WHAT IS WIRESHARK?

Wireshark is the world’s foremost and widely-used network protocol analyzer. It lets you see what’s happening on your network at a microscopic level and is the de facto (and often de jure) standard across many commercial and non-profit enterprises, government agencies, and educational institutions. Wireshark development thrives thanks to the volunteer contributions of networking experts around the globe and is the continuation of a project started by Gerald Combs in 1998.

Wireshark has a rich feature set which includes the following:

• Deep inspection of hundreds of protocols, with more being added all the time
• Live capture and offline analysis
• Standard three-pane packet browser
• Multi-platform: Runs on Windows, Linux, macOS, Solaris, FreeBSD, NetBSD, and many others
• Captured network data can be browsed via a GUI, or via the TTY-mode TShark utility
• The most powerful display filters in the industry
• Rich VoIP analysis
• Read/write many different capture file formats: tcpdump (libpcap), Pcap NG, Catapult DCT2000, Cisco Secure IDS iplog, Microsoft Network Monitor, Network General Sniffer® (compressed and uncompressed), Sniffer® Pro, and NetXray®, Network Instruments Observer, NetScreen snoop, Novell LANalyzer, RADCOM WAN/LAN Analyzer, Shomiti/Finisar Surveyor, Tektronix K12xx, Visual Networks Visual UpTime, WildPackets EtherPeek/TokenPeek/AiroPeek, and many others
• Capture files compressed with gzip can be decompressed on the fly
• Live data can be read from Ethernet, IEEE 802.11, PPP/HDLC, ATM, Bluetooth, USB, Token Ring, Frame Relay, FDDI, and others (depending on your platform)
• Decryption support for many protocols, including IPsec, ISAKMP, Kerberos, SNMPv3, SSL/TLS, WEP, and WPA/WPA2
• Coloring rules can be applied to the packet list for quick, intuitive analysis
• Output can be exported to XML, PostScript®, CSV, or plain text

Wireshark is a free and open-source packet analyzer. It is used for network troubleshooting, analysis, software and communications protocol development, and education. Originally named Ethereal, the project was renamed Wireshark in May 2006 due to trademark issues

Wireshark has developed a reputation as one of the most reliable network protocol analyzers available on the market. Users across the globe have been using this open-source application as a complete network analysis tool. Through Wireshark, users can troubleshoot network problems, examine network security issues, debug protocols, and learn network processes.

What type of tool is Wireshark?

network protocol analyzerWireshark is a network protocol analyzer, or an application that captures packets from a network connection, such as from your computer to your home office or the internet. Packet is the name given to a discrete unit of data in a typical Ethernet network. Wireshark is the most often-used packet sniffer in the world.

At its core, Wireshark was designed to break down packets of data being transferred across different networks. The user can search and filter for specific packets of data and analyze how they are transferred across their network. These packets can be used for analysis on a real-time or offline basis.

The user can use this information to generate statistics and graphs. Wireshark was originally known as Ethereal but has since established itself as one of the key network analysis tools on the market. This is the go-to tool for users who want to view data generated by different networks and protocols.

Wireshark is suitable for novice and expert users alike. The user interface is incredibly simple to use once you learn the initial steps to capture packets. More advanced users can use the platform’s decryption tools to break down encrypted packets as well.

Defining Network Analysis
Network analysis is the process of listening to and analyzing network traffic. Network analysis
offers an insight into network communications to identify performance problems, locate security
breaches, analyze application behavior, and perform capacity planning. Network analysis (aka
“protocol analysis”) is a process used by IT professionals who are responsible for network
performance and security.
Whether you are completely new to network analysis or just returning after a hiatus of setting up
servers, architecting your company’s security plan, deploying Voice over IP, or jumping through
hoops to get WLAN issues fixed… Welcome and welcome back!
Network analysis is not brain surgery. Anyone can analyze network communications. You do,
however, need to acquire three basic skills to be a top notch network analyst who can spot the cause
of performance problems, evidence of breached hosts, misbehaving applications or the impending
overload of the network.

1. A solid understanding of TCP/IP communications
2. Comfort using Wireshark
3. Familiarity with packet structures and typical packet flows
   Many of you have probably installed and configured TCP/IP networks—in fact, I imagine many of
   you have set up hundreds if not thousands of TCP/IP clients and servers. Excellent! You already
   understand TCP/IP addressing and realize the role that DNS and DHCP servers play on your
   network.
   From a network analyst’s perspective, you need to understand the purpose of those devices and
   protocols and how they interact. For example, how exactly does a DHCP server offer an IP address
   and configuration information to a DHCP client? What if there is a relay agent in use? What happens
   when the user’s address lease time expires? How does the user learn the right IP address to use when
   the user wants to reach www.wireshark.org? What happens if the local name server does not have
   the answer? What happens if the local name server is down?
   Seeing these processes in action at packet level is a fast way to learn the inner workings of your
   network. You build your baseline of understanding—the baseline is your foundational knowledge of
   how the processes are supposed to work.
   Network analyzer tools are often referred to as “sniffers” and may be sold or distributed as a
   hardware-plus-software solution or as a software-only solution. Wireshark is distributed as an open
   source software-only solution, but there are add-on adapters that can enhance Wireshark’s
   capabilities. The AirPcap adapter from CACE Technologies is an example of a hardware add-on.
   The AirPcap adapter is used on Windows hosts running Wireshark to listen in to wireless traffic in
   Monitor Mode.5

