1. TSS Academy
Troubleshooting with

2. So What is WireShark?
Open Source Network Tool
Packet sniffer/protocol analyzer

3. Air PCAP (Hardware)
WiFi Packet Sniffing
Association Issues

4. Cascade Pilot (Commercial)

5. From the Firehose
One gigabit per second, equates to over 83,000 packets per second, or only 12 microseconds per packet. 

6. Wireshark Process Capture Traffic Display & Analyze Traffic
Summarize Traffic

7. Where do I put WireShark?

8. Location, Location, Location

9. Hub

10. Switches

12. Switch with a SPAN port

13. TAP

14. HUBS

15. Switch
interface FastEthernet0/1 port monitor FastEthernet0/2

16. Switch
interface FastEthernet0/1 port monitor FastEthernet0/2 rx Interface FastEthernet0/3 port monitor FastEthernet0/2 tx

17. VLAN Monitoring
interface FastEthernet0/1
port monitor VLAN1

18. “Promiscuous” Mode Ethernet Frames are Addressed.
Ethernet NICs ignore frames not for them.

19. Install Wireshark on Client/Server
Wireshark runs on demand.
WinPCAP can be disabled in Services.

20. Selectively Ignore Traffic

21. Capture Filter Examples
host host and host net /24 net mask src net /24 port 53
tcp port http ip
not broadcast not multicast
ether host 00:04:13:00:09:a3

22. Capture Filter

23. Capture Options

26. Capture Interfaces

27. Capturing Data (Capture Window)

28. Stopping the Packet Capture

29. Displaying Packets

30. Display (Post) Filters
Display filters (also called post-filters) only filter the view of what you are seeing. All packets in the capture still exist in the trace
Display filters use their own format and are much more powerful then capture filters

31. Wireshark Display Filter CheatSheet (packetlife.net)

32. Display Filter Expression Builder
To Search.. Just type….

33. Display Filter Examples
ip.src== ip.addr== && ip.addr== tcp.port==80 || tcp.port==3389 !(ip.addr== && ip.addr== ) (ip.addr== && ip.addr== ) && (tcp.port==445 || tcp.port==139) (ip.addr== && ip.addr== ) && (udp.port==67 || udp.port==68)

34. Display Example
dns.qry.name == " and not dns.resp.addr ==

35. Analyzing Data

36. Statistics Menu

37. I/O Graph (With Filters)

38. Protocol Hierarchy

39. Protocol Hierarchy

40. Follow TCP Stream

41. Follow TCP Stream
red - stuff you sent blue - stuff you get

42. Resources & Credits Wireshark WIKI http://wiki.wireshark.org
ctfiles/672/wireshark.ppt‎