Book Image

Wireshark 2 Quick Start Guide

By : Charit Mishra
Book Image

Wireshark 2 Quick Start Guide

By: Charit Mishra

Overview of this book

<p>Wireshark is an open source protocol analyser, commonly used among the network and security professionals. Currently being developed and maintained by volunteer contributions of networking experts from all over the globe. Wireshark is mainly used to analyze network traffic, analyse network issues, analyse protocol behaviour, etc. - it lets you see what's going on in your network at a granular level. This book takes you from the basics of the Wireshark environment to detecting and resolving network anomalies.</p> <p>This book will start from the basics of setting up your Wireshark environment and will walk you through the fundamentals of networking and packet analysis. As you make your way through the chapters, you will discover different ways to analyse network traffic through creation and usage of filters and statistical features. You will look at network security packet analysis, command-line utilities, and other advanced tools that will come in handy when working with day-to-day network operations.</p> <p>By the end of this book, you have enough skill with Wireshark 2 to overcome real-world network challenges.</p>
Table of Contents (14 chapters)
Title Page
Packt Upsell
Contributors
Preface
8
Mastering the Advanced Features of Wireshark
Index

Capture filters


Capture filters enable you to capture only traffic that you want to be captured, eliminating an unwanted stream of packets. Capturing packets is a processor-intensive task, and packet analyzers use a good amount of primary memory while they are running.

Packets are only sent to the capture engine if they meet a certain criterion (capture filter expressions). Capture filters do not facilitate advanced filtering options, as in display filters.

The following is a screenshot of the Capture Options window dialog:

The Capture Options dialog

Let's take a walk through the options available in the Capture dialog window:

  • Capture (under input tab): Its purpose is to choose which interface you wish to listen on; multiple interfaces can also be selected to run in parallel. The details for every interface are listed under separate columns, such as Capture, Interface, the name of the interface, whether the promiscuous mode is enabled or not, and so on. Under the Capture dialog, you will see...