Infrastructure on The Official Wireshark Blog

Wireshark Tutorial Series. Tips and tricks used by insiders and veterans

Wed, 17 Oct 2012 18:08:26 +0000

For those of you who have attended Sharkfest in the past, you already know that protocol analysis is near and dear to my heart. It’s also a field where experience and art still matter. As great as Wireshark is as a tool, it still takes coaxing by an analyst to ferret out root cause. And as networks and applications become more complex, keeping up will be challenging.

But the one thing that I noticed over the years is that people rush to install sniffers without really thinking about it. It’s almost as if people expect sniffers to magically spit out the root cause, served on a silver platter! In reality, it takes fair amount of protocol and application knowledge to truly bring a tool like Wireshark to bear.

I started posting to this blog so that I can help budding protocol analysts and perhaps show interesting tricks-of-the-trade to veteran users. To become good in this field, it takes a fair amount of practice. It takes practice to know how to capture the right data, where to capture the data, what filters to use, and how to interpret the data. So how do you go about getting started? First, you can watch the accompanying video/tutorial session (see below for the link.) Next, make sure you setup your Wireshark in a consistent manner – the video tutorial covers this.

Ever wonder how router jockeys like me can scroll through a “sho run” output so quickly? It’s because I’ve done it for so long that the eyes are trained to filter out unneeded information. That’s the key to training – knowing what to filter out so your brain can get to work on the important stuff. It turns out protocol analysis works the same way. You have to train your brain to filter out the noise. Setting up your Wireshark environment will go a long way to maximizing productivity.

There is no “right way” to setup Wireshark. There’s only “my way” and everyone else’s – by definition – is wrong! Some like destination address to be the first column just like in DOS Sniffer. Others prefer using Wireshark’s default order. Whatever your style is, make sure it’s consistent. And if you’re just starting out, perhaps you can benefit from my setup. Even Anthony Bourdain in his book “Kitchen Confidential” talks about “mise-en-place.” It’s a term used by chefs and signifies how the cooking stations are setup. It’s important because it makes them more productive. For the same reason, you need to develop your own Wireshark mise-en-place!

If you still have not modified the default layout of Wireshark, you’re definitely missing out. In the video, I’m going to help you setup Wireshark so that you can become more productive. And we’re going to embark on a journey where I show you all the secrets to protocol analysis. I’m like the “magicians’ tricks revealed” guy. I’m going to help make you a rock star – where protocol analysis is concerned – in your company. If you’re an industry veteran, don’t be alarmed. The first few sessions are geared towards beginners so they can catch up. After that, I promise you that we’ll be in the weeds!

Hope you enjoy it, and I’d love to hear your comments. You can reach me at hansang.bae@riverbed.com

Comments 🔗

Comment by Betty DuBois on 2012-10-18 09:24:29 +0000 🔗

Great video Hansang. I’m looking forward to the next installment. Did you know you can left click on the profile name in the status bar to toggle between all of your profiles? Just another way to achieve the goal as quick as possible.

Comment by Tony Fortunato on 2012-10-19 06:28:05 +0000 🔗

very nice. I look forward to more articles

Comment by wireshark on 2012-10-19 08:55:01 +0000 🔗

is there a way with wireshark to simulate / replay website visitor ?

i would like to simulate visitor behaviour and trafic !

thanks

sebastien

Comment by Hansang Bae on 2012-10-20 18:42:03 +0000 🔗

Thanks everyone!
Betty, yes, Gerald actually pointed that out and I was going to edit the video with a popup (but must have forgotten it! 🙂

sebastien,
Wireshark will not replay the data. You’ll need something like tcpreplay (and there are other tools, just google for ‘replay pcap’)

Comment by Chris Greer on 2012-10-21 16:43:33 +0000 🔗

Hansang,
Looking forward to reading and watching your work here.
Thanks for taking the time to get this great info together.

