Wireshark has long since become the market standard for network analysis, and with the growth of the internet and TCP/IP-based networks, it became very popular for network analysis and troubleshooting, as well as for R&D engineering, to understand what is actually running over the network and what problems we face.
This book contains practical recipes on troubleshooting a data communications network. This second edition of the book focuses on Wireshark 2, which has already gained a lot of traction due to the enhanced features that it offers. The book expands on some of the subjects explored in the first edition, including TCP performance, network security, Wireless LANs, and how to use Wireshark for cloud and virtual system monitoring. You will learn how to analyze end-to-end IPv4 and IPv6 connectivity failures for unicast and multicast traffic using Wireshark. The book also includes Wireshark capture files so that you can practice what you've learned. You will understand the normal operation of email protocols and learn how to use Wireshark for basic analysis and troubleshooting. Using Wireshark, you will be able to troubleshoot common applications that are used in an enterprise network, such as NetBIOS and SMB protocols. Finally, you will also be able to measure network parameters, check for network problems caused by them, and solve them effectively. By the end of this book, you’ll know how to analyze traffic, how to find patterns of various offending traffic, and how to secure your network from them.
As the name of the book implies, this is a cookbook. It is a list of effective, targeted recipes on how to analyze networks. Every recipe targets a specific issue, how to use Wireshark for it, where to look for it, what to look for, and how to find the cause of the issue. To complete the picture, every recipe provides the theoretical foundations of the subject, in order to give the reader the required theoretical background.
You will see many examples in the book, and all of them are real-world cases. Some of them took me minutes to solve, some hours, and some took many days. But there is one process common to all of them: work systematically, use the proper tools, try to get inside the head of the application writer, and, as someone told me once, try to think like the network. Do this, use Wireshark, and you will get results. The purpose of this book is to try and get you there. Have fun!