Wireshark - 0.99.5 User Manuals

Table of Contents

• Wireshark User's Guide

  3
• Table of Contents

  4
• Preface

  8
  • 1. Foreword

    8
  • 2. Who should read this document?

    9
  • 3. Acknowledgements

    10
  • 4. About this document

    11
  • 5. Where to get the latest copy of this document?

    12
  • 6. Providing feedback about this document

    13
• Chapter 1. Introduction

  15
  • 1.1. What is Wireshark?

    15
    • 1.1.1. Some intended purposes

      15
    • 1.1.2. Features

      15
    • 1.1.3. Live capture from many different network media

      16
    • 1.1.4. Import files from many other capture programs

      16
    • 1.1.5. Export files for many other capture programs

      16
    • 1.1.6. Many protocol decoders

      16
    • 1.1.7. Open Source Software

      16
    • 1.1.8. What Wireshark is not

      17
  • 1.2. System Requirements

    18
    • 1.2.1. General Remarks

      18
    • 1.2.2. Microsoft Windows

      18
    • 1.2.3. Unix / Linux

      19
  • 1.3. Where to get Wireshark?

    20
  • 1.4. A brief history of Wireshark

    21
  • 1.5.  Development and maintenance of Wireshark

    22
  • 1.6. Reporting problems and getting help

    23
    • 1.6.1. Website

      23
    • 1.6.2. Wiki

      23
    • 1.6.3. FAQ

      23
    • 1.6.4. Mailing Lists

      23
    • 1.6.5. Reporting Problems

      24
    • 1.6.6. Reporting Crashes on UNIX/Linux platforms

      24
    • 1.6.7. Reporting Crashes on Windows platforms

      25
• Chapter 2. Building and Installing Wireshark

  27
  • 2.1. Introduction

    27
  • 2.2. Obtaining the source and binary distributions

    28
  • 2.3. Before you build Wireshark under UNIX

    29
  • 2.4. Building Wireshark from source under UNIX

    31
  • 2.5. Installing the binaries under UNIX

    32
    • 2.5.1. Installing from rpm's under RedHat and alike

      32
    • 2.5.2. Installing from deb's under Debian

      32
    • 2.5.3. Installing from portage under Gentoo Linux

      32
    • 2.5.4. Installing from packages under FreeBSD

      32
  • 2.6. Troubleshooting during the install on Unix

    33
  • 2.7. Building from source under Windows

    34
  • 2.8. Installing Wireshark under Windows

    35
    • 2.8.1. Install Wireshark

      35
      • 2.8.1.1. "Choose Components" page

        35
      • 2.8.1.2. "Additional Tasks" page

        36
      • 2.8.1.3. "Install WinPcap?" page

        36
      • 2.8.1.4. Command line options

        36
    • 2.8.2. Manual WinPcap Installation

      37
    • 2.8.3. Update Wireshark

      37
    • 2.8.4. Update WinPcap

      37
    • 2.8.5. Uninstall Wireshark

      37
    • 2.8.6. Uninstall WinPcap

      38
• Chapter 3. User Interface

  40
  • 3.1. Introduction

    40
  • 3.2. Start Wireshark

    41
  • 3.3. The Main window

    42
    • 3.3.1. Main Window Navigation

      43
  • 3.4. The Menu

    44
  • 3.5. The "File" menu

    45
  • 3.6. The "Edit" menu

    48
  • 3.7. The "View" menu

    50
  • 3.8. The "Go" menu

    54
  • 3.9. The "Capture" menu

    56
  • 3.10. The "Analyze" menu

    58
  • 3.11. The "Statistics" menu

    60
  • 3.12. The "Help" menu

    62
  • 3.13. The "Main" toolbar

    64
  • 3.14. The "Filter" toolbar

    67
  • 3.15. The "Packet List" pane

    68
  • 3.16. The "Packet Details" pane

    69
  • 3.17. The "Packet Bytes" pane

    70
  • 3.18. The Statusbar

    71
• Chapter 4. Capturing Live Network Data

  73
  • 4.1. Introduction

    73
  • 4.2. Prerequisites

    74
  • 4.3. Start Capturing

    75
  • 4.4. The "Capture Interfaces" dialog box

