[PDF] [PDF] Wireshark Users Guide

[PDF] Wireshark Users Guide

Under Debian you can install Wireshark using aptitude aptitude will handle any TShark - TShark is a command-line based network protocol analyzer

[PDF] Capturer le trafic réseau au niveau utilisateur avec Wireshark - inetdoc

Cet article est écrit avec DocBook XML sur un système Debian GNU/Linux Il est disponible en contemporaines Pour ce qui est des outils utilisateurs, on doit contrôler leur installation Ici, il s'agit outils wireshark ou tshark Détail des 

[PDF] Wireshark Users Guide: Version 350

Plugins Extensions - Extras for the Wireshark and TShark dissection engines Installing from debs under Debian, Ubuntu and other Debian derivatives

[PDF] Debian Reference

10 jan 2021 · 2 7 17 Converting or installing an alien binary package V:19, I:204 · 1329 , , network traffic analyzer (Tcpdump, console) wireshark · I:55

[PDF] Wireshark Users Guide - for Wireshark 19

Installing from deb's under Debian, Ubuntu and other Debian derivatives 14 2 5 3 D 3 tcpdump: Capturing with tcpdump for viewing with Wireshark

[PDF] Wireless Security of Public Wi-Fi

Installation of Aircrack Installation of Nmap ○ Raspbian is debian based, so use 'apt-get' ○ Other apps installed: tshark, nethogs, iperf 

[PDF] RTI Wireshark Getting Started Guide - RTI Community - Real-Time

2 4 Installing Wireshark on Linux (Debian) Systems 4 Ubuntu 14 04), while the Tshark package installs a terminal-based (non-GUI) version For more inform-

[PDF] Use tcpdump & wireshark to show DNS traffic 1 Tcpdump Open a

Explanation: -n Prevents tcpdump doing reverse DNS lookups on the packets it receives, Linux: Ubuntu / Debian: apt-get install xvnc4viewer MacOS X: 

[PDF] Wireshark Users Guide - DEIM (URV)

Use the following command to install Wireshark under Debian: apt-get install wireshark TShark - TShark is a command-line based network protocol analyzer

[PDF] Wireshark Users Guide

Under Debian you can install Wireshark using apt-get apt-get will handle any TShark - TShark is a command-line based network protocol analyzer

[PDF] install virtualbox

[PDF] install virtualbox mac

[PDF] installation

[PDF] installation box sfr voip ko

[PDF] installing chinese language pack windows 7

[PDF] installing english language pack windows 7

[PDF] installing language pack windows 7

[PDF] instance class java reflection

[PDF] instance method java

[PDF] instance method vs static method in sap abap

[PDF] instance method vs static method mongoose

[PDF] instance of a class static method

[PDF] instance variable vs static method

[PDF] instance vs static method performance

[PDF] instance vs static methods in abap

WiresharkUser's Guide

27488for Wireshark1.0.0

UlfLamping,

RichardSharpe, NSComputerSoftware andServicesP/L

EdWarnicke,

WiresharkUser's Guide:27488

forWireshark 1.0.0 byUlf Lamping,RichardSharpe, andEdWarnicke Copyright© 2004-2008UlfLamping RichardSharpeEd Warnicke

Permissionis grantedtocopy, distributeand/ormodify thisdocumentunder thetermsof theGNUGeneral PublicLicense,

Version2 oranylater versionpublishedby theFreeSoftware Foundation. Alllogos andtrademarksin thisdocumentare propertyoftheir respectiveowner.

