+ Reply to Thread
Results 1 to 2 of 2

Thread: How to Use Wireshark to Capture, Filter and Inspect Packets

  1. #1
    Moderator ContributorNetywork Analysis Master
    Join Date
    May 2014
    Posts
    204

    How to Use Wireshark to Capture, Filter and Inspect Packets

    Some people are looking for a packet sniffer. Some people installed Wireshark. Some people don’t know how to start using Wireshark.
    That’s why I share this article with you.

    Read more...
    Colasoft Capsa is a portable network analyzer for both LAN and WLAN performing real-time packet capturing, network monitoring, advanced protocol analysis, in-depth packet decoding, and automatic expert diagnosis.
    http://www.colasoft.com/

  2. #2

    Some questions and answers

    1.Which tool is better at performing protocol captures and which tool is better at performing protocol analysis?

    Wireshark is better for performing protocol analysis and Netwitness Investigator is best at performing protocol captures. Wireshark does well at both aspects, which makes it a little better.

    2.What is promiscuous mode and how does this allow tcpdump, Wireshark, and NetWitness Investigator to perform protocol capture off a live network?

    Promiscuous mode is for a wired network interface controller or wireless network interface controller that causes the controller to pass all traffic to the CPU instead of passing only through the frames the controller is supposed to receive. It allows tcpdump, Wireshark, and NetWitness Investigator to perform protocol capture off a live network because it’s made for packet sniffing, which all these applications perform.

    3.What is the significance of the TCP three-way handshake for applications that utilize TCP as a transport protocol? Which application in your protocol capture uses TCP as a transport protocol?

    The significance of the TCP three-way handshake is that three messages are transmitted by TCP to negotiate and start a TCP session between the computers. The purpose is so that two computers can negotiate the parameters of the network TCP socket connection before transmitting the data. Wireshark is the application that uses TCP as a transport protocol.

    4.How many different source IP host addresses did you capture in your protocol capture?

    There were 6 different IP host addresses captured in the protocol capture.

+ Reply to Thread

Tags for this Thread

Posting Permissions

  • You may not post new threads
  • You may not post replies
  • You may not post attachments
  • You may not edit your posts