Wireshark Fundamentals: A Network Engineer’s Handbook to Analyzing Network Traffic

Length: 272 pages
Edition: 1
Language: English
Publisher: Apress
Publication Date: 2022-03-23
ISBN-10: 1484280016
ISBN-13: 9781484280010
Sales Rank: #0 (See Top 100 Books)

Understand the fundamentals of the Wireshark tool that is key for network engineers and network security analysts. This book explains how the Wireshark tool can be used to analyze network traffic and teaches you network protocols and features.

Author Vinit Jain walks you through the use of Wireshark to analyze network traffic by expanding each section of a header and examining its value. Performing packet capture and analyzing network traffic can be a complex, time-consuming, and tedious task. With the help of this book, you will use the Wireshark tool to its full potential. You will be able to build a strong foundation and know how Layer 2, 3, and 4 traffic behave, how various routing protocols and the Overlay Protocol function, and you will become familiar with their packet structure.

Troubleshooting engineers will learn how to analyze traffic and identify issues in the network related to packet loss, bursty traffic, voice quality issues, etc. The book will help you understand the challenges faced in any network environment and how packet capture tools can be used to identify and isolate those issues.

This hands-on guide teaches you how to perform various lab tasks. By the end of the book, you will have in-depth knowledge of the Wireshark tool and its features, including filtering and traffic analysis through graphs. You will know how to analyze traffic, find patterns of offending traffic, and secure your network.

What You Will Learn

Understand the architecture of Wireshark on different operating systems
Analyze Layer 2 and 3 traffic frames
Analyze routing protocol traffic
Troubleshoot using Wireshark Graphs

Who This Book Is For

Network engineers, security specialists, technical support engineers, consultants, and cyber security engineers

Table of Contents
About the Author
About the Technical Reviewers
Acknowledgments
Introduction
Chapter 1: Introduction to Wireshark
    Introduction to Network Traffic Analysis
        Network Sniffing
            Sniffer Placement
            Number of Sniffer Placements
            Network Tap
    Overview of Wireshark
    Installing Wireshark
        Installing Wireshark on Windows
        Installing Wireshark on Mac
            Installing Wireshark on Ubuntu
    Setting Up Port Mirroring
        SPAN on Cisco IOS/IOS-XE
        SPAN on Cisco Nexus Switches
        Enabling Port Mirroring on Arista EOS
        Enabling Port Mirroring on JunOS
    Summary
    References in This Chapter
Chapter 2: Getting Familiar with Wireshark
    Overview of Wireshark Tool
        Wireshark Preferences
            Appearance
            Capture
            Expert
            Filter Buttons
            Name Resolution
            Protocols
            RSA Keys
            Statistics
            Advanced
    Performing Packet Capture Using Wireshark
        Dissectors
        Configuration Profiles
        Filtering with Wireshark
            Capture Filters
            Display Filters
    Working with Wireshark Capture Files
        PCAP vs. PCAPng
            Capture from Multiple Interfaces
            Timestamps
            Embedding Comments
            Metadata
            Extendable Format
        Splitting Packet Captures into Multiple Files
        Merging Multiple Capture Files
    Analyzing Packets in Wireshark
        OSI Model
        Analyzing Packets
            Time
            Length
            Capture File Properties
    Summary
Chapter 3: Analyzing Layer 2 and Layer 3 Traffic
    Layer 2 Frames
        Ethernet Frames
    Layer 3 Packets
        Address Resolution Protocol
        IPv4 Packets
            IPv4 Addressing
            ICMP
            IP Fragmentation and Reassembly
        IPv6 Packets
            IPv6 Addressing
            Extension Headers
            ICMPv6
            IPv6 Neighbor Discovery
    Analyzing QoS Markings
    Summary
    Reference in This Chapter
Chapter 4: Analyzing Layer 4 Traffic
    Understanding the TCP/IP Model
        Problem of Ownership
    Transmission Control Protocol
        TCP Flags
        TCP Three-Way Handshake
        Port Scanning
        Investigating Packet Loss
            TCP Retransmission
            TCP Out-of-Order Packets
        Troubleshooting with Wireshark Graphs
            TCP Stream Graphs
            Time Sequence (Stevens)
            Time Sequence (tcptrace)
            Throughput Graph
            Window Scaling Graph
            RTT Graph
            I/O Graphs
            Flow Graphs
        TCP Expert
            Wireshark Profile for TCP
    User Datagram Protocol
    Summary
    References in This Chapter
Chapter 5: Analyzing Control Plane Traffic
    Analyzing Routing Protocol Traffic
        OSPF
        EIGRP
            Hello Packet
            Update Packet
            Acknowledge Packet
            Query Packet
            Reply Packet
        BGP
        PIM
            PIM Hello Message
            PIM Register Message
            PIM Register-Stop Message
            PIM Join/Prune Message
    Analyzing Overlay Traffic
        GRE
        IPSec
        VXLAN
    Summary
Index

Donate to keep this site alive

To access the Link, solve the captcha.

How to download source code?

1. Go to: https://github.com/Apress

2. In the Find a repository… box, search the book title: Wireshark Fundamentals: A Network Engineer’s Handbook to Analyzing Network Traffic, sometime you may not get the results, please search the main title.