Tableof Contents

Preface. ..............................................................................................................ix

1.Foreword ... .............................................................................................ix

2.Who shouldreadthis document?.. ... ... ... .......................................................x

3.Acknowledgements ... ................................................................................xi

4.About thisdocument. ... ... .........................................................................xii

5.Where togetthe latestcopyof thisdocument?. ... ... ... ... ... ... ..........................xiii

6.Providing feedbackaboutthis document.. ... ... ... ...........................................xiv

1.Introduction ... ...................................................................................................1

1.1.What isWireshark?. ... ... ..........................................................................1

1.1.1.Some intendedpurposes. ... ... ..........................................................1

1.1.2.Features ... ...................................................................................1

1.1.3.Live capturefrommany differentnetworkmedia ... ... ... ... ... .................2

1.1.4.Import filesfrommany othercaptureprograms ... ... ... ... ... ...................2

1.1.5.Export filesformany othercaptureprograms ... ... ... ... ... ......................2

1.1.6.Many protocoldecoders. ... ... ..........................................................2

1.1.7.Open SourceSoftware. ... ... ............................................................2

1.1.8.What Wiresharkisnot ... ... ... ..........................................................3

1.2.System Requirements.. ... ..........................................................................4

1.2.1.General Remarks.. ... .....................................................................4

1.2.2.Microsoft Windows.. ... ..................................................................4

1.2.3.Unix /Linux. ... ... .........................................................................5

1.3.Where togetWireshark? ... ... ... .................................................................6

1.4.A briefhistoryof Wireshark.. ... ... ... ...........................................................7

1.5.Development andmaintenanceof Wireshark.. ... ... ... .....................................8

1.6.Reporting problemsandgetting help.. ... ... ... ................................................9

1.6.1.Website ... ...................................................................................9

1.6.2.Wiki ... ........................................................................................9

1.6.3.FAQ ... ........................................................................................9

1.6.4.Mailing Lists.. ... ..........................................................................9

1.6.5.Reporting Problems.. ... .................................................................10

1.6.6.Reporting CrashesonUNIX/Linux platforms.. ... ... ... .........................10

1.6.7.Reporting CrashesonWindows platforms.. ... ... ... .............................11

2.Building andInstallingWireshark ... ... ... ...............................................................13

2.1.Introduction ... .......................................................................................13

2.2.Obtaining thesourceand binarydistributions. ... ... ... ... ..................................14

2.3.Before youbuildWireshark underUNIX. ... ... ... ... .......................................15

2.4.Building Wiresharkfromsource underUNIX. ... ... ... ... .................................17

2.5.Installing thebinariesunder UNIX.. ... ... ... .................................................18

2.5.1.Installing fromrpm'sunder RedHatand alike.. ... ... ... ... ... ..................18

2.5.2.Installing fromdeb'sunder Debian.. ... ... ... .......................................18

2.5.3.Installing fromportageunder GentooLinux. ... ... ... ... .........................18

2.5.4.Installing frompackagesunder FreeBSD.. ... ... ... ...............................18

2.6.Troubleshooting duringtheinstall onUnix. ... ... ... ... .....................................19

2.7.Building fromsourceunder Windows.. ... ... ... .............................................20

2.8.Installing WiresharkunderWindows ... ... ... ................................................21

2.8.1.Install Wireshark.. ... ....................................................................21

2.8.2.Manual WinPcapInstallation. ... ... ..................................................23

2.8.3.Update Wireshark.. ... ...................................................................23

2.8.4.Update WinPcap.. ... .....................................................................23

2.8.5.Uninstall Wireshark.. ... ................................................................23

2.8.6.Uninstall WinPcap.. ... ..................................................................24

3.User Interface.. ... .............................................................................................26

3.1.Introduction ... .......................................................................................26

3.2.Start Wireshark.. ... .................................................................................27

3.3.The Mainwindow. ... ... ...........................................................................28

3.3.1.Main WindowNavigation. ... ... ......................................................29

3.4.The Menu.. ... ........................................................................................30

iv

3.5.The "File"menu. ... ... ..............................................................................31

3.6.The "Edit"menu. ... ... .............................................................................34

3.7.The "View"menu. ... ... ............................................................................36

3.8.The "Go"menu. ... ... ...............................................................................40

3.9.The "Capture"menu. ... ... ........................................................................42

3.10.The "Analyze"menu. ... ... ......................................................................44

3.11.The "Statistics"menu. ... ... .....................................................................46

3.12.The "Tools"menu. ... ... ..........................................................................49

