Mastering Wireshark 2

By : Andrew Crouthamel

Buy this Book

Mastering Wireshark 2

By: Andrew Crouthamel

Buy this Book

Overview of this book

Wireshark, a combination of a Linux distro (Kali) and an open source security framework (Metasploit), is a popular and powerful tool. Wireshark is mainly used to analyze the bits and bytes that flow through a network. It efficiently deals with the second to the seventh layer of network protocols, and the analysis made is presented in a form that can be easily read by people. Mastering Wireshark 2 helps you gain expertise in securing your network. We start with installing and setting up Wireshark2.0, and then explore its interface in order to understand all of its functionalities. As you progress through the chapters, you will discover different ways to create, use, capture, and display filters. By halfway through the book, you will have mastered Wireshark features, analyzed different layers of the network protocol, and searched for anomalies. You’ll learn about plugins and APIs in depth. Finally, the book focuses on pocket analysis for security tasks, command-line utilities, and tools that manage trace files. By the end of the book, you'll have learned how to use Wireshark for network security analysis and configured it for troubleshooting purposes.

Preface

Who this book is for

What this book covers

To get the most out of this book

Get in touch

Free Chapter

Installing Wireshark 2

Installation and setup

Summary

Getting Started with Wireshark

What's new in Wireshark 2?

Capturing traffic

Saving and exporting packets

Annotating and printing packets

Remote capture setup

Remote capture usage

Summary

Filtering Traffic

Berkeley Packet Filter (BPF) syntax

Capturing filters

Displaying filters

Following streams

Advanced filtering

Summary

Customizing Wireshark

Preferences

Profiles

Colorizing traffic

Summary

Statistics

TCP/IP overview

Time values and summaries

Trace file statistics

Expert system usage

Summary

Introductory Analysis

DNS analysis

ARP analysis

IPv4 and IPv6 analysis

ICMP analysis

Summary

Network Protocol Analysis

UDP analysis

TCP analysis I

TCP analysis II

Graph I/O rates and TCP trends

Summary

Application Protocol Analysis I

DHCP analysis

HTTP analysis I

HTTP analysis II

FTP analysis

Summary

Application Protocol Analysis II

Email analysis

802.11 analysis

VoIP analysis

VoIP playback

Summary

Command-Line Tools

Running Wireshark from a command line

Running tshark

Running tcpdump

Running dumpcap

Summary

A Troubleshooting Scenario

Wireshark plugins

Determining where to capture

Capturing scenario traffic

Diagnosing scenario traffic

Summary

Other Books You May Enjoy

Leave a review - let other readers know what you think

Customer Reviews

5 star

4 star

3 star

2 star

1 star

Saving and exporting packets

In this section, we'll take a look at the following subtopics:

How to save packet captures
How to save selected sections of packets, individual packets, and ranges of packets
How to export packets into other formats
How to export raw packet data from the capture that you selected

Now that we have Wireshark up and running, let's capture some traffic. We'll select the Local Area Connection, and we could either double-click as I mentioned or we'll start the capture up at the top. And we will have some packets coming in. So now, if I want to save this capture (the entire capture—all the packets that I just captured) I'll go to File | Save As...; and from here, I can simply choose a filename. So, we'll call it packets. And you'll see in the Save as type, I chose the file as pcapng: