Learn Wireshark

Learn how to analyze protocols and create IO and stream graphs to better visualize traffic while exploring cutting-edge techniques to solve network latency problems and investigate security issues

Key Features

• Gain a deeper understanding of common protocols so you can easily troubleshoot network issues
• Explore ways to examine captures to recognize unusual traffic and possible network attacks
• Learn advanced techniques, create display and capture filters, and generate IO and stream graphs

Book Description

Wireshark is a popular and powerful packet analysis tool that helps network administrators investigate latency issues and potential attacks. Over the years, there have been many enhancements to Wireshark's functionality. This book will guide you through essential features, so you can capture, display, and filter data with ease. In addition to this, you'll gain valuable tips on lesser-known configuration options, which will allow you to complete your analysis in an environment customized to suit your needs.

This updated second edition of Learn Wireshark starts by discussing the benefits of traffic analysis. You'll discover the process of installing Wireshark and become more familiar with the interface. Next, you'll focus on the Internet Suite and then explore deep packet analysis of common protocols such as DNS, DHCP, HTTP, and ARP. The book also guides you through working with the expert system to detect network latency issues, create IO and stream graphs, subset traffic, and save and export captures. Finally, you'll understand how to share captures using CloudShark, a browser-based solution for analyzing packet captures.

By the end of this Wireshark book, you'll have the skills and hands-on experience you need to conduct deep packet analysis of common protocols and network troubleshooting as well as identify security issues.

What you will learn

• Leverage network analysis and troubleshoot anomalies with Wireshark
• Discover the importance of baselining network traffic
• Correlate the OSI model with frame formation in Wireshark
• Narrow in on specific traffic by using display and capture filters
• Carry out deep packet analysis of common protocols - IP, TCP, and ARP
• Understand the role and purpose of ICMP, ARP, and DHCP
• Create a tailored configuration profile
• Create IO and stream graphs to better visualize traffic

Who This Book Is For

If you're a network administrator, security analyst, student, or teacher interested in learning about effective packet analysis using the updated version of Wireshark, then this book is for you. Basic knowledge of network fundamentals, devices, and protocols along with an understanding of different topologies is required to get the most out of this book.

Table of Contents

1. Appreciating Traffic Analysis
2. Using Wireshark
3. Installing Wireshark on a PC or macOS
4. Exploring the Wireshark Interface
5. Tapping into the Data Stream
6. Personalizing the Interface
7. Using Display and Capture Filters
8. Outlining the OSI Model
9. Decoding TCP and UDP
10. Managing TCP Connections
11. Analyzing IPv4 and IPv6
12. Discovering ICMP
13. Diving into DNS
14. Examining DHCP
15. Decoding HTTP
16. Understanding ARP
17. Determining Network Latency Issues
18. Subsetting, Saving, and Exporting Captures
19. Discovering IO and Stream Graphs
20. Using Cloudshark for Packet Analysis