Scroll To Top

Using Wireshark

There can be instances where we may require analysing the network traffic so as to find the cause of the problem.  To do this we can use WireShark.  

Wireshark is a network protocol analyzer. It is "free software", you can download from

http://www.wireshark.org/download.html

1.jpg

Following are the steps that may be helpful in using Wireshark:

 

1. First select the network interface you want to listen for the traffic.

For that either click 'Interface List' on the main window or go to Capture arrow.jpg Select Interfaces arrow.jpg Select Options… arrow.jpg Select an appropriate network interface

2.jpg

2. Click 'Start' button arrow.jpg You will see the network traffic for that interface in the window

3.jpg

3. Filters can be applied so as to view only packets that are of importance.

To apply a filter arrow.jpg write the filter expression in the Filter Window arrow.jpg Press 'Enter' or 'Apply'.

Some common filters are:-

  1. ‘tcp’ = for viewing TCP packets only.
  2. ‘udp’  = for viewing UDP packets only.
  3. ‘sip’ = for viewing SIP packets only.
  4. ‘ip.src == <ip address>’ = for viewing traffic coming from a specific ip address only.
  5. ‘ip.dst == <ip address>’ = for viewing traffic going to a specific ip address only.

4. Once we have captured the packets, we can stop listening to network traffic by pressing 'Stop' button or by going to menu 'Capture arrow.jpg Stop'.

All the filters can be applied together with different logical operators like '&&' for 'And' operation, '||' for 'Or' operation, '!' for 'Not' operation etc.

There are many other filters that may be used. Please refer to Wireshark help for more details.

4.jpg

5. To Analyse a packet arrow.jpg Select the packet you want to view arrow.jpg its information will then be displayed in the middle pane.

arrow.jpg You can then click on any item in middle pane arrow.jpg its information will be displayed in the bottom pane.

6. To copy any data 'bytes' arrow.jpg Right click on that data arrow.jpg Go to Copy arrow.jpg Bytes arrow.jpg Printable Text Only (This will copy the data in a readable text form)

5.jpg

Have more questions? Submit a request

Comments