5
Monitor Mode (also referred to as rfmon mode and wirel

WIRESHARK FEATURES

The underlisted are the core features of wireshark:

•  Capture live packet data
•  Import packets from text files
•  View packet data and protocol information
•  Save captured packet data
•  Display packets
•  Filter packets
•  Search packets
•  Colorize packets
•  Generate Statistics

Installation of wireshark on Windows os

After downloading the program, you can start the setup process. During installation, you may be prompted to install WinPcap. It’s important to install WinPcap as without it you will be unable to capture live network traffic. Without WinPcap you will only be able to open saved capture files. To install, simply check the Install WinPcap box.

Installation on Mac

To install Wireshark on Mac you first need to download an installer. To do this, download an installer such as exquartz Once you’ve done this, open the Terminal and input the following command:

<% /Applications/Wireshark.app/Contents/Mac0S/Wireshark>

Then wait for Wireshark to start.

How to Capture Data Packets

One of the major functions of Wireshark as a network analysis tool is to capture packets of data. Learning how to set up Wireshark to capture packets is essential to conducting detailed network analysis. However, it’s important to note that it can be difficult to capture packets when you’re new to Wireshark. Before you start to capture packets, there are three things you need to do:

1. Make sure that you have the administrative privileges to start a live capture on your device
2. Choose the correct network interface to capture packet data from
3. Capture packet data from the correct location in your network

Once you’ve done these three things, you’re ready to start the capture process. When you use Wireshark to capture packets, they are displayed in a human-readable format to make them legible to the user. You can also break packets down with filters and color-coding if you wish to see more specific information.

When you first open up Wireshark, you’ll be met by the following launch screen:

The first thing you need to do is look at the available interfaces to capture. To do this, select Capture > Options. The “Capture Interfaces” dialog box will then open as shown below:

Check the box of the interface you want to capture and press the Start button to start. You can select multiple interfaces if you want to capture data from multiple sources simultaneously.

On Unix or Linux, the dialog box is shown in a similar style like this:

You can also start Wireshark by using the following command line:

<¢ wireshark -i   eth0 —k>

You can also use the shark fin button on the toolbar as a shortcut to initiate packet capturing. Once you click this button, Wireshark will start the live capture process.

If you want to stop capturing, click the red stop button next to the shark fin.

Promiscuous Mode

If you want to develop an overhead view of your network packet transfers, then you need to activate ‘promiscuous mode’. Promiscuous mode is an interface mode where Wireshark details every packet it sees. When this mode is deactivated, you lose transparency over your network and only develop a limited snapshot of your network (this makes it more difficult to conduct any analysis).

To activate promiscuous mode, click on the Capture Options dialog box and click promiscuous mode. In theory, this should show you all the traffic active on your network. The promiscuous mode box is shown below:

However, this often isn’t the case. Many network interfaces are resistant to promiscuous mode, so you need to check the Wireshark website for information on your specific hardware.

On Windows, it’s useful to open Device Manager and check whether you have your settings configured to reject promiscuous mode. For example:

(Simply click on network and then make sure that your promiscuous mode setting are set to Allow All).

If you have your settings set to “reject” promiscuous mode, then you’re going to limit the number of packets Wireshark captures. So even if you have promiscuous mode enabled on Wireshark check your Device Manager to make sure that your interface isn’t blocking any data from coming through. Taking the time to check through your network infrastructure will ensure Wireshark receives all the necessary packets of data.

How to Analyze Captured Packets

Once you’ve captured your network data, you’ll want to look at your captured packets. In the screenshot below you’ll see three panes, the packet list pane, the packet bytes pane, and the packet details pane.

If you want more information, you can click on any of the fields in each packet to see more. When you click on a packet, you’re shown a breakdown of its internal bytes in the byte view section.

Packet List

The packet list pane is shown at the top of the screenshot. Each piece is broken down to a number with time, source, destination, protocol and support information.

Packet Details

Packet details can be found in the middle, showing the protocols of the chosen packet. You can expand each section by clicking on the arrow next to your row of choice. You can also apply additional filters by right-clicking on the chosen item.

Packet Bytes

The packet bytes pane is shown at the bottom of the page. This pane shows the internal data of your selected packet. If you highlight part of the data in this section, its corresponding information is also highlighted in the packet details pane. By default, all data is shown in hexadecimal format. If you want to change it to bit format, right-click the pane and select this option from the context menu.

