Ethereal/Wireshark Network Analyser

user guide

1 © Nokia Siemens Networks CN3203EN01GLN00

Module Objectives

By the end of this module, the participants should be able to:

• Explain Ethereal/Wireshark main Functionality

• Capture packets in Ethereal/Wireshark
• View packets Ethereal/Wireshark
• Filter packets in Ethereal/Wireshark

2 © Nokia Siemens Networks CN3203EN01GLN00

Main Functionality
2. Analyse 3. Display
ip.addr eq 10.2.10.25
proto tcp
port 21

Standard PC
1. Capture

host 10.2.10.25 NIC

proto tcp Eth/ATM/PCM etc.
port 21

3 © Nokia Siemens Networks CN3203EN01GLN00

Main Menu A B C D

4 © Nokia Siemens Networks CN3203EN01GLN00

File Menu

Edit Menu

5 © Nokia Siemens Networks CN3203EN01GLN00

View
Menu

Go Menu

6 © Nokia Siemens Networks CN3203EN01GLN00

Capture Menu

Analyze Menu

7 © Nokia Siemens Networks CN3203EN01GLN00

Statistic Menu

8 © Nokia Siemens Networks CN3203EN01GLN00

Capture Preferences

9 © Nokia Siemens Networks CN3203EN01GLN00

Saving Capture File Dialog
Format of the saved capture file
– libpcap (tcpdump, Ethereal, etc.)
– modified libpcap (tcpdump)
– RedHat Linux libpcap (tcpdump)
– Network Associates Sniffer (DOS based)
– Sun Snoop
– Microsoft Network Monitor 1.x
– Network Associates Sniffer (Windows
based) 1.1

Note!: Some capture formats may not be

available, depending on the frame types
captured.
Note!: You can convert capture files from
one format to another format

10 © Nokia Siemens Networks CN3203EN01GLN00

Filter Expression

Most commonly used expressions: ip.addr eq 10.2.10.35 Displays only traffic with
source or destination IP
address of 10.2.10.35
proto tcp Displays only IP traffic
with TCP protocol
Port 2123 Displays only GTP-C
protocol
11 © Nokia Siemens Networks CN3203EN01GLN00