Wireshark/Conversation Analysis - Revision history

Admin at 04:58, 20 January 2016

2016-01-20T04:58:19Z

← Older revision		Revision as of 04:58, 20 January 2016
Line 3:		Line 3:
	One of the most interesting ways to analyze network traffic is by looking at it from a conversations standpoint. This bins traffic by source and destination, giving a fine-grained picture of which stations were responsible for the most traffic, which routers were the busiest, and which routers had the most clients.		One of the most interesting ways to analyze network traffic is by looking at it from a conversations standpoint. This bins traffic by source and destination, giving a fine-grained picture of which stations were responsible for the most traffic, which routers were the busiest, and which routers had the most clients.

	==~~Bringing It Up~~==		==Analyzing Conversations in a Pcap==

	You can see the network endpoints, or members of a network that initiate/terminate conversation and communication, by picking Statistics > Endpoints. This shows a list of endpoints and statistics.		You can see the network endpoints, or members of a network that initiate/terminate conversation and communication, by picking Statistics > Endpoints. This shows a list of endpoints and statistics.
Line 10:		Line 10:

	Endpoints/Conversations are useful for troubleshooting lots of traffic, or determining which server is busiest.		Endpoints/Conversations are useful for troubleshooting lots of traffic, or determining which server is busiest.

	~~==Analyzing A Pcap==~~

	Wireshark can be used to capture and analyze traffic itself, or you can create a pcap file using a utility like tcpdump (see the [[Tcpdump]] page). The utility will create the pcap file. Once it's done, load the file into Wireshark.		Wireshark can be used to capture and analyze traffic itself, or you can create a pcap file using a utility like tcpdump (see the [[Tcpdump]] page). The utility will create the pcap file. Once it's done, load the file into Wireshark.

Admin at 03:00, 20 January 2016

2016-01-20T03:00:17Z

← Older revision		Revision as of 03:00, 20 January 2016
Line 1:		Line 1:
	==Conversations==		=Conversations=

	One of the most interesting ways to analyze network traffic is by looking at it from a conversations standpoint. This bins traffic by source and destination, giving a fine-grained picture of which stations were responsible for the most traffic, which routers were the busiest, and which routers had the most clients.		One of the most interesting ways to analyze network traffic is by looking at it from a conversations standpoint. This bins traffic by source and destination, giving a fine-grained picture of which stations were responsible for the most traffic, which routers were the busiest, and which routers had the most clients.

	Wireshark can be used to capture and analyze traffic itself, or you can create a pcap file using a utility like tcpdump (see the [[Tcpdump]] page) to create ~~a .~~pcap file ~~and~~ load it into Wireshark.		==Bringing It Up==

			You can see the network endpoints, or members of a network that initiate/terminate conversation and communication, by picking Statistics > Endpoints. This shows a list of endpoints and statistics.

			You can see the conversations between two endpoints by picking Statistics > Conversations, which will show a window with a list of IP address pairs and various statistics of each conversation.

			Endpoints/Conversations are useful for troubleshooting lots of traffic, or determining which server is busiest.

			==Analyzing A Pcap==

			Wireshark can be used to capture and analyze traffic itself, or you can create a pcap file using a utility like tcpdump (see the [[Tcpdump]] page). The utility will create the pcap file. Once it's done, load the file into Wireshark.

	[[Image:WiresharkTrafficConversations.png\|500px]]		[[Image:WiresharkTrafficConversations.png\|500px]]

Admin: /* Analyzing Traffic */

2016-01-20T02:59:02Z

Analyzing Traffic

← Older revision		Revision as of 02:59, 20 January 2016
Line 1:		Line 1:
	~~=Analyzing Traffic=~~

	~~There are many ways to analyze network traffic using Wireshark.~~

	==Conversations==		==Conversations==

Admin: Admin moved page Wireshark/Traffic Analysis to Wireshark/Conversation Analysis

2016-01-20T02:58:51Z

Admin moved page Wireshark/Traffic Analysis to Wireshark/Conversation Analysis

← Older revision	Revision as of 02:58, 20 January 2016
(No difference)

Admin: /* Analyzing Traffic */

2016-01-18T05:33:17Z

Analyzing Traffic

← Older revision		Revision as of 05:33, 18 January 2016
Line 1:		Line 1:
	=Analyzing Traffic=		=Analyzing Traffic=

			There are many ways to analyze network traffic using Wireshark.

	==Conversations==		==Conversations==

Admin at 05:32, 18 January 2016

2016-01-18T05:32:21Z

← Older revision		Revision as of 05:32, 18 January 2016
Line 8:		Line 8:

	[[Image:WiresharkTrafficConversations.png\|500px]]		[[Image:WiresharkTrafficConversations.png\|500px]]

			By clicking the "Copy" button at the bottom of the window, you can copy the entire contents of the table to the clipboard, then paste it into emacs or vim.




	{{WiresharkFlag}}		{{WiresharkFlag}}

Admin at 04:49, 18 January 2016

2016-01-18T04:49:40Z

← Older revision		Revision as of 04:49, 18 January 2016
Line 8:		Line 8:

	[[Image:WiresharkTrafficConversations.png\|500px]]		[[Image:WiresharkTrafficConversations.png\|500px]]



			{{WiresharkFlag}}

Admin: /* Conversations */

2016-01-18T04:49:03Z

Conversations

← Older revision		Revision as of 04:49, 18 January 2016
Line 7:		Line 7:
	Wireshark can be used to capture and analyze traffic itself, or you can create a pcap file using a utility like tcpdump (see the [[Tcpdump]] page) to create a .pcap file and load it into Wireshark.		Wireshark can be used to capture and analyze traffic itself, or you can create a pcap file using a utility like tcpdump (see the [[Tcpdump]] page) to create a .pcap file and load it into Wireshark.

	[[WiresharkTrafficConversations.png\|500px]]		[[Image:WiresharkTrafficConversations.png\|500px]]

Admin: /* Conversations */

2016-01-18T04:48:49Z

Conversations

← Older revision		Revision as of 04:48, 18 January 2016
Line 6:		Line 6:

	Wireshark can be used to capture and analyze traffic itself, or you can create a pcap file using a utility like tcpdump (see the [[Tcpdump]] page) to create a .pcap file and load it into Wireshark.		Wireshark can be used to capture and analyze traffic itself, or you can create a pcap file using a utility like tcpdump (see the [[Tcpdump]] page) to create a .pcap file and load it into Wireshark.

			[[WiresharkTrafficConversations.png\|500px]]

Admin: Created page with "=Analyzing Traffic= ==Conversations== One of the most interesting ways to analyze network traffic is by looking at it from a conversations standpoint. This bins traffic by s..."

2016-01-18T04:41:19Z

Created page with "=Analyzing Traffic= ==Conversations== One of the most interesting ways to analyze network traffic is by looking at it from a conversations standpoint. This bins traffic by s..."

New page

=Analyzing Traffic=

==Conversations==

One of the most interesting ways to analyze network traffic is by looking at it from a conversations standpoint. This bins traffic by source and destination, giving a fine-grained picture of which stations were responsible for the most traffic, which routers were the busiest, and which routers had the most clients.

Wireshark can be used to capture and analyze traffic itself, or you can create a pcap file using a utility like tcpdump (see the [[Tcpdump]] page) to create a .pcap file and load it into Wireshark.