Wireshark/Advanced - Revision history

Admin: /* Traffic */

2016-01-20T03:09:53Z

Traffic

← Older revision		Revision as of 03:09, 20 January 2016
Line 17:		Line 17:
	=Traffic=		=Traffic=

	~~Wireshark IO graphs show the measure of traffic in a given space over time. By changing~~ the ~~time resolution you get very different pictures of the data.~~		See the [[Wireshark/Traffic Analysis]] page for information about analyzing the amount of traffic on a network with wireshark.

	~~Case in point: the rather boring 1-second resolution:~~

	[[~~Image:WiresharkIO_1second.png\|500px~~]]

	~~versus~~ the ~~much more interesting 10-minute resolution:~~

	~~[[Image:WiresharkIO_10minute~~.~~png\|500px]]~~




	{{WiresharkFlag}}		{{WiresharkFlag}}

Admin: /* Protocol Statistics */

2016-01-20T03:01:38Z

Protocol Statistics

← Older revision		Revision as of 03:01, 20 January 2016
Line 5:		Line 5:
	See [[Wireshark/Conversation Analysis]] page		See [[Wireshark/Conversation Analysis]] page

	==~~Protocol Statistics~~==		==Protocols==

	~~You can open Statistics >~~ Protocol ~~Hierarchy to see information about what protocols are used in what amounts.~~		See the [[Wireshark/Protocol Analysis]] page for more info on analyzing traffic protocols.

	~~This can be useful if you are trying to determine "normal" behavior~~ for ~~a network, and then trying to determine if a particular day's traffic is an outlier and why.~~

	~~By looking at a network's~~ traffic ~~protocol statistics, you can learn a lot about that network. Example: IT department will have admin~~ protocols ~~like ICMP or SNMP. Ordering department will use lots of SMTP. Interns will use WoW~~.

	==Name Resolution==		==Name Resolution==

Admin: /* Endpoints and Conversations */

2016-01-20T03:00:32Z

Endpoints and Conversations

← Older revision		Revision as of 03:00, 20 January 2016
Line 3:		Line 3:
	==Endpoints and Conversations==		==Endpoints and Conversations==

	~~You can see the network endpoints, or members of a network that initiate~~/~~terminate conversation and communication, by picking Statistics > Endpoints. This shows a list of endpoints and statistics.~~		See [[Wireshark/Conversation Analysis]] page

	~~You can see the conversations between two endpoints by picking Statistics > Conversations, which will show a window with a list of IP address pairs and various statistics of each conversation.~~

	~~Endpoints/Conversations are useful for troubleshooting lots of traffic, or determining which server is busiest.~~

	==Protocol Statistics==		==Protocol Statistics==

Admin: /* Traffic */

2016-01-20T02:54:04Z

Traffic

← Older revision		Revision as of 02:54, 20 January 2016
Line 26:		Line 26:

	Wireshark IO graphs show the measure of traffic in a given space over time. By changing the time resolution you get very different pictures of the data.		Wireshark IO graphs show the measure of traffic in a given space over time. By changing the time resolution you get very different pictures of the data.

			Case in point: the rather boring 1-second resolution:

			[[Image:WiresharkIO_1second.png\|500px]]

			versus the much more interesting 10-minute resolution:

			[[Image:WiresharkIO_10minute.png\|500px]]




	{{WiresharkFlag}}		{{WiresharkFlag}}

Admin: /* Name Resolution */

2016-01-20T02:52:02Z

Name Resolution

← Older revision		Revision as of 02:52, 20 January 2016
Line 22:		Line 22:

	To convert from IP to Human-readable domain name uses DNS protocol.		To convert from IP to Human-readable domain name uses DNS protocol.

			=Traffic=

			Wireshark IO graphs show the measure of traffic in a given space over time. By changing the time resolution you get very different pictures of the data.


	{{WiresharkFlag}}		{{WiresharkFlag}}

Admin: Created page with "=Advanced Stuff= ==Endpoints and Conversations== You can see the network endpoints, or members of a network that initiate/terminate conversation and communication, by pickin..."

2016-01-18T04:35:36Z

Created page with "=Advanced Stuff= ==Endpoints and Conversations== You can see the network endpoints, or members of a network that initiate/terminate conversation and communication, by pickin..."

New page

=Advanced Stuff=

==Endpoints and Conversations==

You can see the network endpoints, or members of a network that initiate/terminate conversation and communication, by picking Statistics > Endpoints. This shows a list of endpoints and statistics.

You can see the conversations between two endpoints by picking Statistics > Conversations, which will show a window with a list of IP address pairs and various statistics of each conversation.

Endpoints/Conversations are useful for troubleshooting lots of traffic, or determining which server is busiest.

==Protocol Statistics==

You can open Statistics > Protocol Hierarchy to see information about what protocols are used in what amounts.

This can be useful if you are trying to determine "normal" behavior for a network, and then trying to determine if a particular day's traffic is an outlier and why.

By looking at a network's traffic protocol statistics, you can learn a lot about that network. Example: IT department will have admin protocols like ICMP or SNMP. Ordering department will use lots of SMTP. Interns will use WoW.

==Name Resolution==

To convert from a MAC address to an IP address is name resolution using the ARP protocol.

To convert from IP to Human-readable domain name uses DNS protocol.

{{WiresharkFlag}}