3.13.The "Help"menu. ... ... ...........................................................................50

3.14.The "Main"toolbar. ... ... ........................................................................52

3.15.The "Filter"toolbar. ... ... ........................................................................55

3.16.The "PacketList"pane ... ... ... .................................................................56

3.17.The "PacketDetails"pane ... ... ... .............................................................57

3.18.The "PacketBytes"pane ... ... ... ...............................................................58

3.19.The Statusbar.. ... ..................................................................................59

4.Capturing LiveNetworkData ... ... ... ....................................................................62

4.1.Introduction ... .......................................................................................62

4.2.Prerequisites ... .......................................................................................63

4.3.Start Capturing.. ... .................................................................................64

4.4.The "CaptureInterfaces"dialog box.. ... ... ... ................................................65

4.5.The "CaptureOptions"dialog box.. ... ... ... ..................................................67

4.5.1.Capture frame.. ... ........................................................................67

4.5.2.Capture File(s)frame. ... ... .............................................................69

4.5.3.Stop Capture...frame. ... ... .............................................................69

4.5.4.Display Optionsframe. ... ... ...........................................................70

4.5.5.Name Resolutionframe. ... ... .........................................................70

4.5.6.Buttons ... ...................................................................................70

4.6.The "InterfaceDetails"dialog box.. ... ... ... ..................................................71

4.7.Capture filesandfile modes.. ... ... ... ..........................................................72

4.8.Link-layer headertype. ... ... .....................................................................74

4.9.Filtering whilecapturing. ... ... ...................................................................75

4.9.1.Automatic RemoteTrafficFiltering ... ... ... ........................................76

4.10.While aCaptureis running.... ... ... ... ... .....................................................78

4.10.1.Stop therunningcapture ... ... ... .....................................................78

4.10.2.Restart arunningcapture ... ... ... ....................................................79

5.File Input/Output andPrinting. ... ... ... ... ..............................................................81

5.1.Introduction ... .......................................................................................81

5.2.Open capturefiles. ... ... ...........................................................................82

5.2.1.The "OpenCaptureFile" dialogbox. ... ... ... ... ...................................82

5.2.2.Input FileFormats. ... ... .................................................................84

5.3.Saving capturedpackets. ... ... ...................................................................86

5.3.1.The "SaveCaptureFile As"dialogbox ... ... ... ... ... .............................86

5.3.2.Output FileFormats. ... ... ..............................................................88

5.4.Merging capturefiles. ... ... .......................................................................90

5.4.1.The "MergewithCapture File"dialogbox ... ... ... ... ... .........................90

5.5.File Sets.. ... ..........................................................................................92

5.5.1.The "ListFiles"dialog box.. ... ... ... .................................................92

5.6.Exporting data.. ... ..................................................................................94

5.6.1.The "ExportasPlain TextFile"dialog box.. ... ... ... ... ... ......................94

5.6.2.The "ExportasPostScript File"dialogbox ... ... ... ... ... ........................94

5.6.3.The "ExportasCSV (CommaSeparatedValues) File"dialogbox ... ... ... 95

5.6.4.The "ExportasC Arrays(packetbytes) file"dialogbox ... ... ... ... ... ... ... .96

5.6.5.The "ExportasPSML File"dialogbox ... ... ... ... ... .............................96

5.6.6.The "ExportasPDML File"dialogbox ... ... ... ... ... .............................96

5.6.7.The "Exportselectedpacket bytes"dialogbox ... ... ... ... ... ....................97

5.6.8.The "ExportObjects"dialog box.. ... ... ... ..........................................98

5.7.Printing packets.. ... ..............................................................................100

5.7.1.The "Print"dialogbox ... ... ... .......................................................100

5.8.The PacketRangeframe ... ... ... ...............................................................102

5.9.The PacketFormatframe ... ... ... ..............................................................103

6.Working withcapturedpackets ... ... ... .................................................................105

6.1.Viewing packetsyouhave captured.. ... ... ... ..............................................105

6.2.Pop-up menus.. ... .................................................................................107

