Learn Wireshark: A definitive guide to expertly analyzing protocols and troubleshooting networks using Wireshark, 2nd Edition

by Lisa Bock

Expertly analyze common protocols such as TCP, IP, and ICMP, along with learning how to use display and capture filters, save and export captures, create IO and stream graphs, and troubleshoot latency issues

Key FeaturesGain a deeper understanding of common protocols so you can easily troubleshoot network issuesExplore ways to examine captures to recognize unusual traffic and possible network attacksLearn advanced techniques, create display and capture filters, and generate IO and stream graphsBook DescriptionWireshark is a popular and powerful packet analysis tool that helps network administrators investigate latency issues and potential attacks. Over the years, there have been many enhancements to Wireshark's functionality. This book will guide you through essential features so you can capture, display, and filter data with ease. In addition to this, you'll gain valuable tips on lesser-known configuration options, which will allow you to complete your analysis in an environment customized to suit your needs.

This updated second edition of Learn Wireshark starts by outlining the benefits of traffic analysis. You'll discover the process of installing Wireshark and become more familiar with the interface. Next, you'll focus on the Internet Suite and then explore deep packet analysis of common protocols such as DNS, DHCP, HTTP, and ARP. The book also guides you through working with the expert system to detect network latency issues, create I/O and stream graphs, subset traffic, and save and export captures. Finally, you'll understand how to share captures using CloudShark, a browser-based solution for analyzing packet captures.

By the end of this Wireshark book, you'll have the skills and hands-on experience you need to conduct deep packet analysis of common protocols and network troubleshooting as well as identify security issues.

What you will learnMaster network analysis and troubleshoot anomalies with WiresharkDiscover the importance of baselining network trafficCorrelate the OSI model with frame formation in WiresharkNarrow in on specific traffic by using display and capture filtersConduct deep packet analysis of common IP, TCP, and ARPUnderstand the role and purpose ofICMP, DNS, HTTP, and DHCPCreate a custom configuration profile and personalize the interfaceCreate I/O and stream graphs to better visualize trafficWho this book is forIf you are a network administrator, security analyst, student, or teacher and want to learn about effective packet analysis using Wireshark, then this book is for you. In order to get the most from this book, you should have basic knowledge of network fundamentals, devices, and protocols along with an understanding of different topologies.

Table of ContentsAppreciating Traffic AnalysisUsing WiresharkInstalling WiresharkExploring the Wireshark InterfaceTapping into the Data StreamPersonalizing the InterfaceUsing Display and Capture FiltersOutlining the OSI ModelDecoding TCP and UDPManaging TCP ConnectionsAnalyzing IPv4 and IPv6Discovering ICMPDiving into DNSExamining DHCPDecoding HTTPUnderstanding ARP<

606 pages, Kindle Edition

Published August 5, 2022

Reviews

[Michael · Rating 2 out of 5]

This book is loaded with good content & screenshots of Wireshark and some basics on doing packet analysis, however, the writing style made it a tough read. There is too much "filler" text informing the reader what the upcoming content is, how the upcoming content will be presented, and what was just covered. It was too repetitive. It comes across more as the author's personal notes or rough draft interjected with filler to satisfy publication requirements. Another nuisance was that several of the external references are no longer accesible on the internet (less than 3 years from the copyright date).