Table of Contents
- Introduction
Appendix D. Related command line tools
- Wireshark capturing packets and letting you inspect their contents
- Main window
- Menu
- "File" menu
- "Edit" menu
- "View" menu
- "Go" menu
- "Capture" menu
- "Analyze" menu
- "Statistics" menu
- "Telephony" menu
- "Tools" menu
- "Help" menu
- "Main" toolbar
- "Filter" toolbar
- "Packet list" pane
- "Packet details" pane
- "Packet bytes" pane
- "Packet bytes" pane with tabs
- Initial status bar
- Status bar with loaded capture file
- Status bar with configuration profile menu
- Status bar with selected protocol field
- Status bar with display filter message
List of Tables
- Typographic conventions
- Keyboard navigation
- File menu items
- Edit menu items
- View menu items
- Go menu items
- Capture menu items
- Analyze menu items
- Statistics menu items
- Telephony menu items
- Tools menu items
- Help menu items
- Main toolbar items
- Filter toolbar items
- Related packet symbols
List of Examples
- Capture filter for telnet to capture traffic to and from a specific host
- Capturing all telnet traffic not from 10.0.0.5
Preface
- Preface
Wireshark is the world's foremost network protocol analyzer, but the rich feature set can be intimidating for those unfamiliar with it. This document represents an effort by the Wireshark team to improve usability. We hope you find it useful and look forward to your feedback. 2. Who should read this document?
This book targets anyone who uses Wireshark. It explains all of Wireshark's basic functions and some advanced features. Since Wireshark has become an extremely complex program, not all functions are explained in this book. This book is not intended to explain general network sniffing or provide detailed information about specific network protocols. A wealth of useful information on these topics can be found on the Wireshark Wiki at https://wiki.wireshark.org/. By reading this book, you will learn how to install Wireshark, how to use the basic elements of the graphical user interface (such as menus), and the rationale behind some advanced features that are not always obvious at first glance. It should help you resolve common issues that frequently arise for new (and sometimes even advanced) Wireshark users. 3. Acknowledgements
The author wishes to thank the entire Wireshark team for their assistance. In particular, the author thanks: - Gerald Combs, for starting the Wireshark project and funding this documentation.
- Guy Harris, for many useful tips and tremendous patience during reviews.
- Gilbert Ramirez, for encouragement and helpful hints throughout.
The author also wishes to thank the following individuals for their beneficial feedback: - Pat Eyler, for suggestions on improving the backtrace examples.
- Martin Regner, for various suggestions and corrections.
- Graeme Hewson, for numerous grammar corrections.
The author thanks the manual page and README authors of the Wireshark project, from whose work much of this document borrowed: - Scott Renfro's mergecap man page (Section D.8, "mergecap: Merging multiple capture files into one").
- Ashok Narayanan from his text2pcap man page (Section D.9, "text2pcap: Converting ASCII hexdumps to network captures").
- About this document
This book was originally developed by Richard Sharpe, funded by the Wireshark Fund. It was updated by Ed Warnicke and most recently redesigned and updated by Ulf Lamping. It was initially written in DocBook/XML and converted to AsciiDoc by Gerald Combs. 5. Where to get the latest copy of this document
The latest copy of this documentation can be found at https://www.wireshark.org/docs/. 6. Providing feedback on this document
Please send any feedback on this document to wireshark-dev [AT] wireshark.org. 7. Typographic conventions
The following table shows the typographic conventions used in this guide. | Style | Description | Example |
|---|---|---|
| Italic | Filenames, folder names, and extensions | C:\\Development\\wireshark |
| Monospace | Commands, flags, and environment variables | CMake's -G option |
| Bold Monospace | Commands to be run by the user | Run cmake -G Ninja .. |
| Keys | Dialog and window buttons | Press Enter to go to the next packet |
| Keys | Keyboard shortcuts | Press Ctrl + Down to move to the next packet |
| Menu | Menu items | Select Go → Next Packet to move to the next packet |
7.1. Advisories
Important and noteworthy items are marked as follows: | Warning | You should pay attantion to a warning, otherwise you might lose data. | |---|---|
| Note | Notes will point out common errors and things that might not be obvious. |
|---|
| Tip | Tips are helpful for your daily work with Wireshark. |
|---|
7.2. Shell prompts and source code examples
Bourne shell, regular user.