WiresharkUser's Guide

v

6.2.1.Pop-up menuofthe "PacketList"pane ... ... ... ... ... ...........................107

6.2.2.Pop-up menuofthe "PacketDetails"pane ... ... ... ... ... .......................109

6.3.Filtering packetswhileviewing ... ... ... ......................................................112

6.4.Building displayfilterexpressions ... ... ... ..................................................114

6.4.1.Display filterfields. ... ... .............................................................114

6.4.2.Comparing values.. ... .................................................................114

6.4.3.Combining expressions.. ... ..........................................................116

6.4.4.A commonmistake. ... ... .............................................................117

6.5.The "FilterExpression"dialog box.. ... ... ... ...............................................118

6.6.Defining andsavingfilters ... ... ... ............................................................120

6.7.Defining andsavingfilter macros.. ... ... ... .................................................122

6.8.Finding packets.. ... ...............................................................................123

6.8.1.The "FindPacket"dialog box.. ... ... ... ............................................123

6.8.2.The "FindNext"command ... ... ... .................................................124

6.8.3.The "FindPrevious"command ... ... ... ............................................124

6.9.Go toaspecific packet.. ... ... ... ...............................................................125

6.9.1.The "GoBack"command ... ... ... ...................................................125

6.9.2.The "GoForward"command ... ... ... ..............................................125

6.9.3.The "GotoPacket" dialogbox. ... ... ... ... ........................................125

6.9.4.The "GotoCorresponding Packet"command. ... ... ... ... .....................125

6.9.5.The "GotoFirst Packet"command. ... ... ... ... ..................................125

6.9.6.The "GotoLast Packet"command. ... ... ... ... ...................................125

6.10.Marking packets.. ... ............................................................................126

6.11.Time displayformatsand timereferences. ... ... ... ... ...................................127

6.11.1.Packet timereferencing. ... ... ......................................................127

7.Advanced Topics.. ... .......................................................................................130

7.1.Introduction ... .....................................................................................130

7.2.Following TCPstreams. ... ... ..................................................................131

7.2.1.The "FollowTCPStream" dialogbox. ... ... ... ... ...............................131

7.3.Expert Infos.. ... ...................................................................................133

7.3.1.Expert InfoEntries. ... ... ..............................................................133

7.3.2."Expert InfoComposite"dialog ... ... ... ...........................................134

7.3.3."Colorized" ProtocolDetailsTree ... ... ... ........................................135

7.3.4."Expert" PacketListColumn (optional).. ... ... ... ..............................135

7.4.Time Stamps.. ... ..................................................................................136

7.4.1.Wireshark internals.. ... ...............................................................136

7.4.2.Capture fileformats. ... ... ............................................................136

7.4.3.Accuracy ... ...............................................................................136

7.5.Time Zones.. ... ....................................................................................138

7.5.1.Set yourcomputer'stime correctly!.. ... ... ... ....................................139

7.5.2.Wireshark andTimeZones ... ... ... .................................................139

7.6.Packet Reassembling.. ... .......................................................................141

7.6.1.What isit?. ... ... .........................................................................141

7.6.2.How Wiresharkhandlesit ... ... ... ..................................................141

7.7.Name Resolution.. ... .............................................................................143

7.7.1.Name Resolutiondrawbacks. ... ... .................................................143

7.7.2.Ethernet nameresolution(MAC layer).. ... ... ... ................................143

7.7.3.IP nameresolution(network layer).. ... ... ... .....................................144

7.7.4.IPX nameresolution(network layer).. ... ... ... ..................................144

7.7.5.TCP/UDP portnameresolution (transportlayer). ... ... ... ... .................144

7.8.Checksums ... ......................................................................................145

7.8.1.Wireshark checksumvalidation. ... ... .............................................145

7.8.2.Checksum offloading.. ... .............................................................146

8.Statistics ... ....................................................................................................148

8.1.Introduction ... .....................................................................................148

8.2.The "Summary"window. ... ... .................................................................149

8.3.The "ProtocolHierarchy"window ... ... ... ..................................................151

