Haijie Wu
Motivation and Overview
 Wireshark is a network protocol analyzer
www.wireshark.org
 First released in 1998 by Gerald Combs as Ethereal.
 Open source and free software
Motivation and Overview
 Powerful tool for network troubleshooting
 Sniffs and captures live traffic
 Filters data for ease of analysis
 Statistics and graphs available
 Used in industry and academia
Wireshark Installation
 Wireshark can be installed on various platforms
 Unix, Windows, Linux, Mac OS, etc
 Most recent release is 1.4.1
 System requirements
 Rule of thumb: fast CPU, more memory is better
 FAQs and Wiki pages provide more information
Wireshark Installation
 Installation of Wireshark requires
 Downloading the relevant package

Building the source into binary if the source is downloaded
 Install binaries to their destinations
 Windows installation includes WinPcap
 Packet capture library (also needed for tcpdump)
 Installation easy and intuitive
Wireshark—Main Features
 Capturing live traffic
 Data can be captured on wired or wireless medium
 Numerous protocols can be captured and analyzed
 Filtering is essential when dealing with huge number
of packets
 Filters can be applied on protocols, fields, values, etc.
 Filtering while capturing packets is possible
WinP Cap
 Industries –standard tool for link layer network access in




windows environment
Allows application to capture and transmit network
packets by passing the protocol stack
Consists of a driver-extends OS to provide low level
network access
Consists of library for easy access to low level network
layers
Also contains windows version of libPCap Unix API
Wireshark GUI
How to use Wireshark--Capture
 To capture: go the Capture menu and select the




Interfaces that used for transmission network data.
Set the capturing environment.
Start capturing on this interface.
The lively data captured by the interface will be shown
in the window of Wireshark.
Capturing can be stopped by clicking the stop button
on the main toolbar.
Example
Filtering
 You can enter the filter expression directly to the filter
bar.
 The expression is similar to the ‘if statement’ in other
programming languages.
 Or you can click the ‘Expression…” button to choose
the filter options and set the values.
 After all filter setting values have been putted in, click
the ‘Apply’ button.
Statistics measurement
 There are plenty of statistic options provided by
Wireshark.
 Graph Analysis
 Flow graph
 Throughput graph
Throughput graph
Flow graph