James Won-Ki Hong: Department of Computer Science and Engineering POSTECH, Korea

James Won-Ki Hong
Department of Computer Science and Engineering
POSTECH, Korea
jwkhong@postech.ac.kr
POSTECH CSED702D: Internet Traffic Monitoring and Analysis 1/39

Outline
 What is Wireshark?
 Capturing Packets
 Analyzing Packets
 Filtering Packets
 Saving and Manipulating Packets
 Packet Statistics
 Colorizing Specific Packets
 References

What is Wireshark?
 The De-Facto Network Protocol Analyzer
 Open-Source (GNU Public License)
 Multi-platform (Windows, Linux, OS X, Solaris, FreeBSD,
NetBSD, and others)
 Easily extensible
 Large development group
 Previously Named “Ethereal”

What is Wireshark?
 Features
 Deep inspection of thousands of protocols
 Live capture and offline analysis
 Standard three-pane packet browser
 Captured network data can be browsed via a GUI, or via
the TTY-mode TShark utility
 The most powerful display filters in the industry
 Rich VoIP analysis
 Live data can be read from Ethernet, IEEE 802.11,
PPP/HDLC, ATM, Bluetooth, USB, Token Ring, Frame
Relay, FDDI, and others
 Coloring rules can be applied to the packet list for quick,
intuitive analysis
 Output can be exported to XML, PostScript®, CSV, or
plain text

What is Wireshark?
 What we can:
 Capture network traffic
 Decode packet protocols using dissectors
 Define filters – capture and display
 Watch smart statistics
 Analyze problems
 Interactively browse that traffic
 Some examples people use Wireshark for:
 Network administrators: troubleshoot network problems
 Network security engineers: examine security problems
 Developers: debug protocol implementations
 People: learn network protocol internals

Interfaces
Packet
List
Packet
Details
Packet
Bytes

Capturing Packets (1/3)

Capture all packets on the

network
Buffer size – in order not
to fill your laptop disk
Capture filter
Display
options
Capture in Name
multiple files resolution
options
When to
automatically
stop the
capture

Example (W-LAN):
Received Signal Strength
Indication (RSSI) and Link
speed (BW)

Analyzing Packets (1/9)
 Ethernet Frame Example

 IP Packet Example

 TCP Packet Example

 TCP 3-way Handshake

 Flow Graph
 Giving us a graphical flow, for better understanding of
what we see

 Flow Graph

 Filtering Specific TCP Stream

 Filtering Specific TCP Stream

 RTP Stream Analysis
Stable
stream BW

Filtering Packets (1/4)
 Applying Filter when Capturing Packets
Capture  Interfaces  Options:

 Applying Filter when Analyzing Packets

 Examples:
 Capture only traffic to or from IP address 172.18.5.4
• host 172.18.5.4
 Capture traffic to or from a range of IP addresses
• net 192.168.0.0/24
• net 192.168.0.0 mask 255.255.255.0
 Capture traffic from a range of IP addresses
• src net 192.168.0.0/24
• src net 192.168.0.0 mask 255.255.255.0
 Capture traffic to a range of IP addresses
• dst net 192.168.0.0/24
• dst net 192.168.0.0 mask 255.255.255.0
 Capture only DNS (port 53) traffic
• port 53
 Capture non-HTTP and non-SMTP traffic on your server
• host www.example.com and not (port 80 or port 25)
• host www.example.com and not port 80 and not port 25

 Examples:
 Capture except all ARP and DNS traffic
• port not 53 and not arp
 Capture traffic within a range of ports
• (tcp[2:2] > 1500 and tcp[2:2] < 1550) or (tcp[4:2] > 1500 and
tcp[4:2] < 1550)
• tcp portrange 1501-1549
 Capture only Ethernet type EAPOL
• ether proto 0x888e
 Capture only IP traffic
(the shortest filter, but sometimes very useful to get rid of lower layer
protocols like ARP and STP)
• ip
 Capture only unicast traffic
(useful to get rid of noise on the network if you only want to see traffic
to and from your machine, not, for example, broadcast and multicast
announcements)
• not broadcast and not multicast

Saving and Manipulating Packets (1/3)
 Save only displayed packets

 Export to CSV file

 Exported CSV File

Packet Statistics (1/8)
 Protocol Hierarchy

 Conversation
 Traffic between two specific endpoints
With some manipulation

 I/O Graph

 Configurable Options
 I/O Graphs
• Graph 1-5: enable the specific graph 1-5 (graph 1 by default)
• Filter: a display filter for this graph (only the packets that pass
this filter will be taken into account for this graph)
• Style: the style of the graph (Line/Impulse/FBar/Dot)
 X Axis
• Tick interval: an interval in x direction lasts
(10/1 minutes or 10/1/0.1/0.01/0.001 seconds)
• Pixels per tick: use 10/5/2/1 pixels per tick interval
• View as time of day: option to view x direction labels as time of
day instead of seconds or minutes since beginning of capture
 Y Axis
• Unit: the unit for the y direction
(Packets/Tick, Bytes/Tick, Bits/Tick, Advanced...)
• Scale: the scale for the y unit
(Logarithmic,Auto,10,20,50,100,200,...)