    76
  • 4.5. The "Capture Options" dialog box

    78
    • 4.5.1. Capture frame

      78
    • 4.5.2. Capture File(s) frame

      80
    • 4.5.3. Stop Capture... frame

      80
    • 4.5.4. Display Options frame

      81
    • 4.5.5. Name Resolution frame

      81
    • 4.5.6. Buttons

      81
  • 4.6. Capture files and file modes

    82
  • 4.7. Link-layer header type

    84
  • 4.8. Filtering while capturing

    85
    • 4.8.1. Automatic Remote Traffic Filtering

      86
  • 4.9. While a Capture is running ...

    88
    • 4.9.1. Stop the running capture

      88
    • 4.9.2. Restart a running capture

      89
• Chapter 5. File Input / Output and Printing

  91
  • 5.1. Introduction

    91
  • 5.2. Open capture files

    92
    • 5.2.1. The "Open Capture File" dialog box

      92
    • 5.2.2. Input File Formats

      94
  • 5.3. Saving captured packets

    96
    • 5.3.1. The "Save Capture File As" dialog box

      96
    • 5.3.2. Output File Formats

      98
  • 5.4. Merging capture files

    100
    • 5.4.1. The "Merge with Capture File" dialog box

      100
  • 5.5. File Sets

    102
    • 5.5.1. The "List Files" dialog box

      102
  • 5.6. Exporting data

    104
    • 5.6.1. The "Export as Plain Text File" dialog box

      104
    • 5.6.2. The "Export as PostScript File" dialog box

      104
    • 5.6.3. The "Export as CSV (Comma Separated Values) File" dialog box

      105
    • 5.6.4. The "Export as PSML File" dialog box

      105
    • 5.6.5. The "Export as PDML File" dialog box

      106
    • 5.6.6. The "Export selected packet bytes" dialog box

      107
    • 5.6.7. The "Export Objects" dialog box

      108
  • 5.7. Printing packets

    110
    • 5.7.1. The "Print" dialog box

      110
  • 5.8. The Packet Range frame

    112
  • 5.9. The Packet Format frame

    113
• Chapter 6. Working with captured packets

  115
  • 6.1. Viewing packets you have captured

    115
  • 6.2. Pop-up menus

    117
    • 6.2.1. Pop-up menu of the "Packet List" pane

      117
    • 6.2.2. Pop-up menu of the "Packet Details" pane

      119
  • 6.3. Filtering packets while viewing

    122
  • 6.4. Building display filter expressions

    124
    • 6.4.1. Display filter fields

      124
    • 6.4.2. Comparing values

      124
    • 6.4.3. Combining expressions

      125
    • 6.4.4. A common mistake

      127
  • 6.5. The "Filter Expression" dialog box

    128
  • 6.6. Defining and saving filters

    130
  • 6.7. Finding packets

    132
    • 6.7.1. The "Find Packet" dialog box

      132
    • 6.7.2. The "Find Next" command

      133
    • 6.7.3. The "Find Previous" command

      133
  • 6.8. Go to a specific packet

    134
    • 6.8.1. The "Go Back" command

      134
    • 6.8.2. The "Go Forward" command

      134
    • 6.8.3. The "Go to Packet" dialog box

      134
    • 6.8.4. The "Go to Corresponding Packet" command

      134
    • 6.8.5. The "Go to First Packet" command

      134
    • 6.8.6. The "Go to Last Packet" command

      134
  • 6.9. Marking packets

    135
  • 6.10. Time display formats and time references

    136
    • 6.10.1. Packet time referencing

      136
• Chapter 7. Advanced Topics

  139
  • 7.1. Introduction

    139
  • 7.2. Following TCP streams

    140
    • 7.2.1. The "Follow TCP Stream" dialog box

      140
  • 7.3. Time Stamps

    142
    • 7.3.1. Wireshark internals

      142
    • 7.3.2. Capture file formats

      142
    • 7.3.3. Accuracy

      142
  • 7.4. Time Zones

    144
    • 7.4.1. Set your computer's time correct!

