Hello, I have newly started using Wireshark for data capturing, can anybody please tell me what are the basic things one should know to work with wireshark. For what purpose the manual pages are useful? asked 24 May '11, 23:23  sagu072 |
2 Answers:
This is a really large topics, so here's what I think you should do:
It looks like a short list, but believe me, it's not something you can do in one afternoon ;-) answered 24 May '11, 23:56  Jasper ♦♦ showing 5 of 6 show 1 more comments |
One good starting point is the book Laura Chappell wrote about Wirshark Network Analysis. It teches you the basics of how to use Wireshark and also the basics of mostly used protocols. answered 25 May '11, 00:54  SYN-bit ♦♦ is that book s free ? it will be helpful for me if u can paste the link to download the book . (25 May '11, 01:16) sagu072 Nope, that is not a free book. If you want to start with free information you might want to check out the following:
(25 May '11, 01:25) SYN-bit ♦♦ hi, i want to know how to decode the data which is in hex dumped format, i mean i want to know what s the exact message flowing through the network by removing the headers of protocol , can u pleas tel me some idea of how i can go to it. (29 May '11, 23:32) sagu072 |
jasper, Thank you very much jasper, knowing protcols is getting to know the working of tat protocol n message structures only right ? o anything else is important .? If u hv any other suggestion pleas post. Thanks Sagar
You need to know message structures first, but also how the protocol works in regard to requests/answers. For example the TCP sequence number/acknowledge number mechanism is something where only knowing the header structure isn't enough - you also need to know how the packets work with each other.
ok, what are dumpcap, mergecap etc, which are provided in manual pages, for wat purpose they can be used ?
(I converted your "answer" into a "comment" as that is how this site works best, see the FAQ)
@SynBit: thx, I would have done the conversion as well but I don't think I can :-)
@sagu072: dumpcap is the executable that does the actual capture on your network card. It can either be used separately or automatically through capturing from within Wireshark. Mergecap is used to merge or concatenate multiple tracefiles.
hi, i want to know how to decode the data which is in hex dumped format, i mean i want to know what s the exact message flowing through the network by removing the headers of protocol , can u pleas tel me some idea of how i can go to it.