 TCP Stream Graph

 Round-Trip Time Graph
RTT Vs. Sequence numbers gives us the time that take

to Ack every packet.
In case of variations, it can cause DUPACKs and even
Retransmissions
Usually will happen on communications lines:
Over the Internet
Over cellular networks

 Time / Sequence Graph
Seq No [B]
Time / Sequence representes how sequence numbers

advances with time
In a good connection (like in the example), the line will
be linear
The angle of the line indicates the speed of the
connection. In this example – fast connection
Time [Sec]

 Time / Sequence Graph
Seq No [B]
In this case, we see a non-

contiguous graph
Can be due to:
Severe packet loss
Server response (processing)
time
Time [Sec]

Colorizing Specific Packets (1/4)
 Packet Colorization
 Colorize packets according to a filter
 Allow to emphasize the packets interested in
 A lot of Coloring Rule examples at the Wireshark Wiki
Coloring Rules page at We want to watch a
http://wiki.wireshark.org/ColoringRules specific protocol through
out the capture file



 TLS Connection Establishment

References
 Wireshark Website
 http://www.wireshark.org
 Wireshark Documentation
 http://www.wireshark.org/docs/
 Wireshark Wiki
 http://wiki.wireshark.org
 Network analysis Using Wireshark Cookbook
 http://www.amazon.com/Network-Analysis-Using-Wiresh
ark-Cookbook/dp/1849517649

Q&A

James Won-Ki Hong: Department of Computer Science and Engineering POSTECH, Korea

Uploaded by

Copyright:

Available Formats

James Won-Ki Hong: Department of Computer Science and Engineering POSTECH, Korea

Uploaded by

Document Information

Original Title

Copyright

Available Formats

Share this document

Share or Embed Document

Sharing Options

Did you find this document useful?

Is this content inappropriate?

Copyright:

Available Formats

James Won-Ki Hong: Department of Computer Science and Engineering POSTECH, Korea

Uploaded by

Copyright:

Available Formats

James Won-Ki Hong

Department of Computer Science and Engineering

POSTECH CSED702D: Internet Traffic Monitoring and Analysis 1/39

POSTECH CSED702D: Internet Traffic Monitoring and Analysis 2/39

 Previously Named “Ethereal”

POSTECH CSED702D: Internet Traffic Monitoring and Analysis 3/39

POSTECH CSED702D: Internet Traffic Monitoring and Analysis 4/39

POSTECH CSED702D: Internet Traffic Monitoring and Analysis 5/39

POSTECH CSED702D: Internet Traffic Monitoring and Analysis 6/39

POSTECH CSED702D: Internet Traffic Monitoring and Analysis 7/39

Capture all packets on the

POSTECH CSED702D: Internet Traffic Monitoring and Analysis 8/39

POSTECH CSED702D: Internet Traffic Monitoring and Analysis 9/39

POSTECH CSED702D: Internet Traffic Monitoring and Analysis 10/39

POSTECH CSED702D: Internet Traffic Monitoring and Analysis 11/39

POSTECH CSED702D: Internet Traffic Monitoring and Analysis 12/39

POSTECH CSED702D: Internet Traffic Monitoring and Analysis 13/39

POSTECH CSED702D: Internet Traffic Monitoring and Analysis 14/39

POSTECH CSED702D: Internet Traffic Monitoring and Analysis 15/39

POSTECH CSED702D: Internet Traffic Monitoring and Analysis 16/39

POSTECH CSED702D: Internet Traffic Monitoring and Analysis 17/39

POSTECH CSED702D: Internet Traffic Monitoring and Analysis 18/39

Capture  Interfaces  Options:

POSTECH CSED702D: Internet Traffic Monitoring and Analysis 19/39

POSTECH CSED702D: Internet Traffic Monitoring and Analysis 20/39

POSTECH CSED702D: Internet Traffic Monitoring and Analysis 21/39

POSTECH CSED702D: Internet Traffic Monitoring and Analysis 22/39

 Save only displayed packets

POSTECH CSED702D: Internet Traffic Monitoring and Analysis 23/39

 Export to CSV file

POSTECH CSED702D: Internet Traffic Monitoring and Analysis 24/39

 Exported CSV File

POSTECH CSED702D: Internet Traffic Monitoring and Analysis 25/39

POSTECH CSED702D: Internet Traffic Monitoring and Analysis 26/39

With some manipulation

POSTECH CSED702D: Internet Traffic Monitoring and Analysis 27/39

POSTECH CSED702D: Internet Traffic Monitoring and Analysis 28/39

POSTECH CSED702D: Internet Traffic Monitoring and Analysis 29/39

POSTECH CSED702D: Internet Traffic Monitoring and Analysis 30/39

RTT Vs. Sequence numbers gives us the time that take

POSTECH CSED702D: Internet Traffic Monitoring and Analysis 31/39

Time / Sequence representes how sequence numbers

POSTECH CSED702D: Internet Traffic Monitoring and Analysis 32/39

In this case, we see a non-

POSTECH CSED702D: Internet Traffic Monitoring and Analysis 33/39

POSTECH CSED702D: Internet Traffic Monitoring and Analysis 34/39

POSTECH CSED702D: Internet Traffic Monitoring and Analysis 35/39

POSTECH CSED702D: Internet Traffic Monitoring and Analysis 36/39

POSTECH CSED702D: Internet Traffic Monitoring and Analysis 37/39

POSTECH CSED702D: Internet Traffic Monitoring and Analysis 38/39

POSTECH CSED702D: Internet Traffic Monitoring and Analysis 39/39

You might also like