Wireshark User's Guide

24295 for Wireshark 0.99.7

Ulf Lamping,Richard Sharpe, NS Computer Software and Services P/L

Ed Warnicke,

Wireshark User's Guide: 24295

for Wireshark 0.99.7by Ulf Lamping, Richard Sharpe, and Ed WarnickeCopyright 2004-2007 Ulf Lamping Richard Sharpe Ed Warnicke

Permission is granted to copy, distribute and/or modify this document under the terms of the GNU General Public License,Version 2 or any later version published by the Free Software Foundation.

All logos and trademarks in this document are property of their respective owner.

Table of ContentsPreface ............................................................................................................... ix

1. Foreword ................................................................................................ ix2. Who should read this document? .................................................................. x3. Acknowledgements ................................................................................... xi4. About this document ................................................................................ xii5. Where to get the latest copy of this document? ............................................. xiii6. Providing feedback about this document ......................................................xiv

1. Introduction ...................................................................................................... 11.1. What is Wireshark? ................................................................................. 1

1.1.1. Some intended purposes ................................................................. 11.1.2. Features ...................................................................................... 11.1.3. Live capture from many different network media ................................ 21.1.4. Import files from many other capture programs .................................. 21.1.5. Export files for many other capture programs ..................................... 21.1.6. Many protocol decoders ................................................................. 21.1.7. Open Source Software ................................................................... 21.1.8. What Wireshark is not ................................................................... 3

1.2. System Requirements ............................................................................... 41.2.1. General Remarks .......................................................................... 41.2.2. Microsoft Windows ....................................................................... 41.2.3. Unix / Linux ................................................................................ 5

1.3. Where to get Wireshark? .......................................................................... 61.4. A brief history of Wireshark ...................................................................... 71.5. Development and maintenance of Wireshark ................................................ 81.6. Reporting problems and getting help ........................................................... 9

1.6.1. Website ...................................................................................... 91.6.2. Wiki ........................................................................................... 91.6.3. FAQ ........................................................................................... 91.6.4. Mailing Lists ............................................................................... 91.6.5. Reporting Problems ......................................................................101.6.6. Reporting Crashes on UNIX/Linux platforms ....................................101.6.7. Reporting Crashes on Windows platforms ........................................11

2. Building and Installing Wireshark ........................................................................132.1. Introduction ..........................................................................................132.2. Obtaining the source and binary distributions ...............................................142.3. Before you build Wireshark under UNIX ....................................................152.4. Building Wireshark from source under UNIX ..............................................172.5. Installing the binaries under UNIX ............................................................18

2.5.1. Installing from rpm's under Red Hat and alike ...................................182.5.2. Installing from deb's under Debian ..................................................182.5.3. Installing from portage under Gentoo Linux ......................................182.5.4. Installing from packages under FreeBSD ..........................................18

2.6. Troubleshooting during the install on Unix ..................................................192.7. Building from source under Windows ........................................................202.8. Installing Wireshark under Windows .........................................................21

2.8.1. Install Wireshark .........................................................................212.8.2. Manual WinPcap Installation .........................................................232.8.3. Update Wireshark ........................................................................232.8.4. Update WinPcap ..........................................................................232.8.5. Uninstall Wireshark .....................................................................232.8.6. Uninstall WinPcap .......................................................................24

3. User Interface ..................................................................................................263.1. Introduction ..........................................................................................263.2. Start Wireshark ......................................................................................273.3. The Main window ..................................................................................28

3.3.1. Main Window Navigation .............................................................293.4. The Menu .............................................................................................30

iv

3.5. The "File" menu .....................................................................................313.6. The "Edit" menu ....................................................................................343.7. The "View" menu ...................................................................................363.8. The "Go" menu ......................................................................................403.9. The "Capture" menu ...............................................................................423.10. The "Analyze" menu .............................................................................443.11. The "Statistics" menu ............................................................................463.12. The "Help" menu ..................................................................................483.13. The "Main" toolbar ...............................................................................503.14. The "Filter" toolbar ...............................................................................533.15. The "Packet List" pane ..........................................................................543.16. The "Packet Details" pane ......................................................................553.17. The "Packet Bytes" pane ........................................................................563.18. The Statusbar .......................................................................................57

4. Capturing Live Network Data .............................................................................594.1. Introduction ..........................................................................................594.2. Prerequisites ..........................................................................................604.3. Start Capturing ......................................................................................614.4. The "Capture Interfaces" dialog box ...........................................................624.5. The "Capture Options" dialog box .............................................................64

4.5.1. Capture frame .............................................................................644.5.2. Capture File(s) frame ....................................................................664.5.3. Stop Capture... frame ....................................................................664.5.4. Display Options frame ..................................................................674.5.5. Name Resolution frame ................................................................674.5.6. Buttons ......................................................................................67

4.6. Capture files and file modes .....................................................................684.7. Link-layer header type ............................................................................704.8. Filtering while capturing ..........................................................................71

4.8.1. Automatic Remote Traffic Filtering .................................................724.9. While a Capture is running ... ...................................................................74

4.9.1. Stop the running capture ...............................................................744.9.2. Restart a running capture ...............................................................75

5. File Input / Out