Introduction To

Wireshark
Advance Enterprise Network

Wireshark

Wireshark is a GUI Network Protocol Analyzer

Formerly known as Ethereal

1997, Gerald Combs, started writing it

2006, Wireshark

2008, Wireshark v1 released

Functions

Capturing network traffic

Decodes packets of protocols

Displays the network traffic in human-readable format

Features

Display Filters in Wireshark are very powerful

C-like symbols, or through English-like abbreviations

eq, == Equal

ne, != Not equal

Capture Filters follows the rules of the PCAP library

A capture filter for HTTP than captures traffic to and from

a particular host

-tcp port 80 and host 10.10.10.5

Intended Purposes

Network Administrators use it to troubleshoot network

problems

Network Security Engineers use it to examine security

problems

Developers use it to debug protocol implementations

People use it to learn network protocol internals

What Wireshark is not

Not an intrusion detection system.

It will not warn when strange things happen

Might help in figuring out what is really going on.

Not manipulate things on the network, only "measure" things from

it.

Doesnt send packets or do other active things

Demonstration