1. A Quick Guide to Ethereal/Wireshark

2. Ethereal/Wireshark
In the labs, we use Ethereal/Wireshark to collect and view protocol messages
Ethereal/Wireshark is a free protocol analysis tool:
Ethereal was re-named to Wireshark
Both take advantage of an even older tool: tcpdump
Exists for Windows, Linux, Mac OS
User interface changes a lot between versions and platforms, but the tool is essentially unchanged
Lab Manual has a detailed description

3. User Interface

4. Basic steps Select a network interface for data collection
Ethernet, Wifi, Bluetooth, Loopback, (or a file)
Select which packets should be collected (Capture filter)
Start packet capture
View captured packets in the user interface
Limit the packets that are displayed with Display filter
Save/print packets to a file
Many options
Use “print” to save packets in a text file
Use “save” to save packets as a “.pcap” file. “.pcap” files can be used to view the captured packets offline

5. Capture Filters and Display Filters
Capture filters are set before packet capture is started
Display filters can be set during or after a packet capture
Syntax for capture filters and display filters is different !
Capture filters use the syntax of tcpdump tool
Example: All IP packets with IP destination address
Capture filter: dst host
Display filter: ip.dst==
Prelabs have some exercises