8.4.Conversations ... ...................................................................................153

8.4.1.What isaConversation? ... ... ... .....................................................153

8.4.2.The "Conversations"window. ... ... ................................................153

8.4.3.The protocolspecific"Conversation List"windows. ... ... ... ... .............154

8.5.Endpoints ... ........................................................................................155

8.5.1.What isanEndpoint? ... ... ... .........................................................155

WiresharkUser's Guide

vi

8.5.2.The "Endpoints"window. ... ... ......................................................155

8.5.3.The protocolspecific"Endpoint List"windows. ... ... ... ... ..................156

8.6.The "IOGraphs"window ... ... ... ..............................................................157

8.7.WLAN TrafficStatistics. ... ... .................................................................159

8.8.Service ResponseTime. ... ... ..................................................................160

8.8.1.The "ServiceResponseTime DCE-RPC"window. ... ... ... ... ...............160

8.9.The protocolspecificstatistics windows.. ... ... ... ........................................162

9.Customizing Wireshark.. ... ...............................................................................164

9.1.Introduction ... .....................................................................................164

9.2.Start Wiresharkfromthe commandline. ... ... ... ... .......................................165

9.3.Packet colorization.. ... ..........................................................................171

9.4.Control Protocoldissection. ... ... .............................................................174

9.4.1.The "EnabledProtocols"dialog box.. ... ... ... ...................................174

9.4.2.User SpecifiedDecodes. ... ... .......................................................176

9.4.3.Show UserSpecifiedDecodes ... ... ... .............................................177

9.5.Preferences ... ......................................................................................178

9.5.1.Interface Options.. ... ..................................................................179

9.6.Configuration Profiles.. ... ......................................................................180

9.7.User Table.. ... .....................................................................................183

9.8.Display FilterMacros. ... ... .....................................................................184

9.9.GeoIP DatabasePaths. ... ... ....................................................................185

9.10.Tektronix K12xx/15RF5protocols Table.. ... ... ... .....................................186

9.11.SCCP usersTable. ... ... ........................................................................187

9.12.SMI (MIBandPIB) Modules.. ... ... ... .....................................................188

9.13.SMI (MIBandPIB) Paths.. ... ... ... .........................................................189

9.14.SNMP usersTable. ... ... .......................................................................190

9.15.User DLTsprotocoltable ... ... ... ............................................................191

10.Lua SupportinWireshark ... ... ... ......................................................................193

10.1.Introduction ... ....................................................................................193

10.2.Example ofDissectorwritten inLua. ... ... ... ... ..........................................194

10.3.Example ofListenerwritten inLua. ... ... ... ... ...........................................195

10.4.Wireshark's LuaAPIReference Manual.. ... ... ... .......................................196

10.4.1.Saving capturefiles. ... ... ...........................................................196

10.4.2.Obtaining dissectiondata. ... ... ....................................................198

10.4.3.GUI support.. ... .......................................................................200

10.4.4.Post-dissection packetanalysis. ... ... ............................................205

10.4.5.Obtaining packetinformation. ... ... ..............................................206

10.4.6.Functions forwritingdissectors ... ... ... .........................................210

10.4.7.Adding informationtothe dissectiontree. ... ... ... ... .........................222

10.4.8.Functions forhandlingpacket data.. ... ... ... ...................................223

10.4.9.Utility Functions.. ... .................................................................229

A.Files andFolders. ... ... .....................................................................................233

A.1.Capture Files.. ... .................................................................................233

A.1.1.Libpcap FileContents. ... ... .........................................................233 A.1.2.Not Savedinthe CaptureFile. ... ... ... ... .........................................233

A.2.Configuration FilesandFolders ... ... ... .....................................................235

A.3.Windows folders.. ... ............................................................................240

A.3.1.Windows profiles.. ... .................................................................240 A.3.2.Windows Vista/XP/2000/NTroamingprofiles ... ... ... .......................240 A.3.3.Windows temporaryfolder. ... ... ..................................................240

B.Protocols andProtocolFields ... ... ... ..................................................................243

