How to Use Wireshark to Capture, Filter and Inspect Packets
Wireshark, a network analysis tool formerly known as Ethereal, captures packets in real time and display them in human-readable format. Wireshark includes filters, color-coding and other features that let you dig deep into network traffic and inspect individual packets. This tutorial will get you up to speed with the basics of capturing packets, filtering them, and inspecting them. You can use Wireshark to inspect a suspicious program’s network traffic, analyze the traffic flow on your network, or troubleshoot network problems. Getting Wireshark You can download Wireshark for Windows or Mac OS X from its official website. Just a quick warning: Many organizations don’t allow Wireshark and similar tools on their networks. Capturing Packets After downloading and installing Wireshark, you can launch it and click the name of an interface under Interface List to start capturing packets on that interface. Color Coding You’ll probably see packets highlighted in green, blue, and black.
Related: Tools and Utilities
• Training and cheatsheets