1 of 20

Wireshark: A network traffic analysis tool

INDIAN INSTITUTE OF TECHNOLOGY

KHARAGPUR

Department of Computer Science and Engineering

Ubiquitous Networked Systems Lab

2 of 20

What is wireshark

  • Wireshark is a network packet/protocol analyzer
  • Open source
  • Multi-platform
  • Deep inspection of packets
  • Live captures and offline analysis
  • Powerful display filters

​

​

Indian Institute of Technology Kharagpur

3 of 20

Intended purpose

  • Network administrators use it to troubleshoot network problems
  • Examine the security problem
  • Debug protocol implementation
  • Learn network protocol
  • Wireshark will not manipulate the things on the network; it will only measure

​

Indian Institute of Technology Kharagpur

4 of 20

Download and installation

Use the link below to download Wireshark:

https://www.wireshark.org/download.html

Indian Institute of Technology Kharagpur

5 of 20

Wireshark interface

Indian Institute of Technology Kharagpur

6 of 20

Wireshark interface

Header fields

Indian Institute of Technology Kharagpur

7 of 20

Packet statistics

Number of packets captured

Indian Institute of Technology Kharagpur

8 of 20

Packet conversations

  • Go to statistics in the command menus
  • Under statistics, go to conversations

Indian Institute of Technology Kharagpur

9 of 20

Packet filtering

Type ‘HTTP’ in the display filter and enter

Display filter

Indian Institute of Technology Kharagpur

10 of 20

Packet filtering

  • Select the HTTP packet and right-click
  • Go to the ‘Follow’ option and then click on HTTP stream

​

​

Indian Institute of Technology Kharagpur

11 of 20

How to create filter button

Click on sign on the right-hand side of the display filter

Indian Institute of Technology Kharagpur

12 of 20

Display filter example

ip.src==10.5.20.248

ip.addr==10.5.20.248 && ip.addr==172.16.1.164

Tcp.port==80

Tcp.port==80 || tcp.port ==3389

(ip.addr==10.5.20.248 && ip.addr==172.16.1.164) &&(tcp.port==445||tcp.port==139)

(ip.addr==10.5.20.248 && ip.addr==172.16.1.164) &&(udp.port==67||udp.port==68)

​

​

Indian Institute of Technology Kharagpur

13 of 20

Layout change

  • Go to the ‘Edit’ in the command menus
  • Under ‘Edit’, click on Preferences
  • Click on the layout

Indian Institute of Technology Kharagpur

14 of 20

Analyzing packets-Ethernet frame example

Indian Institute of Technology Kharagpur

15 of 20

Analyzing packets-IP header

Indian Institute of Technology Kharagpur

16 of 20

Analyzing TCP header

Indian Institute of Technology Kharagpur

17 of 20

Analyzing TCP handshaking

Indian Institute of Technology Kharagpur

18 of 20

Connection-oriented service

  • Before any data transfer, TCP establish a connection
  • One TCP entity is waiting for a connection (“Server”)
  • The other TCP entity (“Client”) contacts the server

​

Indian Institute of Technology Kharagpur

19 of 20

Protocol Hierarchy

Indian Institute of Technology Kharagpur

20 of 20

Packet Statistics

  • Go to statistics and then select I/O Graphs
  • Graphical visualization tool

​

​

Indian Institute of Technology Kharagpur