Comment by Travis Marlette on 2012-10-30 08:25:59 +0000 🔗

I look forward to learning more from you Hangseng! Now that my wireshark is setup properly, it should go much faster.

I look forward to your future posts!

Comment by Hansang Bae on 2012-10-31 10:29:02 +0000 🔗

Travis,
Thank you, another session will be posted (hopefully) by next (Nov 10th) weekend. Hurricane Sandy made things a bit difficult – to say the least.

Comment by Alex on 2012-11-13 12:44:53 +0000 🔗

Hey there…

I downloaded the Wirshark software and it works great for viewing packets and destinations running back and forth to my laptop….but I was wondering is there a way for me to see the traffic going to other laptops on my home router….I have 2 children and am concerned who they are chatting with etc…?

Thanks for your help.

Comment by Alex on 2012-11-13 13:31:33 +0000 🔗

Is there anyway to capture the traffic with all laptops (3)on a home router with Wireshark?

Thanks for your help.

Alex

Comment by Hansang Bae on 2012-11-18 21:36:28 +0000 🔗

Alex,
It depends on your home router. Please see

http://www.wireshark.org/faq.html

Q 7.1: When I use Wireshark to capture packets, why do I see only packets to and from my machine, or not see all the traffic I’m expecting to see from or to the machine I’m trying to monitor?

7.2 When I capture with Wireshark, why can’t I see any TCP packets other than packets to and from my machine, even though another analyzer on the network sees those packets?

Comment by Riu on 2012-11-24 08:43:26 +0000 🔗

Great video, but i was wondering how could i send packets to test server responses to them.
Thanks for your help!

Comment by Hansang Bae on 2012-11-26 06:57:06 +0000 🔗

Riu,
You can’t use Wireshark to (re)generate traffic. There are other tools for sending packets out, but for TCP, it can get a little tricky. If you’re interested check out tcpreplay or Google’s Ostinato tool.

Comment by http://business-ethernet.com on 2012-12-02 22:24:57 +0000 🔗

When you’re looking for an Internet connection for your company, you must know a few things about the telecom world, what the different circuits are, and most of all, what is guaranteed and what it is. The marketing hype is often very deceiving, so you need to understand dedicated lines such as business Ethernet, T1 and similar. Additionally you have to know where to look for the best pricing and how to make sure it truly is reliable at the best prices possible.

Comment by bernard on 2012-12-07 15:20:48 +0000 🔗

I must be among the dumber ones. I can’t find the link to the video. Where is it?

Comment by Hansang Bae on 2012-12-07 15:24:57 +0000 🔗

Bernard, it’s the hyperlink in the final paragraph.

“If you still have not modified the default layout of Wireshark, you’re definitely missing out. In the

**> video<** , I’m ….."

Comment by Kostas on 2012-12-15 00:03:21 +0000 🔗

Very helpful! Looking forward for the next one!

Comment by Hansang Bae on 2012-12-15 14:48:09 +0000 🔗

Thank you, I’m currently working on the next set (as I type this…actually). It requires some visual explanation so I’m working through my PPT issues at the moment. LOL. I can do packet analysis, but PPT can elude me at times!

Comment by decaptcha service on 2012-12-15 19:48:28 +0000 🔗

Everyone loves what you guys are usually up too. This type of
clever work and exposure! Keep up the fantastic works guys I’ve added you guys to my own blogroll.

Comment by captcha reader on 2012-12-15 19:54:17 +0000 🔗

Hey I know this is off topic but I was wondering if you
knew of any widgets I could add to my blog that automatically tweet my newest twitter updates.

I’ve been looking for a plug-in like this for quite some time and was hoping maybe you would have some experience with something like this. Please let me know if you run into anything. I truly enjoy reading your blog and I look forward to your new updates.

Comment by captcha decoder on 2012-12-15 19:55:57 +0000 🔗

When I initially commented I clicked the “Notify me when new comments are added” checkbox and now each time a comment is added I get four e-mails with
the same comment. Is there any way you can remove people from that service?
Thanks a lot!

