Wireshark User's Guide
|  | Next

# Wireshark User's Guide

## for Wireshark 1.9

### Ulf Lamping

### Richard Sharpe

NS Computer Software and Services P/L

### Ed Warnicke

Copyright © 2004-2012 Ulf Lamping , Richard Sharpe , Ed Warnicke

Permission is granted to copy, distribute and/or modify this document under the terms of the GNU General Public License, Version 2 or any later version published by the Free Software Foundation.

All logos and trademarks in this document are property of their respective owner.

List of Figures

1.1. Wireshark captures packets and allows you to examine their content.
3.1. The Main window
3.2. The Menu
3.3. The "File" Menu
3.4. The "Edit" Menu
3.5. The "View" Menu
3.6. The "Go" Menu
3.7. The "Capture" Menu
3.8. The "Analyze" Menu
3.9. The "Statistics" Menu
3.10. The "Telephony" Menu
3.11. The "Tools" Menu
3.12. The "Internals" Menu
3.13. The "Help" Menu
3.14. The "Main" toolbar
3.15. The "Filter" toolbar
3.16. The "Packet List" pane
3.17. The "Packet Details" pane
3.18. The "Packet Bytes" pane
3.19. The "Packet Bytes" pane with tabs
3.20. The initial Statusbar
3.21. The Statusbar with a loaded capture file
3.22. The Statusbar with a configuration profile menu
3.23. The Statusbar with a selected protocol field
3.24. The Statusbar with a display filter message
4.1. The "Capture Interfaces" dialog box on Microsoft Windows
4.2. The "Capture Interfaces" dialog box on Unix/Linux
4.3. The "Capture Options" dialog box
4.4. The "Edit Interface Settings" dialog box
4.5. The "Compile Results" dialog box
4.6. The "Add New Interfaces" dialog box
4.7. The "Add New Interfaces - Pipes" dialog box
4.8. The "Add New Interfaces - Local Interfaces" dialog box
4.9. The "Add New Interfaces - Remote Interfaces" dialog box
4.10. The "Remote Capture Interfaces" dialog box
4.11. The "Remote Capture Settings" dialog box
4.12. The "Interface Details" dialog box
4.13. The "Capture Info" dialog box
5.1. "Open" on native Windows
5.2. "Open" - new GTK version
5.3. "Open" - old GTK version
5.4. "Save" on native Windows
5.5. "Save" - new GTK version
5.6. "Save" - old GTK version
5.7. "Merge" on native Windows
5.8. "Merge" - new GTK version
5.9. "Merge" - old GTK version
5.10. The "File Import" dialog
5.11. The "List Files" dialog box
5.12. The "Export as Plain Text File" dialog box
5.13. The "Export as PostScript File" dialog box
5.14. The "Export as PSML File" dialog box
5.15. The "Export as PDML File" dialog box
5.16. The "Export Selected Packet Bytes" dialog box
5.17. The "Export Objects" dialog box
5.18. The "Print" dialog box
5.19. The "Packet Range" frame
5.20. The "Packet Format" frame
6.1. Wireshark with a TCP packet selected for viewing
6.2. Viewing a packet in a separate window
6.3. Pop-up menu of the "Packet List" column header
6.4. Pop-up menu of the "Packet List" pane
6.5. Pop-up menu of the "Packet Details" pane
6.6. Filtering on the TCP protocol
6.7. The "Filter Expression" dialog box
6.8. The "Capture Filters" and "Display Filters" dialog boxes
6.9. The "Find Packet" dialog box
6.10. The "Go To Packet" dialog box
6.11. Wireshark showing a time referenced packet
7.1. The "Follow TCP Stream" dialog box
7.2. The "Packet Bytes" pane with a reassembled tab
8.1. The "Summary" window
8.2. The "Protocol Hierarchy" window
8.3. The "Conversations" window
8.4. The "Endpoints" window
8.5. The "IO Graphs" window
8.6. The "Compute DCE-RPC statistics" window
8.7. The "DCE-RPC Statistic for ..." window
8.8. The "Compare" window
8.9. The "WLAN Traffic Statistics" window
9.1. The "RTP Stream Analysis" window
9.2. The "LTE MAC Traffic Statistics" window
9.3. The "LTE RLC Traffic Statistics" window
10.1. The "Coloring Rules" dialog box
10.2. The "Edit Color Filter" dialog box
10.3. The "Choose color" dialog box
10.4. Using color filters with Wireshark
10.5. The "Enabled Protocols" dialog box
10.6. The "Decode As" dialog box
10.7. The "Decode As: Show" dialog box
10.8. The preferences dialog box
10.9. The interface options dialog box
10.10. The configuration profiles dialog box

List of Tables

3.1. Keyboard Navigation
3.2. File menu items
3.3. Edit menu items
3.4. View menu items
3.5. Go menu items
3.6. Capture menu items
3.7. Analyze menu items
3.8. Statistics menu items
3.9. Telephony menu items
3.10. Tools menu items
3.11. Help menu items
3.12. Help menu items
3.13. Main toolbar items
3.14. Filter toolbar items
4.1. Capture file mode selected by capture options
5.1. The system specific "Open Capture File" dialog box
5.2. The system specific "Save Capture File As" dialog box
5.3. The system specific "Merge Capture File As" dialog box
6.1. The menu items of the "Packet List" column header pop-up menu
6.2. The menu items of the "Packet List" pop-up menu
6.3. The menu items of the "Packet Details" pop-up menu
6.4. Display Filter comparison operators
6.5. Display Filter Field Types
6.6. Display Filter Logical Operations
7.1. Some example expert infos
7.2. Time zone examples for UTC arrival times (without DST)
A.1. Configuration files and folders overview

List of Examples

2.1. Building GTK+ from source
2.2. Building and installing libpcap
2.3. Installing required RPMs under Red Hat Linux 6.2 and beyond
2.4. Installing debs under Debian, Ubuntu and other Debian derivatives
4.1. A capture filter for telnet that captures traffic to and from a particular host
4.2. Capturing all telnet traffic not from 10.0.0.5
10.1. Help information available from Wireshark
D.1. Help information available from tshark
D.2. Help information available from dumpcap
D.3. Help information available from capinfos
D.4. Help information available from rawshark
D.5. Help information available from editcap
D.6. Capture file types available from editcap
D.7. Encapsulation types available from editcap
D.8. Help information available from mergecap
D.9. Simple example of using mergecap
D.10. Help information available for text2pcap

|  | Next
|  | Preface