Book Image

Wireshark 2 Quick Start Guide

By : Charit Mishra
Book Image

Wireshark 2 Quick Start Guide

By: Charit Mishra

Overview of this book

<p>Wireshark is an open source protocol analyser, commonly used among the network and security professionals. Currently being developed and maintained by volunteer contributions of networking experts from all over the globe. Wireshark is mainly used to analyze network traffic, analyse network issues, analyse protocol behaviour, etc. - it lets you see what's going on in your network at a granular level. This book takes you from the basics of the Wireshark environment to detecting and resolving network anomalies.</p> <p>This book will start from the basics of setting up your Wireshark environment and will walk you through the fundamentals of networking and packet analysis. As you make your way through the chapters, you will discover different ways to analyse network traffic through creation and usage of filters and statistical features. You will look at network security packet analysis, command-line utilities, and other advanced tools that will come in handy when working with day-to-day network operations.</p> <p>By the end of this book, you have enough skill with Wireshark 2 to overcome real-world network challenges.</p>
Table of Contents (14 chapters)
Title Page
Packt Upsell
Contributors
Preface
8
Mastering the Advanced Features of Wireshark
Index

Capturing methodologies


In order to capture the right set of a packets stream, you would need to know where to place your protocol analyser. Depending on the requirements (source of packets, number of packets, type of packets, and more), a protocol analyzer needs to be placed at a certain point in the network. Also, a few configuration changes in a network device may be necessary, such as switch configuration changes (mirroring is done in network switches to capture packets from one or more sources). The following sub sections discuss a few means of assessing the best way of configuring protocol analyses in certain types of topology.

Hub-based networks

It is relatively easy to sniff in a hub-based network topology, because you've got the freedom to place the sniffer at any place you want, as hubs are designed to broadcast each and every packet to all connected devices.

However, due to such design deficiencies, hub-based network topologies face issues in terms of overall performance. Network...