Network Analyzer :- Introduction to Wireshark

1
Network Analyzer - Introduction to Wireshark

• Computer Networking (Graduate Class)

2
What is Wireshark ?

• Formerly known as Ethereal
• Wireshark is a GUI Network Protocol Analyzer
• Display filters in Wireshark are very powerful
• Follows the rules of the pcap library

3
Functions

• Capturing network traffic
• Decodes packets of common protocols
• Displays the network traffic in human-readable
  format

4
Wireshark Startup
Version 1.2.6
5
Screen Layout of Wireshark
The summary line, briefly describing what the
packet is.
A protocol tree is shown, allowing you to drill
down to exact protocol or field that you
interested in.
a hex dump shows you exactly what the packet
looks like when it goes over the wire.
Filename Of Current File
6
Edit -gt Preferences -gtColumns
7
Enable Protocols
8
Capture Options
9
Capture Options
To Specify the interface to be monitored
To Record all traffic even not for you
Only Capture part of the packet
Only Capture certain packet
To Store the result in file
Automatic Stop Condition
To Start Monitoring
10
Start Capturing
11
Stop Capturing
12
Display Packet Captured
Frame
Ethernet Header
Destination Mac Address Field in Ethernet Header
13
Column Sorting
Output is Sorted By Frame No By Default
Output is Sorted By Source Address
14
Conversation List
15
Saving Packets Captured
16
Capture Filters

• The capture filter syntax follows the rules of
  the pcap library
• This syntax is different from the display filter
  syntax.
• Referring manual page of tcpdump
  (http//www.tcpdump.org/tcpdump_man.html )
• Sample filters
• src ip 192.168.1.1
• ether src 0050BA48B5EF

17
Capture Filters

• A capture filter for HTTP than captures traffic
  to and from a particular host
• -tcp port 80 and host 10.10.10.5
• A capture filter for HTTP than captures traffic
  not from a particular host
• -tcp port 80 and not host 10.10.10.5
• A capture filter to and from an Ethernet address
• -ether 000001010222

18
Display Filters

• C-like symbols, or through English-like
  abbreviations
• eq, Equal
• ne, ! Not equal
• gt, gt Greater than
• lt, lt Less Than
• ge, gt Greater than or Equal to
• le, lt Less than or Equal to

19
Display Filters GUI
Quick Way to Learn Display Filter Commands
20
Display Filters GUI
1.
3.
2.
21
Display Filters GUI
22
Why Packet Analyzing in this class ?

• Useful in Developing Network Application
• As a guideline when error encountered

23
Some Useful Information

• Wireshark
• - http//www.wireshark.org
• TCPDUMP MAN Page
• - http//www.tcpdump.org/tcpdump_man.html
• IP Protocol
• - http//www.networksorcery.com/enp/protocol/i
  p.htm

24
Demonstration