C.Wireshark Messages.. ... ..................................................................................244

C.1.Packet ListMessages. ... ... .....................................................................244

C.1.1.[Malformed Packet].. ... ..............................................................244 C.1.2.[Packet sizelimitedduring capture].. ... ... ... ...................................244

C.2.Packet DetailsMessages. ... ... ................................................................245

C.2.1.[Response inframe:123] ... ... ... ...................................................245 C.2.2.[Request inframe:123] ... ... ... .....................................................245 C.2.3.[Time fromrequest:0.123 seconds].. ... ... ... ...................................245 C.2.4.[Stream setupbyPROTOCOL (frame123)]. ... ... ... ... ......................245

D.Related commandlinetools ... ... ... ....................................................................247

D.1.Introduction ... .....................................................................................247

D.2.tshark:Terminal-based Wireshark.. ... ....................................................248

WiresharkUser's Guide

vii D.3.tcpdump:Capturing withtcpdumpfor viewingwithWireshark ... ... ... ... ... ....249 D.4.dumpcap:Capturing withdumpcapfor viewingwithWireshark ... ... ... ... ... ...250 D.5.capinfos:Print informationaboutcapture files.. ... ... ... ...............................251

D.6.editcap:Edit capturefiles. ... ... ..............................................................252

D.7.mergecap:Merging multiplecapturefiles intoone. ... ... ... ... .......................255 D.8.text2pcap:Converting ASCIIhexdumpsto networkcaptures. ... ... ... ... .........258 D.9.idl2wrs:Creating dissectorsfromCORBA IDLfiles. ... ... ... ... .....................261

D.9.1.What isit?. ... ... ........................................................................261

D.9.2.Why dothis?. ... ... .....................................................................261 D.9.3.How touseidl2wrs ... ... ... ...........................................................261 D.9.4.TODO ... .................................................................................263 D.9.5.Limitations ... ...........................................................................263

D.9.6.Notes ... ...................................................................................263

E.This Document'sLicense(GPL) ... ... ... ...............................................................265

WiresharkUser's Guide

viii

Preface

1.Foreword

Wiresharkis oneofthose programsthatmany networkmanagerswould lovetobe abletouse, but theyare oftenpreventedfrom gettingwhatthey wouldlikefrom Wiresharkbecauseof thelackof documentation. Thisdocument ispartof aneffortby theWiresharkteam toimprovethe usabilityofWireshark. Wehope thatyoufind ituseful,and lookforwardto yourcomments. ix

2.Who shouldreadthis document?

Theintended audienceofthis bookisanyone usingWireshark. Thisbook willexplainall thebasicsand alsosomeof theadvancedfeatures thatWireshark provides.As Wiresharkhasbecome averycomplex programsincethe earlydays,not everyfeature ofWireshark maybeexplained inthisbook. Thisbook isnotintended toexplainnetwork sniffingingeneral anditwill notprovidedetails about specificnetwork protocols.Alot ofusefulinformation regardingthesetopics canbefound atthe

WiresharkWiki athttp://wiki.wireshark.org

Byreading thisbook,you willlearnhow toinstallWireshark, howtouse thebasicelements ofthe graphicaluser interface(suchas themenu)and what'sbehindsome oftheadvanced featuresthatare notalways obviousatfirst sight.Itwill hopefullyguideyou aroundsomecommon problemsthat frequentlyappear fornew(and sometimesevenadvanced) usersofWireshark.