Comment by recaptcha bypass on 2012-12-15 19:58:03 +0000 🔗

When I initially commented I clicked the “Notify me when new comments are added” checkbox and now each time a comment is added I get several emails with
the same comment. Is there any way you can remove people from that service?
Thanks a lot!

Used Cars and Stub Installers

Tue, 06 Dec 2011 19:59:28 +0000

The Wireshark development team works hard to earn the respect of our users. This includes making sure that downloading and installing Wireshark is as easy and trouble-free as possible. Right now the vast majority of our users can go to www.wireshark.org, follow the big green arrows, and immediately download the appropriate Wireshark package for their platform.

For many years a number of third party sites have also offered Wireshark downloads. Typing “wireshark download” into your favorite search engine will turn up a bunch of them, usually just below links to wireshark.org. These sites are popular and often provide valuable services such as reviews and malware prescreening. They also reside outside the Wireshark ecosystem — we don’t link to them and aren’t affiliated with any of them.

"This is the Cadillac of invasive toolbars at a Chevy price!"

Sometimes these sites abuse their relationship with their users. For example a few months ago Download.com started using a stub installer which tries to get you to install various toolbars and who-knows-what-else before it installs the package you ultimately want, much like a sleazy car salesman trying to bundle add-ons you don’t want or need.

This sort of bottom-feeding behavior is harmful to our user community and exploits the goodwill we have with our users. Brian Krebs and Gordon “Fyodor” Lyon describe the problem with much more depth and eloquence than I can.

I sent a request to Download.com to disable their stub installer for Wireshark. They complied, but there are dozens of other download sites. Trying to keep tabs on all of them would result in a never-ending game of Whac-A-Mole®.

On behalf of the Wireshark development team I promise to provide easily accessible, direct downloads of Wireshark from wireshark.org just as we always have. If you choose to download Wireshark somewhere else we can’t guarantee that the experience will be free of shenanigans so please be careful.

Comments 🔗

Comment by Sean B on 2011-12-07 01:36:37 +0000 🔗

But they just wanted to ‘wrap’ all these nice programs in an extra little blanket for…warmth, and safe-keeping…and stuff. I mean who notices extra toolbars and new default search engines? Intrusive? Infuriating? Nonsense.

We’re not Participating in World IPv6 Day. Mostly.

Tue, 07 Jun 2011 17:23:54 +0000

Tomorrow is World IPv6 Day, the largest full-frontal test of IPv6 to date. It is going to be a historic event. It’s also one in which wireshark.org will and won’t be participating.

In one sense every day is IPv6 day here and tomorrow will be just another day. Most of our web sites (anonsvn, ask, this blog, bugs, buildbot, sharkfest, and wiki) have been fully dual-stacked for some time. You can reach them over both IPv4 and IPv6 and so far it’s been working pretty well. The big exception to this is the main web site, which still only has an A record. We can add an AAAA record at any time, but I’ve been holding off doing so until well *after* World IPv6 Day.

My concern is that having an AAAA record in place for www.wireshark.org tomorrow will cause unnecessary problems. If anyone runs into trouble reaching dual-stacked sites I don’t want to impede their ability to troubleshoot the problem by making Wireshark difficult to download.

We’ll add the AAAA record for www.wireshark.org in a few weeks.

P.S. According to the SCM revision logs IPv6 support was introduced in Wireshark in 1998. Tomorrow’s test is long overdue.

Comments 🔗

Comment by reddy on 2011-06-12 08:30:16 +0000 🔗

make sense.

Comment by Smat Testing on 2011-06-14 00:17:12 +0000 🔗

IPv6 good

Comment by guilleme on 2011-06-14 18:58:11 +0000 🔗

All ipv6 is looong overdue.
It started being needed many, many years ago.

