1. 4/10/2017 2:53 PM
SIM202
We Don't Need No Stinkin' GUI: Command-Line Capture Techniques (Remote Options)
Laura Chappell
Founder, Wireshark University
Founder, Chappell University
© 2007 Microsoft Corporation. All rights reserved. Microsoft, Windows, Windows Vista and other product names are or may be registered trademarks and/or trademarks in the U.S. and/or other countries.
The information herein is for informational purposes only and represents the current view of Microsoft Corporation as of the date of this presentation. Because Microsoft must respond to changing market conditions, it should not be interpreted to be a commitment on the part of Microsoft, and Microsoft cannot guarantee the accuracy of any information provided after the date of this presentation. MICROSOFT MAKES NO WARRANTIES, EXPRESS, IMPLIED OR STATUTORY, AS TO THE INFORMATION IN THIS PRESENTATION.

2. It’s Baaaaack! Laura’s Lab Kit v10
Tenth Anniversary Edition
Available for free at the Global Knowledge booth (#1803)
Trace files and training for network forensics and troubleshooting
Announcing

3. Why Use CLI Capture? Packet loss Lower resource requirements
Top 10 Reasons Your Network is Slow
Why Use CLI Capture?
Packet loss
Lower resource requirements
Easy to distribute CLI tools

4. Tshark vs. Dumpcap Both CLI capture tools included with Wireshark
Tshark relies on dumpcap for capture
Tshark offers more flexibility during the capture process

5. Tshark Setup
Put it in your path!
Run from your “traces” directory

6. Key Parameters

7. Key Parameters
Example:

8. Key Parameters
show during capture
Example:

9. Key Parameters
Example:

10. Filtering tshark captures with display filters (-R) doesn’t work
Key Parameters
Example:
Bug 2234:
Filtering tshark captures with display filters (-R) doesn’t work

11. Key Parameters
Example:

12. Extracting Fields at Command-Line

13. Extracting Fields at Command-Line

14. Statistics with Tshark

15. Examples to Try

16. Examples to Try

17. Examples to Try

18. ask.wireshark.org

19. Remote Capture In Wireshark… see Capture Options Address 1 Address 2
rpcapd
rpcapd
rpcapd

20. rpcapd.exe Parameters
rpcapd –b n

21. Required Slide
Speakers, please list the Breakout Sessions, Interactive Discussions, Labs, Demo Stations and Certification Exam that relate to your session. Also indicate when they can find you staffing in the TLC.
Tech Ed North America 2010
4/10/2017 2:53 PM
Related Content
SIM201: Wiretapping 101: Catching Evidence on the Network
WCL201: Become a Wireshark Guru: 10 Hot Skills for Faster Troubleshooting
SIM327: Rethinking Cyber Threats: Experts Panel
Laura’s Lab Kit v10 DVD: Available at the Global Knowledge booth 1803
Wireshark Certified Network Analyst
Find Me Later At… the Global Knowledge Booth
© 2010 Microsoft Corporation. All rights reserved. Microsoft, Windows, Windows Vista and other product names are or may be registered trademarks and/or trademarks in the U.S. and/or other countries.
The information herein is for informational purposes only and represents the current view of Microsoft Corporation as of the date of this presentation. Because Microsoft must respond to changing market conditions, it should not be interpreted to be a commitment on the part of Microsoft, and Microsoft cannot guarantee the accuracy of any information provided after the date of this presentation. MICROSOFT MAKES NO WARRANTIES, EXPRESS, IMPLIED OR STATUTORY, AS TO THE INFORMATION IN THIS PRESENTATION.

22. Trustworthy Computing
4/10/2017 2:53 PM
Trustworthy Computing
Safety and Security Center
Security Development Lifecycle
Security Intelligence Report
End to End Trust
© 2007 Microsoft Corporation. All rights reserved. Microsoft, Windows, Windows Vista and other product names are or may be registered trademarks and/or trademarks in the U.S. and/or other countries.
The information herein is for informational purposes only and represents the current view of Microsoft Corporation as of the date of this presentation. Because Microsoft must respond to changing market conditions, it should not be interpreted to be a commitment on the part of Microsoft, and Microsoft cannot guarantee the accuracy of any information provided after the date of this presentation. MICROSOFT MAKES NO WARRANTIES, EXPRESS, IMPLIED OR STATUTORY, AS TO THE INFORMATION IN THIS PRESENTATION.

23. Resources Learning http://northamerica.msteched.com
Tech Ed North America 2010
4/10/2017 2:53 PM
Resources
Connect. Share. Discuss.
Learning
Sessions On-Demand & Community
Microsoft Certification & Training Resources
Resources for IT Professionals
Resources for Developers
© 2010 Microsoft Corporation. All rights reserved. Microsoft, Windows, Windows Vista and other product names are or may be registered trademarks and/or trademarks in the U.S. and/or other countries.
The information herein is for informational purposes only and represents the current view of Microsoft Corporation as of the date of this presentation. Because Microsoft must respond to changing market conditions, it should not be interpreted to be a commitment on the part of Microsoft, and Microsoft cannot guarantee the accuracy of any information provided after the date of this presentation. MICROSOFT MAKES NO WARRANTIES, EXPRESS, IMPLIED OR STATUTORY, AS TO THE INFORMATION IN THIS PRESENTATION.

24. Complete an evaluation on CommNet and enter to win!
Tech Ed North America 2010
4/10/2017 2:53 PM
Complete an evaluation on CommNet and enter to win!
© 2010 Microsoft Corporation. All rights reserved. Microsoft, Windows, Windows Vista and other product names are or may be registered trademarks and/or trademarks in the U.S. and/or other countries.
The information herein is for informational purposes only and represents the current view of Microsoft Corporation as of the date of this presentation. Because Microsoft must respond to changing market conditions, it should not be interpreted to be a commitment on the part of Microsoft, and Microsoft cannot guarantee the accuracy of any information provided after the date of this presentation. MICROSOFT MAKES NO WARRANTIES, EXPRESS, IMPLIED OR STATUTORY, AS TO THE INFORMATION IN THIS PRESENTATION.

25. Tech Ed North America 2010 4/10/2017 2:53 PM
© 2010 Microsoft Corporation. All rights reserved. Microsoft, Windows, Windows Vista and other product names are or may be registered trademarks and/or trademarks in the U.S. and/or other countries.
The information herein is for informational purposes only and represents the current view of Microsoft Corporation as of the date of this presentation. Because Microsoft must respond to changing market conditions, it should not be interpreted to be a commitment on the part of Microsoft, and Microsoft cannot guarantee the accuracy of any information provided after the date of this presentation. MICROSOFT MAKES NO WARRANTIES, EXPRESS, IMPLIED OR STATUTORY, AS TO THE INFORMATION IN THIS PRESENTATION.