      145
    • 7.4.2. Wireshark and Time Zones

      145
  • 7.5. Packet Reassembling

    147
    • 7.5.1. What is it?

      147
    • 7.5.2. How Wireshark handles it

      147
  • 7.6. Name Resolution

    149
    • 7.6.1. Name Resolution drawbacks

      149
    • 7.6.2. Ethernet name resolution (MAC layer)

      149
    • 7.6.3. IP name resolution (network layer)

      150
    • 7.6.4. IPX name resolution (network layer)

      150
    • 7.6.5. TCP/UDP port name resolution (transport layer)

      150
  • 7.7. Checksums

    151
    • 7.7.1. Wireshark checksum validation

      151
    • 7.7.2. Checksum offloading

      152
• Chapter 8. Statistics

  154
  • 8.1. Introduction

    154
  • 8.2. The "Summary" window

    155
  • 8.3. The "Protocol Hierarchy" window

    157
  • 8.4. Endpoints

    159
    • 8.4.1. What is an Endpoint?

      159
    • 8.4.2. The "Endpoints" window

      159
    • 8.4.3. The protocol specific "Endpoint List" windows

      160
  • 8.5. Conversations

    161
    • 8.5.1. What is a Conversation?

      161
    • 8.5.2. The "Conversations" window

      161
    • 8.5.3. The protocol specific "Conversation List" windows

      161
  • 8.6. The "IO Graphs" window

    162
  • 8.7. Service Response Time

    164
    • 8.7.1. The "Service Response Time DCE-RPC" window

      164
  • 8.8. The protocol specific statistics windows

    166
• Chapter 9. Customizing Wireshark

  168
  • 9.1. Introduction

    168
  • 9.2. Start Wireshark from the command line

    169
  • 9.3. Packet colorization

    174
  • 9.4. Control Protocol dissection

    177
    • 9.4.1. The "Enabled Protocols" dialog box

      177
    • 9.4.2. User Specified Decodes

      179
    • 9.4.3. Show User Specified Decodes

      180
  • 9.5. Preferences

    181
  • 9.6. User Table

    182
  • 9.7. Display Filter Macros

    183
  • 9.8. Tektronics K12xx/15 RF5 protocols Table

    184
  • 9.9. User DLTs protocol table

    185
  • 9.10. SNMP users Table

    186
• Appendix A. Files and Folders

  188
  • A.1. Capture Files

    188
    • A.1.1. Libpcap File Contents

      188
    • A.1.2. Not Saved in the Capture File

      188
  • A.2. Configuration Files and Folders

    190
  • A.3. Windows folders

    194
    • A.3.1. Windows profiles

      194
    • A.3.2. Windows Vista/XP/2000/NT roaming profiles

      194
    • A.3.3. Windows temporary folder

      194
• Appendix B. Protocols and Protocol Fields

  197
• Appendix C. Wireshark Messages

  198
  • C.1. Packet List Messages

    198
    • C.1.1. [Malformed Packet]

      198
    • C.1.2. [Packet size limited during capture]

      198
  • C.2. Packet Details Messages

    199
    • C.2.1. [Response in frame: 123]

      199
    • C.2.2. [Request in frame: 123]

      199
    • C.2.3. [Time from request: 0.123 seconds]

      199
• Appendix D. Related command line tools

  201
  • D.1. Introduction

    201
  • D.2. tshark: Terminal-based Wireshark

    202
  • D.3. tcpdump: Capturing with tcpdump for viewing with Wireshark

    203
  • D.4. dumpcap: Capturing with dumpcap for viewing with Wireshark

    204
  • D.5. capinfos: Print information about capture files

    205
  • D.6. editcap: Edit capture files

    206
  • D.7. mergecap: Merging multiple capture files into one

    209
  • D.8. text2pcap: Converting ASCII hexdumps to network captures

    212
  • D.9. idl2wrs: Creating dissectors from CORBA IDL files

    215
    • D.9.1. What is it?

      215
    • D.9.2. Why do this?

      215
    • D.9.3. How to use idl2wrs

      215
    • D.9.4. TODO

      216
    • D.9.5. Limitations

      217
    • D.9.6. Notes

      217
• Appendix E. This Document's License (GPL)

  219