Book Image

Wireshark 2 Quick Start Guide

By : Charit Mishra
Book Image

Wireshark 2 Quick Start Guide

By: Charit Mishra

Overview of this book

<p>Wireshark is an open source protocol analyser, commonly used among the network and security professionals. Currently being developed and maintained by volunteer contributions of networking experts from all over the globe. Wireshark is mainly used to analyze network traffic, analyse network issues, analyse protocol behaviour, etc. - it lets you see what's going on in your network at a granular level. This book takes you from the basics of the Wireshark environment to detecting and resolving network anomalies.</p> <p>This book will start from the basics of setting up your Wireshark environment and will walk you through the fundamentals of networking and packet analysis. As you make your way through the chapters, you will discover different ways to analyse network traffic through creation and usage of filters and statistical features. You will look at network security packet analysis, command-line utilities, and other advanced tools that will come in handy when working with day-to-day network operations.</p> <p>By the end of this book, you have enough skill with Wireshark 2 to overcome real-world network challenges.</p>
Table of Contents (14 chapters)
Title Page
Packt Upsell
Contributors
Preface
8
Mastering the Advanced Features of Wireshark
Index

Summary


Filtering traffic lets you capture and see only stream of packets you want; there are two types of filters: display filters and capture filters.

Display filters hide the packets; however, capture filters discard the packets that do not meet user defined expression and discarded packets are not passed to the capturing engine.

Capture filters use the BPF syntax, which is an industry standard and is used by several other protocol analyzers.

Find utility is useful and can be accessed from the Edit menu in Wireshark. The Find utility gives various vectors to search a packet(s) and related details.

Coloring preferences comes handy when filtering a set of traffic. Distinguishing packets becomes easy, as the matched packets will be displayed with a unique coloring scheme.

Profiles are like virtual scenarios that saves time and efforts. Changes made to a profile with respect to display/capture filter and color/protocol/time preferences, stays within the same.