How to use Wireshark for protocol analysis | Free Cyber Work Applied series

Learn how to analyze network traffic with the free protocol analyzer Wireshark and sniffing tool tcpdump. Then try it yourself! Infosec Skills author Mike Meyers shows you how in this episode of Cyber Work Applied.

0:00 - What is a protocol analyzer?
0:56 - How does a protocol analyzer work?
1:59 - How to capture data using Wireshark
3:48 - What is an ARP?
4:16 - How to filter data in Wireshark
7:13 - Other uses for Wireshark analysis
8:53 - tcpdump demo and walkthrough

About Infosec

[James_Knott]

20 years ago, Wireshark was called Ethereal.
A couple of points. First off, for some reason, people making Wireshark videos seem to rely entirely on display filters and ignore capture filters. This means you're capturing a lot of noise that will make overflowing the buffer more likely. You can use both capture and display filters for maximum flexibility.
Second, many people don't seem to know you can change the display layout. You pushed panel 3 (the hex panel) down to make more room for the other panels. You can change the layout so that panels 2 & 3 are beside each other and then adjust the width of panel 3 to the minimum required to display the hex data and leave the rest of the space for panel 2. You can then adjust the height so you can see whatever portion of panels 1 & 2 you want.

BTW, I created a "data tap" with a 5 port managed switch, which I can insert between two devices, to monitor the connection with a computer running Wireshark.

[tahersadeghi]

This man is a talented author, technician, and a superior describer. Long live and thank you.

[salsalisbury]

Awesome video, easy to follow, great refresher on the topic at hand and value prop of Wireshark and TCPDUMP.

[mclbjyb]

Great video. Thanks for sharing.
What Wireshark book would you recommend for complete beginners?