How to use Wireshark to Analyze Network Performance

If you want to use Wireshark to inspect your network and analyze all active traffic, then you need to close down all active applications on your network. This will reduce traffic to a minimum so you can see what is happening on your network more clearly. However, even if you turn off all of your applications, you’ll still have a mass of packets being sent and received.

Using Wireshark to filter these packets is the best way to take stock of your network data. When your connection is active, thousands of packets are transferring through your network every second. This means it’s vital that you filter out the information you don’t need to get a clear picture of what’s going on.

Capture Filters and Display Filters

Capture Filters and Display Filters are two types of distinct filters that can be used on Wireshark.

Capture Filters and Display Filters are two types of distinct filters that can be used on Wireshark. Capture Filters are used to reduce the size of incoming packet capture, essentially filtering out other packets during live packet capturing. As a result, capture filters are set before you begin the live capture process.

Capture Filters are used to reduce the size of incoming packet capture, essentially filtering out other packets during live the packet capturing. As a result, capture filters are set before you begin the live capture process.

Capture Filters can’t be modified once a capture has been started. On the other hand, Display Filters can be used to filter data that has already been recorded. Capture Filters determine what data you capture from live network monitoring, and Display Filters dictate the data you see when looking through previously captured packets.

If you want to start filtering your data, one of the easiest ways to do this is to use the filter box below the toolbar. For example, if you type in HTTP in the filter box, you will be provided with a list of all HTTP packets captured. When you start typing, you’ll be met with an autocomplete field. The filter box is shown below:

You can use hundreds of different filters to break down your packet information, from 104apci to zvt. An extensive list can be found on the Wireshark website here. You can also choose a filter by clicking on the bookmark icon to the left of the entry field. This will raise a menu of popular filters.

If you choose to set a capture filter, then your changes will come into effect once you start recording live network traffic. To activate a display filter, simply click on the arrow to the right of the entry field. Alternatively, you can click Analyze > Display Filters and choose a filter from the list of defaults.

After choosing a filter, you can view the TCP conversation behind a packet. To do this, right click on the packet and click Follow > TCP stream. This will show you the TCP exchange between the client and server.

Viewing Network Statistics

To view more information on your network, the statistics drop-down menu is incredibly useful. The statistics menu can be located at the top of the screen and will provide you with several metrics from size and timing information to plotted charts and graphs. You can also apply display filters to these statistics to narrow down important information.

The Wireshark statistics menu is shown below:

In this menu are a variety of options to help you break down your network information.

Statistics Menu Selections

Here are some of the core sections:

• Protocol Hierarchy – The Protocol Hierarchy option raises a window with a complete table of all captured protocols. Active display filters are also displayed at the bottom.
• Conversations – Reveals the network conversation between two endpoints (For example exchange of traffic from one IP address to another).
• Endpoints – Displays a list of endpoints (a network endpoint is where protocol traffic of a specific protocol layer ends).
• IO Graphs – Displays user-specific graphs, visualizing the number of packets throughout the data exchange.
• RTP_statistics – Allows the user to save the content of an RTP audio stream directly to an Au-file.
• Service Response Time – Displays the response time between a request and the network’s response.
• TcpPduTime – Displays the time taken to transfer data from a Protocol Data Unit. Can be used to find TCP retransmissions.
• VoIP_Calls – Shows VoIP calls obtained from live captures.
• Multicast Stream – Detects multicast streams and measures the size of bursts and the output buffers of certain speeds.

Visualizing Network Packets With IO Graphs

If you want to create a visual representation of your data packets, then you need to open IO graphs. Simply click on the statistics menu and select IO graphs. You’ll then be met by a graph window:

You can configure IO graphs with your own settings according to the data you want to display. By default only graph 1 is enabled, so if you want to activate 2-5 you need to click on them. Likewise, if you want to apply a display filter for a graph, click the filter icon next to the graph you want to interact with. The style column allows you to change how your graph is structured. You can choose between Line, FBar, Dot, or Impulse.

You can also interact with the X and Y axis metrics on your graph as well. On the X-axis, the tick interval sections allow you to dictate how long the interval is, from minutes to seconds. You can also check the view as time of day checkbox to change the time of the X-axis.

Under the Y-axis section, you can change the unit of measurement from any of the following options: Packets/Tick, Bytes/Tick, Bits/Tick, or Advanced. The scale allows you to choose the scale of measurement for the Y-axis of the graph.

Once you press save the graph is then stored in a file format of your choice

How to Use Sample Captures

If you want to practice using Wireshark but your own network is unavailable for whatever reason, using ‘sample captures’ is a great alternative. Sample captures provide you with another network’s packet data.

The Wireshark wiki website features a variety of sample capture files that can be downloaded across the site. Once you’ve downloaded a sample capture you can use it by clicking File > Open and then clicking on your file.

Capture Files can also be found from the following sources below:

• ICIR
• OPENPACKET
• PACKETLIFE

Please drop your comments below.