Wireshark/Protocol Analysis - Revision history

Admin: /* Wireless Pcap */

2016-01-20T05:16:22Z

Wireless Pcap

← Older revision		Revision as of 05:16, 20 January 2016
Line 16:		Line 16:

	The first percentage shows the share of number of packets. However, packets can vary widely in their size, so the second column shows the share of total traffic. Wireless data packets thus account for 6 percent of of the number of packets, but nearly 50 percent of total traffic - a lopsided ratio.		The first percentage shows the share of number of packets. However, packets can vary widely in their size, so the second column shows the share of total traffic. Wireless data packets thus account for 6 percent of of the number of packets, but nearly 50 percent of total traffic - a lopsided ratio.





	{{WiresharkFlag}}		{{WiresharkFlag}}

Admin: /* Wireless Pcap */

2016-01-20T05:08:30Z

Wireless Pcap

← Older revision		Revision as of 05:08, 20 January 2016
Line 15:		Line 15:
	[[Image:WirelessProtocolHierarchy.png\|500px]]		[[Image:WirelessProtocolHierarchy.png\|500px]]

			The first percentage shows the share of number of packets. However, packets can vary widely in their size, so the second column shows the share of total traffic. Wireless data packets thus account for 6 percent of of the number of packets, but nearly 50 percent of total traffic - a lopsided ratio.


	{{WiresharkFlag}}		{{WiresharkFlag}}

Admin at 03:03, 20 January 2016

2016-01-20T03:03:30Z

← Older revision		Revision as of 03:03, 20 January 2016
Line 9:		Line 9:
	By looking at a network's traffic protocol statistics, you can learn a lot about that network. Example: IT department will have admin protocols like ICMP or SNMP. Ordering department will use lots of SMTP. Interns will use WoW.		By looking at a network's traffic protocol statistics, you can learn a lot about that network. Example: IT department will have admin protocols like ICMP or SNMP. Ordering department will use lots of SMTP. Interns will use WoW.

			==Wireless Pcap==

			If you load a wireless pcap into Wireshark and click Statistics > Protocol Hierarchy, you might see something like this:

			[[Image:WirelessProtocolHierarchy.png\|500px]]



	{{WiresharkFlag}}		{{WiresharkFlag}}

Admin: Created page with "=Protocols= Another way to analyze traffic in Wireshark is to look at statistics about the protocol layer. You can open Statistics > Protocol Hierarchy to see information ab..."

2016-01-20T03:01:52Z

Created page with "=Protocols= Another way to analyze traffic in Wireshark is to look at statistics about the protocol layer. You can open Statistics > Protocol Hierarchy to see information ab..."

New page

=Protocols=

Another way to analyze traffic in Wireshark is to look at statistics about the protocol layer.

You can open Statistics > Protocol Hierarchy to see information about what protocols are used in what amounts.

This can be useful if you are trying to determine "normal" behavior for a network, and then trying to determine if a particular day's traffic is an outlier and why.

By looking at a network's traffic protocol statistics, you can learn a lot about that network. Example: IT department will have admin protocols like ICMP or SNMP. Ordering department will use lots of SMTP. Interns will use WoW.

{{WiresharkFlag}}