$ # this is a comment
$ git config --global log.abbrevcommit true
Bourne shell, root user.
## this is a comment
# ninja install
Command prompt (cmd.exe).
> rem this is a comment
> cd C:\Development
PowerShell.
PS > # this is a comment
PS > choco list -l
C source code.
#include "config.h"
/* this method dissects foos */
static int
dissect_foo_message(tvbuff_t *tvb, packet_info *pinfo _U_, proto_tree *tree _U_, void *data _U_)
{
/* TODO: implement your dissecting code */
return tvb_captured_length(tvb);
}
Chapter 1. Introduction
1.1. What is Wireshark?
Wireshark is a network packet analyzer. A network packet analyzer will try to capture network packets and attempt to display that packet data as detailed as possible. You could think of a network packet analyzer as a measuring device used to examine what's happening inside a network cable, similar to how an electrician uses a voltmeter to check what's happening inside an electrical cable (but at a higher level, of course). In the past, such tools were either very expensive or didn't exist. However, with Wireshark's availability, that has changed. Wireshark is free software, open source, and is one of the best packet analyzers available today. ### 1.1.1. Some intended use cases
Here are some reasons people use Wireshark: - Network administrators use it to troubleshoot network problems
- Network security engineers use it to examine security problems
- QA engineers use it to verify network applications
- Developers use it to debug protocol implementations
- People use it to learn network protocol internals
Wireshark is also helpful in many other situations. ### 1.1.2. Features
The following are some of the many features Wireshark provides: - Capture live network data from a network interface
- Open files containing packet data captured with tcpdump/WinDump, Wireshark, and many other packet capture programs
- Import packets from text files containing hexadecimal packet data
- Display packets with very detailed protocol information
- Save captured packet data
- Export packets to many capture file formats
- Filter packets by many criteria
- Search for packets by many criteria
- Colorize packet display based on filters
- Create various statistics
- ...and many more!
However, to really appreciate its power, you must start using it. Figure 1.1 shows Wireshark having captured some packets and waiting for you to examine them. Figure 1.1. Wireshark capturing packets and letting you inspect their contents### 1.1.3. Live capture from many different network media
Wireshark can capture traffic from many different network media types, including Ethernet, wireless LAN, Bluetooth, USB, and more. The specific media types supported may be limited by various factors including your hardware and operating system. See the CaptureSetup/NetworkMedia wiki page for an overview of supported media types. ### 1.1.4. Import files from many other capture programs
Wireshark can open packet captures from a large number of capture programs. See Section 5.2.2, "Input File Formats" for the list of input formats. ### 1.1.5. Export files to many other capture programs
Wireshark can save captured packets in many formats. See Section 5.3.2, "Output File Formats" for the list of output formats. ### 1.1.6. Many protocol dissectors
Protocol dissectors (or decoders, as they are known in some products) exist for many protocols. See Appendix C, "Protocols and Protocol Fields". ### 1.1.7. Open source software
Wireshark is an open source software project, released under the GNU General Public License (GPL). You are free to use Wireshark on any number of computers without worrying about license keys or fees. Additionally, all source code is freely available under the GPL. Because of this, people can easily add new protocols to Wireshark—whether as plugins or built into the source—and they do so frequently! ### 1.1.8. What Wireshark is not
Here are some things Wireshark does not provide: - Wireshark is not an intrusion detection system. It won't alert you when someone does something strange on your network that they aren't allowed to do. However, if something strange happens, Wireshark might help you figure out what happened.
- Wireshark doesn't manipulate network things, it only measures them. Wireshark doesn't send packets on the network or perform other active things (except for name resolution, which can be disabled).
