Network Analysis using Wireshark Cookbook

This book will be a massive ally in troubleshooting your network using Wireshark, the world’s most popular analyzer. Over 100 practical recipes provide a focus on real-life situations, helping you resolve your own individual issues.

Network Analysis using Wireshark Cookbook

Cookbook
Yoram Orzach

This book will be a massive ally in troubleshooting your network using Wireshark, the world’s most popular analyzer. Over 100 practical recipes provide a focus on real-life situations, helping you resolve your own individual issues.
$29.99
$49.99
RRP $29.99
RRP $49.99
eBook
Print + eBook
$12.99 p/month

Want this title & more? Subscribe to PacktLib

Enjoy full and instant access to over 2000 books and videos – you’ll find everything you need to stay ahead of the curve and make sure you can always get the job done.
Code Files
+ Collection
Free sample

Book Details

ISBN 139781849517645
Paperback452 pages

About This Book

  • Place Wireshark in the network and configure it for effective network analysis
  • Use Wireshark's powerful statistical tools and expert system for pinpointing network problems
  • Use Wireshark for troubleshooting network performance, applications, and security problems in the network

Who This Book Is For

This book is aimed at research and development professionals, engineering and technical support, and IT and communications managers who are using Wireshark for network analysis and troubleshooting. This book requires a basic understanding of networking concepts, but does not require specific and detailed technical knowledge of protocols or vendor implementations.

Table of Contents

Chapter 1: Introducing Wireshark
Introduction
Locating Wireshark
Starting the capture of data
Configuring the start window
Using time values and summaries
Configuring coloring rules and navigation techniques
Saving, printing, and exporting data
Configuring the user interface in the Preferences menu
Configuring protocol preferences
Chapter 2: Using Capture Filters
Introduction
Configuring capture filters
Configuring Ethernet filters
Configuring host and network filters
Configuring TCP/UDP and port filters
Configuring compound filters
Configuring byte offset and payload matching filters
Chapter 3: Using Display Filters
Introduction
Configuring display filters
Configuring Ethernet, ARP, host, and network filters
Configuring TCP/UDP filters
Configuring specific protocol filters
Configuring substring operator filters
Configuring macros
Chapter 4: Using Basic Statistics Tools
Introduction
Using the Summary tool from the Statistics menu
Using the Protocol Hierarchy tool from the Statistics menu
Using the Conversations tool from the Statistics menu
Using the Endpoints tool from the Statistics menu
Using the HTTP tool from the Statistics menu
Configuring Flow Graph for viewing TCP flows
Creating IP-based statistics
Chapter 5: Using Advanced Statistics Tools
Introduction
Configuring IO Graphs with filters for measuring network performance issues
Throughput measurements with IO Graph
Advanced IO Graph configurations with advanced Y-Axis parameters
Getting information through TCP stream graphs – the Time-Sequence (Stevens) window
Getting information through TCP stream graphs – the Time-Sequence (tcp-trace) window
Getting information through TCP stream graphs – the Throughput Graph window
Getting information through TCP stream graphs – the Round Trip Time window
Getting information through TCP stream graphs – the Window Scaling Graph window
Chapter 6: Using the Expert Infos Window
Introduction
The Expert Infos window and how to use it for network troubleshooting
Error events and understanding them
Warning events and understanding them
Notes events and understanding them
Chapter 7: Ethernet, LAN Switching, and Wireless LAN
Introduction
Discovering broadcast and error storms
Analyzing Spanning Tree Protocols
Analyzing VLANs and VLAN tagging issues
Analyzing wireless (Wi-Fi) problems
Chapter 8: ARP and IP Analysis
Introduction
Analyzing connectivity problems with ARP
Using IP traffic analysis tools
Using GeoIP to look up physical locations of the IP address
Finding fragmentation problems
Analyzing routing problems
Finding duplicate IPs
Analyzing DHCP problems
Chapter 9: UDP/TCP Analysis
Introduction
Configuring TCP and UDP preferences for troubleshooting
TCP connection problems
TCP retransmission – where do they come from and why
Duplicate ACKs and fast retransmissions
TCP out-of-order packet events
TCP Zero Window, Window Full, Window Change, and other Window indicators
TCP resets and why they happen
Chapter 10: HTTP and DNS
Introduction
Filtering DNS traffic
Analyzing regular DNS operations
Analysing DNS problems
Filtering HTTP traffic
Configuring HTTP preferences
Analyzing HTTP problems
Exporting HTTP objects
HTTP flow analysis and the Follow TCP Stream window
Analyzing HTTPS traffic – SSL/TLS basics
Chapter 11: Analyzing Enterprise Applications' Behavior
Introduction
Finding out what is running over your network
Analyzing FTP problems
Analyzing e-mail traffic and troubleshooting e-mail problems – POP, IMAP, and SMTP
Analyzing MS-TS and Citrix communications problems
Analyzing problems in the NetBIOS protocols
Analyzing database traffic and common problems
Chapter 12: SIP, Multimedia, and IP Telephony
Introduction
Using Wireshark's features for telephony and multimedia analysis
Analyzing SIP connectivity
Analyzing RTP/RTCP connectivity
Troubleshooting scenarios for video and surveillance applications
Troubleshooting scenarios for IPTV applications
Troubleshooting scenarios for video conferencing applications
Troubleshooting RTSP
Chapter 13: Troubleshooting Bandwidth and Delay Problems
Introduction
Measuring total bandwidth on a communication link
Measuring bandwidth and throughput per user and per application over a network connection
Monitoring jitter and delay using Wireshark
Discovering delay/jitter-related application problems
Chapter 14: Understanding Network Security
Introduction
Discovering unusual traffic patterns
Discovering MAC- and ARP-based attacks
Discovering ICMP and TCP SYN/Port scans
Discovering DoS and DDoS attacks
Locating smart TCP attacks
Discovering brute-force and application attacks

