Browse Library
Sign In Start Free Trial
Close icon Search icon
Account
Browse Library Advanced Search Sign In Start Free Trial

Add to playlist

Create a Playlist

Modal Close icon
You need to login to use this feature.
  • Mastering Wireshark 2
  • Toc
  • feedback
Mastering Wireshark 2

Mastering Wireshark 2

By : Andrew Crouthamel
close
Mastering Wireshark 2

Mastering Wireshark 2

By: Andrew Crouthamel

Overview of this book

Wireshark, a combination of a Linux distro (Kali) and an open source security framework (Metasploit), is a popular and powerful tool. Wireshark is mainly used to analyze the bits and bytes that flow through a network. It efficiently deals with the second to the seventh layer of network protocols, and the analysis made is presented in a form that can be easily read by people. Mastering Wireshark 2 helps you gain expertise in securing your network. We start with installing and setting up Wireshark2.0, and then explore its interface in order to understand all of its functionalities. As you progress through the chapters, you will discover different ways to create, use, capture, and display filters. By halfway through the book, you will have mastered Wireshark features, analyzed different layers of the network protocol, and searched for anomalies. You’ll learn about plugins and APIs in depth. Finally, the book focuses on pocket analysis for security tasks, command-line utilities, and tools that manage trace files. By the end of the book, you'll have learned how to use Wireshark for network security analysis and configured it for troubleshooting purposes.
Table of Contents (13 chapters)
close
close
Preface
chevron up
Preface
Who this book is for
What this book covers
To get the most out of this book
Get in touch
Free Chapter
1
Installing Wireshark 2
Installing Wireshark 2
Installation and setup
Summary
2
Getting Started with Wireshark
Getting Started with Wireshark
What's new in Wireshark 2?
Capturing traffic
Saving and exporting packets
Annotating and printing packets
Remote capture setup
Remote capture usage
Summary
3
Filtering Traffic
Filtering Traffic
Berkeley Packet Filter (BPF) syntax
Capturing filters
Displaying filters
Following streams
Advanced filtering
Summary
4
Customizing Wireshark
Customizing Wireshark
Preferences
Profiles
Colorizing traffic
Summary
5
Statistics
Statistics
TCP/IP overview
Time values and summaries
Trace file statistics
Expert system usage
Summary
6
Introductory Analysis
Introductory Analysis
DNS analysis
ARP analysis
IPv4 and IPv6 analysis
ICMP analysis
Summary
7
Network Protocol Analysis
Network Protocol Analysis
UDP analysis
TCP analysis I
TCP analysis II
Graph I/O rates and TCP trends
Summary
8
Application Protocol Analysis I
Application Protocol Analysis I
DHCP analysis
HTTP analysis I
HTTP analysis II
FTP analysis
Summary
9
Application Protocol Analysis II
Application Protocol Analysis II
Email analysis
802.11 analysis
VoIP analysis
VoIP playback
Summary
10
Command-Line Tools
Command-Line Tools
Running Wireshark from a command line
Running tshark
Running tcpdump
Running dumpcap
Summary
11
A Troubleshooting Scenario
A Troubleshooting Scenario
Wireshark plugins
Determining where to capture
Capturing scenario traffic
Diagnosing scenario traffic
Summary
12
Other Books You May Enjoy
Other Books You May Enjoy
Leave a review - let other readers know what you think

What this book covers

Chapter 1, Installing Wireshark 2, teaches you how to install Wireshark on Windows, macOS, and Linux.

Chapter 2, Getting Started with Wireshark, tells you about what's new in Wireshark 2. It will also teach you how to capture traffic and how to save, export, annotate, and print packages.

Chapter 3, Filtering Traffic, teaches you about BPF syntax and how to create one. It further explains how to use BPF to apply it as a capture filter and reduce the packets, how to create and use display filters, and how to follow streams—both TCP and UDP.

Chapter 4, Customizing Wireshark, explains how to apply preferences in Wireshark and customize them. You will learn how to create profiles for different analysis requirements.

Chapter 5, Statistics, provides an overview of TCP/IP and time values and summaries. You will also take a look at the expert system usage feature of Wireshark.

Chapter 6, Introductory Analysis, explains the basics of DNS and some DNS query examples. You will also learn about ARP resolution and how to resolve an IP address to a physical MAC address on an Ethernet bus. You will also acquire knowledge about IPv4 and IPv6 headers, the flags within them, and the fragmentation.

Chapter 7, Network Protocol Analysis, teaches you about UDP analysis: the connectionless protocol, TCP analysis: the connection-oriented protocol, and finally, graphing I/O rates and TCP trends: visualization of the data analyzed.

Chapter 8, Application Protocol Analysis I, talks about HTTP, both in an unencrypted fashion and an encrypted fashion, and how to decrypt that. You will also look into FTP in all of its many flavors, including active mode, passive mode, and the encrypted flavors of FTPS and SFTP.

Chapter 9, Application Protocol Analysis II, teaches you email analysis using POP and SMTP. We will also look at VoIP analysis using SIP and RTP.

Chapter 10, Command-Line Tools, teaches you how to run Wireshark from the command line, tshark, tcpdump, and running dumpcap.

Chapter 11, A Troubleshooting Scenario, covers troubleshooting a specific issue within Wireshark.

Unlock full access

Continue reading for free

A Packt free trial gives you instant online access to our library of over 7000 practical eBooks and videos, constantly updated with the latest in tech
Start a 7-day FREE trial
Next Section
bookmark search playlist font-size

Change the font size

margin-width

Change margin width

day-mode

Change background colour

Close icon Search
Country selected
Close icon Your notes and bookmarks

Delete Bookmark

Modal Close icon
Are you sure you want to delete it?
Cancel
Yes, Delete