wireshark lecture
Download
Report
Transcript wireshark lecture
Haijie Wu
Motivation and Overview
Wireshark is a network protocol analyzer
www.wireshark.org
First released in 1998 by Gerald Combs as Ethereal.
Open source and free software
Motivation and Overview
Powerful tool for network troubleshooting
Sniffs and captures live traffic
Filters data for ease of analysis
Statistics and graphs available
Used in industry and academia
Wireshark Installation
Wireshark can be installed on various platforms
Unix, Windows, Linux, Mac OS, etc
Most recent release is 1.4.1
System requirements
Rule of thumb: fast CPU, more memory is better
FAQs and Wiki pages provide more information
Wireshark Installation
Installation of Wireshark requires
Downloading the relevant package
Building the source into binary if the source is downloaded
Install binaries to their destinations
Windows installation includes WinPcap
Packet capture library (also needed for tcpdump)
Installation easy and intuitive
Wireshark—Main Features
Capturing live traffic
Data can be captured on wired or wireless medium
Numerous protocols can be captured and analyzed
Filtering is essential when dealing with huge number
of packets
Filters can be applied on protocols, fields, values, etc.
Filtering while capturing packets is possible
WinP Cap
Industries –standard tool for link layer network access in
windows environment
Allows application to capture and transmit network
packets by passing the protocol stack
Consists of a driver-extends OS to provide low level
network access
Consists of library for easy access to low level network
layers
Also contains windows version of libPCap Unix API
Wireshark GUI
How to use Wireshark--Capture
To capture: go the Capture menu and select the
Interfaces that used for transmission network data.
Set the capturing environment.
Start capturing on this interface.
The lively data captured by the interface will be shown
in the window of Wireshark.
Capturing can be stopped by clicking the stop button
on the main toolbar.
Example
Filtering
You can enter the filter expression directly to the filter
bar.
The expression is similar to the ‘if statement’ in other
programming languages.
Or you can click the ‘Expression…” button to choose
the filter options and set the values.
After all filter setting values have been putted in, click
the ‘Apply’ button.
Statistics measurement
There are plenty of statistic options provided by
Wireshark.
Graph Analysis
Flow graph
Throughput graph
Throughput graph
Flow graph