In this section, we'll take a look at the expert system in Wireshark, which is a great feature that not many people know about, and it allows you to easily find problems in a packet capture.
You can follow along with the capture that I'll use by downloading the same one off of the Wireshark website. There's a great section of their wiki called SampleCaptures
that allows you to download captures that have been submitted by the community:
What we'll do is search for errors, and the first one that comes up is cmp-in-http-with-errors-in-cmp-protocol.pcap.gz
. If you download that and extract it, you can open up the pcap
file and follow along:
Here, we have our pcap
file from the wiki, and there are two ways to get to the expert system. The first way is from the Analyze
menu. We click on Analyze
, and go to Expert Information
:
The second method is in the bottom left. As you can see in the following screenshot, it is a yellow colored icon:
This icon color will change based on the...