Network%20Analyzer%20:-%20Introduction%20to%20Wireshark

1
Network Analyzer - Introduction to Wireshark

• ???

2
What is Wireshark ?

• Formerly known as Ethereal
• Wireshark is a GUI network protocol analyzer
• Display filters in Wireshark are very powerful
• Follows the rules of the pcap library

3
Functions

• capturing network traffic
• Decodes packets of common protocols
• Displays the network traffic in human-readable
  format

4
Screen Layout of Wireshark
The summary line, briefly describing what the
packet is.
A protocol tree is shown, allowing you to drill
down to exact protocol or field that you
interested in.
a hex dump shows you exactly what the packet
looks like when it goes over the wire.
Filename Of Current File
5
Edit -gt Preferences -gtColumns
6
Enable Protocols
7
(No Transcript)
8
Start Capturing
9
Select Capture Options
To Specify the interface to be monitored
To Record all traffic even not for you
Only Capture part of the packet
To Store the result in file
Automatic Stop Condition
To Start Monitoring
10
Capture Filters

• The capture filter syntax follows the rules of
  the pcap library
• This syntax is different from the display filter
  syntax.
• Refering manual page of tcpdump
• Sample filters
• src ip 192.168.1.1
• ether src 0050BA48B5EF

11
Capture Filters

• A capture filter for HTTP than captures traffic
  to and from a particular host
• -tcp port 80 and host 10.10.10.5
• A capture filter for HTTP than captures traffic
  not from a particular host
• -tcp port 80 and not host 10.10.10.5
• A capture filter to and from an ethernet address
• -ether 000001010222

12
Display Packet Captured
Once the monitoring is stopped, the following
will show
Packet List Pane
Source IP or Source Mac
Packet Detail Pane
Destination IP or Destination Mac
Protocol
Packet Byte Pane (raw data in Hex Form)
13
Display Packet Captured
Frame 3
Ethernet Header
Destination Mac Address Field in Ethernet Header
14
Display Packets Captured
Source Mac Address Field in Ethernet Header
15
Display Packets Captured
ICMP Message
16
Column Sorting
Output is Sorted By Frame No By Default
After Sorting By Info
17
Conversation List
18
Saving Packets Captured
19
Display Filters

• C-like symbols, or through English-like
  abbreviations
• eq, Equal
• ne, ! Not equal
• gt, gt Greater than
• lt, lt Less Than
• ge, gt Greater than or Equal to
• le, lt Less than or Equal to

20
Display Filters GUI
3.
1.
Quick Way to Learn Display Filter Commands
2.
21
Why Packet Analyzing in this class ?

• Useful in Developing Network Application
• As a guideline when error encountered

22
Some Useful Information

• Wireshark
• -http//www.wireshark.org
• TCPDUMP MAN Page
• - http//www.tcpdump.org/tcpdump_man.html
• IP Protocol
• -http//www.networksorcery.com/enp/protocol/ip
  .htm

23
Demonstration