Comment by Byte on 2011-06-15 07:56:52 +0000 🔗

I’d suggest creating a separate domain http://www.wiresharkipv4.org with only an A record, and http://www.wiresharkipv6.org with only a AAAA record. Not only handy for testing, but also ensures the site can be reached.

Comment by Gerald Combs on 2011-06-15 11:50:58 +0000 🔗

@Byte we have ip4.wireshark.org (A) and ipv6.wireshark.org (AAAA). They are primarily used by the IPv4/IPv6 connectivity test in the upper right corner of the pages on the web site, but you’re free to use them to connect to the site using your browser. Will that work?

Comment by NickC on 2011-07-08 04:49:31 +0000 🔗

While websites can often respond to more than one name, there is always issues for HTTPS – with certificate name mismatches if the Hostname doesn’t match. As the SSL certificate exchange happens before there is any HTTP sent on the connection, the Host can’t offer multiple certificates, based on the Hostname that will appear only once the SSL connection has been established.
So the wireshark website doesn’t work well via alternative names.

Announcing ask.wireshark.org

Mon, 13 Sep 2010 05:00:00 +0000

There have been requests over the years for an online forum for Wireshark. I’m not too crazy about traditional forums, particularly for support. You often end up digging through a lot of not-so-useful content to get to the information you’re looking for.

(If you can see where this is going and are impatient, you can go straight to the new support Q&A site now. Otherwise read on.)

Last year Jeff Atwood and Joel Spolsky started Stack Exchange, a collection of question & answer sites including Stack Overflow, Server Fault, and Super User. SE fixes everything that’s wrong with traditional form software. Useful answers can be voted up by the community, and “hot” questions are listed first.

Stack Exchange is wonderful but they require you to host your content on their servers. This is goes against my control freak sensibilities, so I had to look elsewhere for a solution. I found OSQA. The software is still beta, but it’s quite functional and becoming quite popular.

Here are some of the things you can do with OSQA:

Vote questions and answers up and down 🔗

This means that the good stuff floats to the top. Additionally the person who posted the question can select one answer as the best.

Comment on questions and answers 🔗

This lets you have a traditional forum-style linear discussion when you need it.

Tag questions 🔗

Tags let you categorize questions. For instance the python tag on Stack Overflow will give you all of the Python programming questions.

Earn karma 🔗

As you ask questions and provide helpful answers you gain karma points. This lets you do things like…

Edit content 🔗

Power users can correct, clarify, or otherwise make helpful changes to things others have posted.

Q&A sites aren’t for everyone. They tend to work best when you have a bunch of helpful, active, and knowledgeable people willing to exchange ideas in a particular field. As luck would have it this describes the Wireshark community to a tee.

Go try it for yourself at http://ask.wireshark.org.

Comments 🔗

Comment by Srivats P. on 2010-09-18 07:04:07 +0000 🔗

Gerald,

How do you distinguish/differentiate the purpose behind the mailing list and ‘ask’ ?

Srivats

Comment by Gerald Combs on 2010-09-18 17:41:27 +0000 🔗

Their purposes certainly overlap. wireshark-users, wireshark-dev, and “ask” all let Wireshark’s user and developer communities interact and help each other.

The mailing lists get a lot of “drive-by” questions — someone asks a question, (hopefully) gets an answer, and is never heard from again. If the person asking the question subscribes to the list he ends up getting a lot of messages from other threads that may not have anything to do with his problem. If he doesn’t subscribe he may not see any responses to his question. A Q&A site is much more suited to this than a mailing list.

However Q&A sites aren’t discussion forums. Long discussions are much more suited to mailing lists (IMHO at least).

Last but not least, some users prefer mailing lists and other prefer the web.

Comment by Brian Bewick on 2010-09-19 14:11:02 +0000 🔗

Hi, How do I find someone if all I have their email address
and a phone number. Please advise, Brian.

