What Is Wireshark and How to Use It - Tutorial

[tuffor]

What Is Wireshark?

Wireshark is a sniffer, as well as a packet analyzer, you can think of a sniffer as a measuring device. We use it to examine whats going on inside a network cable, or in the air if we are dealing with a wireless network. A sniffer shows us the data that passes through our network card. A sniffer could just display a stream of bits - ones and zeroes, that the network card sees.

Wireshark is also a packer analyzer that displays lots of meaningful data about the frames that it sees. It's an open-source and free tool, and is widely used to analyze network traffic. It might be helpful for debugging problems in your network, for instance if you cant connect from one computer to another, and want to understand whats going on.


For using Wireshark you will need:
- A computer running Wireshark.
- Administrative or root privileges.
- Basic knowledge of networking concepts.

1. Install Wireshark: Download and install Wireshark from the official website for your operating system.
2. Open Wireshark: Launch Wireshark. Depending on your system, you might need administrative privileges to capture traffic.
3. Select Network Interface: Choose the network interface you want to capture traffic on (e.g., Ethernet, Wi-Fi). Click the interface name to start capturing.
4. Capture Traffic: Wireshark will start capturing network traffic on the selected interface. You'll see a live list of captured packets.
5. Filter Traffic: You can apply filters to narrow down the captured data. For example, you can use "tcp" to display only TCP traffic or "ip.addr == 192.168.1.1" to show traffic to or from a specific IP address.
6. Inspect Packets: Select a packet in the list to view its details in the packet details pane. You can see information like source and destination IP addresses, port numbers, and the packet's payload.
7. Follow TCP Streams: Right-click on a TCP packet and select "Follow" to see the entire conversation in a readable format.
8. Save Captured Data: You can save the captured data for later analysis using the "File" menu


Wireshark offers a decent range of features for in-depth network analysis:

1. Colour Coding: Packets are colour-coded for easy identification. Green for TCP, blue for UDP, and so on.
2. Statistics: Wireshark provides various statistics, including endpoints, conversations, and protocol hierarchy, to help you analyse network traffic.
3. Protocol Support: Wireshark understands a wide range of network protocols and can dissect their packets, making it easy to analyse different types of traffic.
4. Follow TCP/UDP Streams: You can follow the entire conversation between two endpoints for protocols like HTTP, FTP, or VoIP.
5. Conversations: The "Statistics" menu provides various options to analyse network conversations.
6. Display Filters: You can use display filters to focus on specific packets, protocols, or IP addresses.
7. Custom Columns: Customize the packet list view by adding or removing columns to display specific information.
8. VoIP Analysis: Wireshark can decode and analyse VoIP calls, making it useful for troubleshooting VoIP issues.

Leave a like to upload more content

​