1. Wireshark
CSC8510
David Sivieri

2. what is wireshark? Open source packet analyzer
Available for Windows, macOS, Linux, UNIX variants
Can place network interface controller in promiscuous mode
Promiscuous mode allows network controller to see network traffic not sent to that particular controller

3. Features Select from multiple network controllers
Live packet capture or read pre-captured files (pcap files)
Encapsulation of data is displayed to user.
Different fields are parsed and displayed to user
Different network protocol structure displayed to user.
Multiple filters allowed.

4. FILTERS
Filters can alter which packets the users sees based on filter criteria
Common filters
ip.dst_host
ip.src_dst
tcp, udp, icmp

5. OSI MODEL and packets