What You Will Learn

  • Configure Wireshark for effective network troubleshooting
  • Set up various display and capture filters
  • Use basic statistical tools that provide you with "who is talking" tables, conversations, and HTTP statistics
  • Master both the standard and advanced features of IO graphs
  • Use the expert system to pinpoint various types of events that might influence the behavior of your network
  • Learn about Wi-Fi testing and how to resolve problems related to wireless LANs
  • Explore performance issues in TCP/IP
  • Explore failures due to delays and jitters in the network
  • Find and resolve problems due to bandwidth, throughput, and packet loss
  • Identify and locate faults in communication applications including HTTP, FTP, mail, and various other applications – Microsoft OS problems, databases, voice, and video over IP
  • Identify and locate faults in detecting security failures and security breaches in the network

In Detail

Is your network slow? Are your users complaining? Disconnections? IP Telephony problems? Video freezes? Network analysis is the process of isolating these problems and fixing them, and Wireshark has long been the most popular network analyzer for achieving this goal. Based on hundreds of solved cases, Network Analysis using Wireshark Cookbook provides you with practical recipes for effective Wireshark network analysis to analyze and troubleshoot your network.

"Network analysis using Wireshark Cookbook" highlights the operations of Wireshark as a network analyzer tool. This book provides you with a set of practical recipes to help you solve any problems in your network using a step-by-step approach.

"Network analysis using Wireshark Cookbook" starts by discussing the capabilities of Wireshark, such as the statistical tools and the expert system, capture and display filters, and how to use them. The book then guides you through the details of the main networking protocols, that is, Ethernet, LAN switching, and TCP/IP, and then discusses the details of application protocols and their behavior over the network. Among the application protocols that are discussed in the book are standard Internet protocols like HTTP, mail protocols, FTP, and DNS, along with the behavior of databases, terminal server clients, Citrix, and other applications that are common in the IT environment.

In a bottom-up troubleshooting approach, the book goes up through the layers of the OSI reference model explaining how to resolve networking problems. The book starts from Ethernet and LAN switching, through IP, and then on to TCP/UDP with a focus on TCP performance problems. It also focuses on WLAN security. Then, we go through application behavior issues including HTTP, mail, DNS, and other common protocols. The book finishes with a look at network forensics and how to search and find security problems that might harm the network.