1.2. System Requirements
The amount of resources Wireshark needs depends on your environment and on the size of the capture file you are analyzing. For small to medium sized captures (a few hundred MB), the values below should be fine. Larger capture files will require more memory and disk space. | Busy networks mean large captures | |---| | Busy networks can produce huge capture files. Even capturing on a 100 megabit network can produce hundreds of megabytes of capture data in a short time. A computer with a fast processor, lots of memory, and disk space is always a good idea. |
Wireshark should support any Windows version that is still within its extended support lifecycle. At the time of this writing, that includes Windows 10, 8.1, 8, 7, Server 2019, Server 2016, Server 2012 R2, Server 2012, and Server 2008 R2. It also requires: - The Universal C Runtime. This is included in Windows 10 and Windows Server 2019, and is automatically installed on earlier versions if Windows Update is enabled. Otherwise, you must install KB2999226 or KB3118401.
- Any modern 64-bit AMD64/x86-64 or 32-bit x86 processor.
- 500 MB available memory. Larger capture files need more RAM.
- 500 MB available disk space. Capture files need additional disk space.
- Any modern display. A resolution of 1280×1024 or higher is recommended. Wireshark will use HiDPI or Retina resolution if available. Advanced users may find multiple monitors useful.
- A supported network interface for capturing
- Ethernet. Any card supported by Windows should work. See the wiki page about Ethernet capture and offloading for possible issues in your environment.
- 802.11. See the Wireshark wiki page. Capturing raw 802.11 information can be difficult without special equipment.
- Other media. See https://wiki.wireshark.org/CaptureSetup/NetworkMedia.
See the Wireshark release lifecycle page for more details. ### 1.2.2. UNIX/Linux
Wireshark runs on most UNIX and UNIX-like platforms, including macOS and Linux. System requirements should be similar to those listed for Windows above. Binary packages are available for most Unices and Linux distributions, including the following platforms: - Alpine Linux
- Apple macOS
- Canonical Ubuntu
- Debian GNU/Linux
- FreeBSD
- Gentoo Linux
- HP-UX
- Mandriva Linux
- NetBSD
- OpenPKG
- Oracle Solaris
- Red Hat Enterprise Linux/CentOS/Fedora
If your platform doesn't have a binary package, you can download the source and try to build it. Report your experience to wireshark-dev [AT] wireshark.org. 1.3. Where to get Wireshark
You can get the latest version of the program from the Wireshark website at https://www.wireshark.org/download.html. The download page should automatically highlight the appropriate download for your platform and direct you to the nearest mirror. Official Windows and macOS installers are signed by the Wireshark Foundation. A new Wireshark version typically becomes available every month or two. If you want to be notified about new Wireshark versions, you should subscribe to the wireshark-announce mailing list. You will find more details about this in Section 1.6.5, "Mailing Lists". 1.4. A brief history of Wireshark
In late 1997, Gerald Combs needed a tool to track down network problems and wanted to learn more about networking, so he started writing Ethereal (the original name of the Wireshark project) as a way to solve both of these needs. Ethereal was initially developed in several pauses between July 1998 and was first released as version 0.2.0. Within days, patches, bug reports, and words of encouragement started arriving, and Ethereal was on its way to success. Not long after that, Gilbert Ramirez saw its potential and contributed a low-level dissector. In October 1998, Guy Harris was looking for something better than tcpview, so he started applying patches and dissectors to Ethereal. Towards the end of 1998, Richard Sharpe was teaching a TCP/IP course and saw its potential, so he started looking at it to see if it supported the protocols he needed. While new protocols could be added easily at the time, he started contributing dissectors and patches. Since then, the list of people contributing to the project has become very long, and almost all of them started by using the protocols they needed Wireshark to handle or have not yet handled. So, they copied existing dissectors and contributed code to the team. In 2006, the project moved house and emerged with a new name: Wireshark. In 2008, after a decade of development, Wireshark 1.0 was finally released. This version was considered the first release to be complete, implementing a minimum of functionality. Its release coincided with the first Wireshark Developers and Users Conference, named Sharkfest. In 2015, Wireshark 2.0 was released, featuring a new user interface. 1.5. Wireshark development and maintenance
Wireshark was initially developed by Gerald Combs. Ongoing development and maintenance of Wireshark is done by the Wireshark team, a loose group of people who fix bugs and provide new features. There are also many people who contribute protocol dissectors to Wireshark, and this is expected to continue. You can find the list of people who have contributed code to Wireshark in the About dialog of Wireshark or on the authors page of the Wireshark website. Wireshark is an open source software project released under the GNU General Public License version 2. All source code is freely available under the GPL. You are welcome to modify Wireshark to suit your own needs, and if you contribute improvements to the Wireshark team, we would be grateful. By contributing your improvements to the community, you gain three benefits: 1. People who find your contributions useful will appreciate them, and you will know that you helped people in the same way the developers of Wireshark have helped you. 2. The Wireshark developers can further improve your changes or implement other features on top of your code, which might also benefit you. 3. The maintainers and developers of Wireshark will maintain your code, fixing it when API changes or other changes are made, and generally keeping things consistant with the rest of Wireshark. So, when Wireshark is updated (which usually happens often), you can get the new Wireshark version from the website, and your changes will be included without any extra effort on your part.
