to-speech.

50+ new titles added per month and exclusive early access to books as they are being written.

Wireshark Essentials

Search

Your notes and bookmarks