Preface

x

3.Acknowledgements

Theauthors wouldliketo thankthewhole Wiresharkteamfor theirassistance.In particular,theau- thorswould liketothank: •Gerald Combs,forinitiating theWiresharkproject andfundingto dothisdocumentation. •Guy Harris,formany helpfulhintsand agreatdeal ofpatiencein reviewingthisdocument. •Gilbert Ramirez,forgeneral encouragementandhelpful hintsalongthe way. Theauthors wouldalsolike tothankthe followingpeoplefor theirhelpfulfeedback onthisdocu- ment: •Pat Eyler,forhis suggestionsonimproving theexampleon generatingabacktrace. •Martin Regner,forhis varioussuggestionsand corrections. •Graeme Hewson,fora lotofgrammatical corrections. Theauthors wouldliketo acknowledgethoseman pageandREADME authorsforthe Wireshark projectfrom whosectionsof thisdocumentborrow heavily: •Scott Renfrofromwhose mergecapmanpage SectionD.7,"mergecap:Mergingmultiplecap- turefilesintoone"isderived. •Ashok Narayananfromwhose text2pcapmanpage SectionD.8,"text2pcap:ConvertingASCII hexdumpstonetworkcaptures"isderived. •Frank Singletonfromwhose README.idl2wrsSectionD.9,"idl2wrs:Creatingdissectors fromCORBAIDLfiles"isderived.

Preface

xi

4.About thisdocument

Thisbook wasoriginallydeveloped byRichardSharpewithfunds providedfromthe Wireshark Fund.It wasupdatedby EdWarnickeandmore recentlyredesignedand updatedbyUlfLamping.

Itis writteninDocBook/XML.

Youwill findsomespecially markedpartsin thisbook:

Thisis awarning!

Youshould payattentionto awarning,as otherwisedataloss mightoccur.

Thisis anote!

Anote willpointyou tocommonmistakes andthingsthat mightnotbe obvious.

Thisis atip!

Tipswill behelpfulfor youreverydaywork usingWireshark.

Preface

xii

5.Where togetthe latestcopyof this

document? Thelatest copyofthis documentationcanalways befoundat: http://www.wireshark.org/docs/.

Preface

xiii

6.Providing feedbackaboutthis document

Shouldyou haveanyfeedback aboutthisdocument, pleasesendit totheauthors throughwireshark- dev[AT]wireshark.org.

Preface

xiv

Preface

xv

Chapter1. Introduction

1.1.What isWireshark?

Wiresharkis anetworkpacket analyzer.Anetwork packetanalyzerwill trytocapture network packetsand triestodisplay thatpacketdata asdetailedas possible. Youcould thinkofa networkpacketanalyzer asameasuring deviceusedto examinewhat'sgoing oninside anetworkcable, justlikea voltmeterisused byanelectrician toexaminewhat's goingon insidean electriccable(but atahigher level,ofcourse). Inthe past,suchtools wereeithervery expensive,proprietary,or both.However,with theadventof

Wireshark,all thathaschanged.

Wiresharkis perhapsoneof thebestopen sourcepacketanalyzers availabletoday.

1.1.1.Some intendedpurposes

Hereare someexamplespeople useWiresharkfor:

•network administratorsuseit totroubleshootnetwork problems •network securityengineersuse ittoexaminesecurity problems •developers useitto debugprotocol implementations •people useitto learnnetwork protocolinternals Besidethese examples,Wiresharkcan behelpfulin manyothersituations too.

1.1.2.Features

Thefollowing aresomeof themanyfeatures Wiresharkprovides: •Available forUNIXandWindows. •Capturelivepacket datafroma networkinterface. •Display packetswithverydetailed protocolinformation. •Openand Savepacketdata captured. •Importand Exportpacketdata fromandto alotof othercaptureprograms. •Filterpackets onmany criteria. •Searchforpackets onmanycriteria. •Colorizepacketdisplay basedonfilters. •Create variousstatistics. •... andalot more! However,to reallyappreciateits power,youhave tostartusing it. sharkhaving capturedsomepackets andwaitingfor youtoexamine them. 1 Figure1.1. Wiresharkcapturespackets andallowsyou toexaminetheir content.

1.1.3.Live capturefrommany differentnetworkmedia

Wiresharkcan capturetrafficfrom manydifferentnetwork mediatypes- anddespiteits name-in- cludingwireless LANaswell. Whichmediatypes aresupported,depends onmanythings likethe operatingsystem youareusing. Anoverviewof thesupportedmedia typescanbe foundat:http://quotesdbs_dbs10.pdfusesText_16