Slide 1AcknowledgeWhat is Wireshark?Some intended purposesInstall under WindowsInstall under Debian/ UbuntuConfigurationIMPORTANTLive DemoMore resourceITIS3100By Fei XuAcknowledgeThis document is basically a digest from “Wireshark User's Guide 25114 for Wireshark 1.0.0”You can download the software and document at http://www.wireshark.org/http://wiki.wireshark.orgAll logos and trademarks in this document are property of their respective owner.What is Wireshark?Wireshark is a network packet/protocol analyzer. A network packet analyzer will try to capture network packets and tries to display that packet data as detailed as possible.Wireshark is perhaps one of the best open source packet analyzers available today for UNIX and Windows.Some intended purposesnetwork administrators use it to troubleshoot network problemsnetwork security engineers use it to examine security problemsdevelopers use it to debug protocol implementationspeople use it to learn network protocol internalsWireshark isn't an intrusion detection system.Wireshark will not manipulate things on the network, it will only "measure" things from it.Install under WindowsDownloadInstallInstall under Debian/ Ubuntu# apt-get install wiresharkConfigurationThis checkbox allows you to specify that Wireshark should put the interface in promiscuous mode when capturing. If you do not specify this, Wireshark will only capture the packets going to or from your computer (not all packets on your LAN segment).IMPORTANTTURN PROMISCUOUS MODE OFF! IF YOU'RE AT WORK, YOUR NETWORK ADMINISTRATOR MAY SEE YOU RUNNING IN PROMISCUOUS MODE AND SOMEBODY MAY DECIDE TO FIRE YOU FOR THAT.Live DemoHTTPDNSARPPhoto credit: Jeff KubinaMore resourcehttp://wiki.wireshark.orghttp://wiki.wireshark.org/SampleCapturesSearch “wireshark
View Full Document