1. Network Analyzer :- Introduction to Wireshark

2. What is Wireshark ? Formerly known as Ethereal
Wireshark is a GUI Network Protocol Analyzer
Display filters in Wireshark are very powerful
Follows the rules of the pcap library

3. Functions Capturing network traffic
Decodes packets of common protocols
Displays the network traffic in human- readable format

4. Wireshark Startup
Version 1.2.6

5. Screen Layout of Wireshark
The summary line, briefly describing what the packet is.
A protocol tree is shown, allowing you to drill down to exact protocol or field that you interested in.
a hex dump shows you exactly what the packet looks like when it goes over the wire.
Filename Of Current File

6. Edit -> Preferences ->Columns

7. Enable Protocols

8. Capture Options

9. Capture Options To Specify the interface to be monitored
To Record all traffic even not for you
Only Capture part of the packet
Only Capture certain packet
To Store the result in file
Automatic Stop Condition
To Start Monitoring

10. Start Capturing

11. Stop Capturing

12. Display Packet Captured
Frame #
Ethernet Header
Destination Mac Address Field in Ethernet Header

13. Column Sorting Output is Sorted By Frame No By Default
Output is Sorted By Source Address

14. Conversation List

15. Saving Packets Captured

16. Capture Filters
The capture filter syntax follows the rules of the pcap library
This syntax is different from the display filter syntax.
Referring manual page of tcpdump ( )
Sample filters:
src ip
ether src 00:50:BA:48:B5:EF

17. Capture Filters
A capture filter for HTTP than captures traffic to and from a particular host
-tcp port 80 and host
A capture filter for HTTP than captures traffic not from a particular host
-tcp port 80 and not host
A capture filter to and from an Ethernet address
-ether 00:00:01:01:02:22

18. Display Filters C-like symbols, or through English-like abbreviations:
eq, == Equal
ne, != Not equal
gt, > Greater than
lt, < Less Than
ge, >= Greater than or Equal to
le, <= Less than or Equal to

19. Display Filters GUI
Quick Way to Learn Display
Filter Commands

20. Display Filters GUI 1. 3. 2.

21. Display Filters GUI

22. Why Packet Analyzing in this class ?
Useful in Developing Network Application
As a guideline when error encountered

23. Some Useful Information
Wireshark -
TCPDUMP MAN Page -
IP Protocol -

24. Demonstration