1. Network Analyzer :- Introduction to Wireshark
임효택

2. What is Wireshark ? Formerly known as Ethereal
Wireshark is a GUI network protocol analyzer
Display filters in Wireshark are very powerful
Follows the rules of the pcap library

3. Functions capturing network traffic
Decodes packets of common protocols
Displays the network traffic in human- readable format

4. Screen Layout of Wireshark
The summary line, briefly describing what the packet is.
A protocol tree is shown, allowing you to drill down to exact protocol or field that you interested in.
a hex dump shows you exactly what the packet looks like when it goes over the wire.
Filename Of Current File

5. Edit -> Preferences ->Columns

6. Enable Protocols

8. Start Capturing

9. Select Capture Options
To Specify the interface to be monitored
To Record all traffic even not for you
Only Capture part of the packet
To Store the result in file
Automatic Stop Condition
To Start Monitoring

10. Capture Filters
The capture filter syntax follows the rules of the pcap library
This syntax is different from the display filter syntax.
Refering manual page of tcpdump
Sample filters
src ip
ether src 00:50:BA:48:B5:EF

11. Capture Filters
A capture filter for HTTP than captures traffic to and from a particular host
-tcp port 80 and host
A capture filter for HTTP than captures traffic not from a particular host
-tcp port 80 and not host
A capture filter to and from an ethernet address
-ether 00:00:01:01:02:22

12. Display Packet Captured
Once the monitoring is stopped, the following will show
Packet List Pane
Source IP or
Source Mac
Packet Detail Pane
Destination IP or
Destination Mac
Protocol
Packet Byte Pane
(raw data in Hex Form)

13. Display Packet Captured
Frame 3
Ethernet Header
Destination Mac Address Field in Ethernet Header

14. Display Packets Captured
Source Mac Address Field in Ethernet Header

15. Display Packets Captured
ICMP Message

16. Column Sorting Output is Sorted By Frame No By Default
After Sorting By Info

17. Conversation List

18. Saving Packets Captured

19. Display Filters C-like symbols, or through English-like abbreviations:
eq, == Equal
ne, != Not equal
gt, > Greater than
lt, < Less Than
ge, >= Greater than or Equal to
le, <= Less than or Equal to

20. Display Filters GUI 3. 1. 2. Quick Way to Learn Display
Filter Commands 2.

21. Why Packet Analyzing in this class ?
Useful in Developing Network Application
As a guideline when error encountered

22. Some Useful Information
Wireshark -
TCPDUMP MAN Page -
IP Protocol -

23. Demonstration