Revision as of 03:00, 20 January 2016

Advanced Stuff

Endpoints and Conversations

See Wireshark/Conversation Analysis page

Protocol Statistics

You can open Statistics > Protocol Hierarchy to see information about what protocols are used in what amounts.

This can be useful if you are trying to determine "normal" behavior for a network, and then trying to determine if a particular day's traffic is an outlier and why.

By looking at a network's traffic protocol statistics, you can learn a lot about that network. Example: IT department will have admin protocols like ICMP or SNMP. Ordering department will use lots of SMTP. Interns will use WoW.

Name Resolution

To convert from a MAC address to an IP address is name resolution using the ARP protocol.

To convert from IP to Human-readable domain name uses DNS protocol.

Traffic

Wireshark IO graphs show the measure of traffic in a given space over time. By changing the time resolution you get very different pictures of the data.

Case in point: the rather boring 1-second resolution:

versus the much more interesting 10-minute resolution:

@@ Line 3: / Line 3: @@
 ==Endpoints and Conversations==
-You can see the network endpoints, or members of a network that initiate/terminate conversation and communication, by picking Statistics > Endpoints. This shows a list of endpoints and statistics.
+See [[Wireshark/Conversation Analysis]] page
-You can see the conversations between two endpoints by picking Statistics > Conversations, which will show a window with a list of IP address pairs and various statistics of each conversation.
-Endpoints/Conversations are useful for troubleshooting lots of traffic, or determining which server is busiest.
 ==Protocol Statistics==

Wireshark/Advanced: Difference between revisions

From charlesreid1