Source and binary packages for Wireshark are available for download from the Wireshark website's download page: https://www.wireshark.org/download.html. 1.6. Reporting problems and getting help
If you encounter a problem or need help with Wireshark, there are several places you might want to look (apart from this guide, of course). ### 1.6.1. Website
You will find a lot of useful information on the Wireshark homepage at https://www.wireshark.org/. ### 1.6.2. Wiki
The Wireshark Wiki at https://wiki.wireshark.org/ provides a wide range of information related to Wireshark and packet capturing. You will find a lot of information not covered in this user guide. For example, it explains how to capture on a switched network, the ongoing effort to build a protocol reference, and protocol-specific information. Most importantly, if you would like to contribute knowledge about a specific topic (perhaps a network protocol you are familiar with), you can use the web browser to edit the wiki pages. ### 1.6.3. Q&A site
The Wireshark Q&A site at https://ask.wireshark.org/ provides a resource where questions and answers are collected together. You can search previously asked questions and see the answers given by people who know the answer. The answers are ranked, so you can easily pick out the best answer. If you haven't found an answer to your question before, you can post it yourself. ### 1.6.4. FAQ
The "Frequently Asked Questions" will list common questions and their answers. | Read the FAQ | |---| | Before sending any mail to the mailing lists below, be sure to read the FAQ. It often answers questions that come up again and again. This will save time for yourself and others and keep the traffic on the mailing list at a manageable level. Many people on the mailing lists are subscribed to the mailing lists. |
There are several mailing lists for specific Wireshark topics: Wireshark AnnounceThis mailing list will notify you about new program releases, usually appearing every four to eight weeks.Wireshark UsersThis list is for Wireshark users. People post questions about building and using Wireshark, others (hopefully) provide answers.Wireshark DevThis list is for Wireshark developers. If you want to start developing protocol dissectors, you should join this list.You can subscribe to each of these lists from the Wireshark website: https://www.wireshark.org/lists/. From there, you can select which lists to subscribe to by clicking the "Subscribe/Unsubscribe/Options" button under the relevant list title. Links to the archives are also included on that page. | Lists are archived | |---| | You can search in the list archives to see if someone previously asked the same question and maybe got an answer. This way you don't have to wait until someone answers your question. |
When reporting crashes, providing a backtrace will be very helpful. You can get this on UNIX or Linux using the following command (note the backticks): ```
$ gdb which wireshark core>& backtrace.txt
backtrace
^D
If you don't have `gdb` available, you will have to check your operating system's debugger. Mail the `backtrace.txt` to wireshark-dev \[AT\] wireshark.org. ### 1.6.8. Reporting crashes on Windows
The Windows distributions don't include symbol files (.pdb) because they are very large. You can download them from https://www.wireshark.org/download/win32/all-versions/ and https://www.wireshark.org/download/win64/all-versions/.