This is our old Q&A Site. Please post any new questions and answers at ask.wireshark.org.

I am joined a research organization and they told me to setup wireshark on their server. Here we are using three server first one is data server(debian), second one is router and third one is print server where we install all the software, printer etc. I don't have any idea about wireshark setup for an organization.

I need to know following information.

On which server i have to installed wireshark. How to install on that server. How to access wireshark. Can I access wireshark from my windows system and if yes the how.

asked 10 Sep '14, 21:35

amit%20sharma's gravatar image

amit sharma
11223
accept rate: 0%


You don't say what technology is used for the router or print servers. I'll assume they are Windows servers to give a mix.

  1. Install the Wireshark suite on all three servers and on your PC
  2. On the Debian server create a script for each network interface to run dumpcap and use the -w option to specify where to write the data to - I recommend you also specify a ring buffer of multiple 200 MB files but be careful to create a ring buffer that doesn't fill the volume it writes to. Also don't write to a disk that is heavily used by the system to avoid performance impact.
  3. On the the Windows servers create a batch (command) file for each network interface to run dumpcap and use the -w option to specify where to write the data to - again specify a ring buffer of multiple 200 MB files being careful to create a ring buffer that doesn't fill the volume it writes to. As with Debian, don't write to a volume that may impact performance e.g. the C: drive, database logging volumes, etc.
  4. Use dumpcap to capture. Just run the scripts and batch files you have created to start and use Ctl-C to stop them.
  5. Transfer the captured trace files from the server to your PC using FTP (make sure you use binary mode) or SMB (via a file share on the server)
  6. Use Wireshark on your PC to do the analysis

I hope that helps.

Best regards...Paul

permanent link

answered 14 Sep '14, 02:24

PaulOfford's gravatar image

PaulOfford
131273237
accept rate: 11%

Thank you for your answer

(14 Sep '14, 23:21) amit sharma
Your answer
toggle preview

Follow this question

By Email:

Once you sign in you will be able to subscribe for any updates here

By RSS:

Answers

Answers and Comments

Markdown Basics

  • *italic* or _italic_
  • **bold** or __bold__
  • link:[text](http://url.com/ "title")
  • image?![alt text](/path/img.jpg "title")
  • numbered list: 1. Foo 2. Bar
  • to add a line break simply add two spaces to where you would like the new line to be.
  • basic HTML tags are also supported

Question tags:

×52
×21

question asked: 10 Sep '14, 21:35

question was seen: 1,264 times

last updated: 14 Sep '14, 23:21

p​o​w​e​r​e​d by O​S​Q​A