Comment by Gerald Combs on 2010-09-22 08:28:20 +0000 🔗

@Brian That’s way outside our scope.

Comment by Bob on 2010-10-25 08:24:50 +0000 🔗

A couple of questions:
I want to monitor wireless traffic from an iphone going to my home linksys router. The only computer I have at home is my windows laptop, so I would be loading wireshark on that?

Sharkfest ’10 Recap

Thu, 24 Jun 2010 21:37:04 +0000

Sharkfest ’10 ended a week ago today and I’m still reeling. The conference started with a keynote from Van Jacobson and ended with one from Harry Saal, two monumental figures in our industry and very nice people to boot. Attendees traveled from all over the globe, from large companies to single-person operations. The presentations were packed with information and it was great to see how experts tackle packet-level network monitoring and troubleshooting. If you missed out we’re getting the presentations online as fast as we can.

Van Jacobson talking about sequence numbers

Harry Saal (left) talks with an attendee

I love Sharkfest. I get to interact with Wireshark developers and users daily but this is one of the few opportunities to meet them face to face. On behalf of CACE, thanks to everyone who attended. It’s great to see so many people enthusiastic about packet capture and about Wireshark!

Wish List: Decent SVG Network Elements

Wed, 25 Nov 2009 05:02:17 +0000

Nmap 5 has a really cool feature: you can scan a network and dump its map to SVG. Inkscape is turning out to be a really nice vector drawing program.

A really useful workflow would be to combine the two:

Map your network using Nmap.
Tweak that map to your liking using Inkscape.
Have a cool map.

Unfortunately this is a harsh, cruel world we live in. The workflow we currently have is:

Map your network using Nmap.
Load the map Inkscape.
Search the interwebs for decent SVG network elements until you have to explain the foul language and crying to your wife.

This is something Visio is famous for (network art, not the foul language and crying). Search for “visio stencils” and you’ll be bombarded with all sorts of network shapes, from major equipment manufacturers to ones that look like crayon art. Where are all the cool SVG network elements? Quantum Bits made a nice start, but we need a lot more than that.

Comments 🔗

Comment by shannon on 2009-12-02 10:09:28 +0000 🔗

this is some good info. thanks, by the way is there some wireshark software for the palm pre?

Comment by Kirby Files on 2009-12-23 13:06:31 +0000 🔗

Just a note: the OpenClipArt site (which can be accessed via the Inkscape “Import from Open Clipart Library” menu) has some (mostly rudimentary) SVG artwork. Try searching for “network”, “router”, or “server”.

Autosuggestive

Wed, 18 Nov 2009 17:37:22 +0000

walmart

wikipedia

Does Wired 96.5 have a morning zoo?

walmart beat weather. wtf?

Comments 🔗

Comment by Chris on 2009-12-02 16:53:31 +0000 🔗

way cool on #1 suggestion for wir as wireshark.
wow for walmart.

btw, eth yields:
ethan allen
ethanol
ethics
ethos
ethel kennedy
ether
ethiopia
ethereal
ethnicity
ethnocentrism

#8 isn’t too bad either, especially considering that it’s essentially been dead for ~3 1/2 years.

We are here at www.wireshark.org…

Tue, 29 Sep 2009 23:17:57 +0000

…where we’ve secretly replaced the Internet Explorer we usually serve with Chrome Frame.

Enjoy.

Does IPv6 Adoption Depend on Akamai?

Mon, 07 Sep 2009 04:11:11 +0000

The ongoing effort to switch the entire planet over to IPv6 has a chicken-and-egg problem: there is little incentive to deploy it if no one else is using it. This is expected to change as IPv4 addresses become more scarce, but for the time being uptake is dismal (in the U.S. at least).

