With over 5 million downloads of Wireshark every year, network analysts who have skills in packet analysis set themselves apart. To troubleshoot your network, you should learn, really learn about Wireshark.

Packet analysis can analyze network problems, detect network intrusion attempts, perform content monitoring, monitor bandwidth usage per application and process, and verify endpoint security status to see unwanted protocols (such as bogus ARP traffic and Multicast DNS), and gather and report network statistics.

As data flows across the network, a packer analyzer captures each packet, decodes the packet's raw bits, and then displays the field values in the packet according the appropriate RFC or other specification. Network administrators should be familiar with packet analysis, as Wireshark is built into the Cisco Nexus 7000 series and many other devices.

Wireshark, Formerly Ethereal, an Open-Source Packet Analyzer

In the late 1990s, Gerald Combs needed a tool for analyzing network problems. Portable sniffers were available at the time, but they were costly. Combs developed Ethereal with the help of some friends, and this later became Wireshark. It has been around for over 15 years.

In addition to Wireshark, there are other packet analyzers. Cain and Abel can recover passwords by sniffing the network and can record Voice over IP (VoIP) conversations. Tcpdump is a protocol analyzer that runs from the command line. And NarusInsight, formerly Carnivore, can monitor all Internet traffic.

Download and Install

If you have never used Wireshark, go to Wireshark.org. The home page has resources where you can download Wireshark, learn about it, and then enhance your capture abilities with some of the add-ons and interfaces. Select download, which will automatically identify the operating system that is most likely yours. Select that and bring down the executable.

Note: When installing Wireshark on a MAC, you will need to use XQuartz, which is used with some MAC operating systems so that applications such as Wireshark with run with an appropriate GUI.

This is a pretty standard installation. It will take you into the License Agreement, which is a little different because it's the GNU public licensing, and it might be of interest to read it. Next comes a choice of components of Wireshark you want to install. With that, you can see that a number of components are available for installation. I don't generally cherry pick through these, as most of them are needed in order for Wireshark to function correctly.

The default directory is presented where it will be installed, or you can specify another one. At this point you're going to see a window pop up asking, "Install WinPCap?" If you're using Windows, you will need to install WinPCap, as it's one of three capture engines: WinPCap for Windows, LibPcap for Linux, and AirPcap for Wireless.

Once the installation is complete you can run Wireshark. Look at the splash screen to get a little more familiar with Wireshark. See Figure 1.

Figure 1: This is the Wireshark Splash Screen.

On the top, you'll see the menu choices, such as File, Edit, View, Capture, Analyze, Statistics, Tools, and Help. You also see commonly referenced icons, some of which are greyed out simply because there are no packet captures to reference. You'll see the display filter, and then down below you'll see three columns.

Ready to Capture

Select the drop-down menu Capture and select Interfaces, where you'll see a list of interfaces that are available (the Start button remains grayed out until you select one of the interfaces). The one that is actively exchanging packets is the one to select. See Figure 2.

Figure 2: Choose your interface here.

Click Start and your capture will begin. Stop the capture after a few seconds by selecting the red square next to the green fin, as Wireshark can start to consume your resources unless you use a ring buffer.

When you look at your first capture, you'll see three panes:

1. Packet List shows all packets that are captured.
2. Packet Details shows the details of one single packet.
3. Packet Bytes is like a HEX dump that displays the current packet's contents.

The Packet Bytes pane doesn't help in analysis, so I generally remove this by going to View, and unselecting Packet Bytes, which will give you more room on your screen.

If this is your first time looking at Wireshark, select and look at one single frame at a time, and focus on the packet details pane. Here I have selected packet 831 and expanded the headers. See Figure 3.

Figure 3: Look at the details of a single packet.

Curious? Join me next month, as my TechTip will investigate a single TCP packet in Wireshark.

Lisa Bock is an assistant professor in the Information Technology department at Pennsylvania College of Technology, in Williamsport, Pennsylvania. Courses Lisa has taught since 2003 include networking, security, biometrics, cryptography, technical support, protocol vulnerabilities (using Wireshark), CCNA security, requirements analysis, web and organizational security, and digital video production. She holds a MS from University of Maryland University College (UMUC) along with numerous other certifications. She has had training in forensics, networking, steganography, and network security. Lisa has presented at several national IT conferences. Lisa is an author for Lynda.com and is involved with various volunteer activities and has evaluated professional journals and manuscripts. Lisa and her husband, Mike, enjoy bike riding, watching movies, and traveling.

This email address is being protected from spambots. You need JavaScript enabled to view it.

www.pct.edu