One easy way to measure IPv6 adoption is to see how many of Alexa’s top sites have AAAA records. Hurricane Electric and Lars Eggert do a good job of this. Following in their footsteps my own version of this data is shown below:

IPv6 Adoption - Alexa top 1000

It shows IPv6 adoption in Alexa’s top 1000 sites along with the number of sites using Akamai. The number of IPv6 sites is pretty small but the number of “testing” sites is encouraging. See the notes below for a detailed explanation and breakdown.

Who is Akamai? They’re a giant content and application delivery provider.

If you serve out a bajillion pages to users all over the world, Akamai can help you do it more effectively. They also don’t support IPv6. According to a response I received from them they have no plans to deploy it any time soon. As you can see, if

just one company added IPv6 support, it would have a huge impact on content availability.

Two Akamai users stick out: Apple and Microsoft. Apple’s Airport Extreme gives home users IPv6 automatically, but those users can’t access apple.com over IPv6. The same is true of microsoft.com —Windows Vista and 7 have excellent IPv6 support but you can’t use it to connect to Microsoft. Even worse, Microsoft has a test address (www.ipv6.microsoft.com) which is broken in two ways: it doesn’t follow accepted naming conventsions and it’s currently down.

When Akamai starts delivering IPv6 content, it will be a pretty big milestone.

Notes:

The graph was generated using Amazon’s “top 1 million sites” data from September 6, 2009.
Categories were tabulated thusly: “IPv6 Deployed” sites (5) had AAAA records for either domain.com or www.domain.com. “IPv6 Testing” sites (16) had AAAA records for ipv6.domain.com, www.ipv6.domain.com, or www6.domain.com. “Akamai” sites (108) had CNAMEs pointing to one of the many Akamai domains (akadns.net, edgekey.net, edgesuite.net, or d4p.net).
The data was fudged in two places due to overlap. Microsoft.com was categorized as “Akamai” for reasons discussed above. Sify.com had both test and production AAAA records. They were counted as “IPv6 Deployed.”
Alexa is more of a random number generator rather than an accurate measurement of top web sites. They get their data from people with the Alexa toolbar installed. These people tend to be overly-interested in things like web hosting and search engine optimization. For example, I really like SoftLayer but there’s no way in Hell they should be in the top 500.

Comments 🔗

Comment by Liberty Miller on 2009-09-17 00:34:23 +0000 🔗

Good article! (& better than NCC’s ” IPv6 Act Now” effort .. 😉

And this is HILARIOUS (in that ‘it’s-funny-because-it’s-so-true’ kind of way):

“Even worse, Microsoft has a test address which is broken in two ways…” (etc.)

Reminds me of how I couldn’t find Microsoft sites using Microsoft’s search engine…

Comment by epi on 2009-10-26 23:02:14 +0000 🔗

Scaricity is profitable. As you know money was once backed by scarce gold but currently it is only backed by the greed of hoarders. The limited ipv4 address space could change that and be used for creating a new monetary standard, unfortunately ipv6 would be inflationary.

Wireshark.org and IPv6 plumbing

Mon, 03 Aug 2009 21:38:10 +0000

Wireshark has supported IPv6 since dirt was new. Unfortunately, the wireshark.org web site has only been available over IPv4. Until now, that is. If you are IPv6-enabled, you can reach the Wireshark web site at http://ipv6.wireshark.org. Nota bene:

The address above is only available over IPv6.
The main address for the site (http://www.wireshark.org) is still IPv4-only. We’ll add an AAAA record after a suitable evaluation period.
Other Wireshark sites (such as the bug tracker, wiki, and buildbot) are still IPv4-only for the time being.

In order to encourage the adoption of IPv6 I think the phrases “indoor plumbing” and “outdoor plumbing” should be used to refer to native and tunneled IPv6, respectively. Once you point out that an ISP has outdoor plumbing, they’ll want to add native IPv6 support out of shame.

Examples:

Wireshark.org is hosted at SoftLayer. They have indoor IPv6 plumbing.
Wave Broadband is so behind the times! I’m stuck with outdoor IPv6 plumbing at home!