Authors

Table of Contents

Chapter 1: Introducing Wireshark
Introduction
Locating Wireshark
Starting the capture of data
Configuring the start window
Using time values and summaries
Configuring coloring rules and navigation techniques
Saving, printing, and exporting data
Configuring the user interface in the Preferences menu
Configuring protocol preferences
Chapter 2: Using Capture Filters
Introduction
Configuring capture filters
Configuring Ethernet filters
Configuring host and network filters
Configuring TCP/UDP and port filters
Configuring compound filters
Configuring byte offset and payload matching filters
Chapter 3: Using Display Filters
Introduction
Configuring display filters
Configuring Ethernet, ARP, host, and network filters
Configuring TCP/UDP filters
Configuring specific protocol filters
Configuring substring operator filters
Configuring macros
Chapter 4: Using Basic Statistics Tools
Introduction
Using the Summary tool from the Statistics menu
Using the Protocol Hierarchy tool from the Statistics menu
Using the Conversations tool from the Statistics menu
Using the Endpoints tool from the Statistics menu
Using the HTTP tool from the Statistics menu
Configuring Flow Graph for viewing TCP flows
Creating IP-based statistics
Chapter 5: Using Advanced Statistics Tools
Introduction
Configuring IO Graphs with filters for measuring network performance issues
Throughput measurements with IO Graph
Advanced IO Graph configurations with advanced Y-Axis parameters
Getting information through TCP stream graphs – the Time-Sequence (Stevens) window
Getting information through TCP stream graphs – the Time-Sequence (tcp-trace) window
Getting information through TCP stream graphs – the Throughput Graph window
Getting information through TCP stream graphs – the Round Trip Time window
Getting information through TCP stream graphs – the Window Scaling Graph window
Chapter 6: Using the Expert Infos Window
Introduction
The Expert Infos window and how to use it for network troubleshooting
Error events and understanding them
Warning events and understanding them
Notes events and understanding them
Chapter 7: Ethernet, LAN Switching, and Wireless LAN
Introduction
Discovering broadcast and error storms
Analyzing Spanning Tree Protocols
Analyzing VLANs and VLAN tagging issues
Analyzing wireless (Wi-Fi) problems
Chapter 8: ARP and IP Analysis
Introduction
Analyzing connectivity problems with ARP
Using IP traffic analysis tools
Using GeoIP to look up physical locations of the IP address
Finding fragmentation problems
Analyzing routing problems
Finding duplicate IPs
Analyzing DHCP problems
Chapter 9: UDP/TCP Analysis
Introduction
Configuring TCP and UDP preferences for troubleshooting
TCP connection problems
TCP retransmission – where do they come from and why
Duplicate ACKs and fast retransmissions
TCP out-of-order packet events
TCP Zero Window, Window Full, Window Change, and other Window indicators
TCP resets and why they happen
Chapter 10: HTTP and DNS
Introduction
Filtering DNS traffic
Analyzing regular DNS operations
Analysing DNS problems
Filtering HTTP traffic
Configuring HTTP preferences
Analyzing HTTP problems
Exporting HTTP objects
HTTP flow analysis and the Follow TCP Stream window
Analyzing HTTPS traffic – SSL/TLS basics
Chapter 11: Analyzing Enterprise Applications' Behavior
Introduction
Finding out what is running over your network
Analyzing FTP problems
Analyzing e-mail traffic and troubleshooting e-mail problems – POP, IMAP, and SMTP
Analyzing MS-TS and Citrix communications problems
Analyzing problems in the NetBIOS protocols
Analyzing database traffic and common problems
Chapter 12: SIP, Multimedia, and IP Telephony
Introduction
Using Wireshark's features for telephony and multimedia analysis
Analyzing SIP connectivity
Analyzing RTP/RTCP connectivity
Troubleshooting scenarios for video and surveillance applications
Troubleshooting scenarios for IPTV applications
Troubleshooting scenarios for video conferencing applications
Troubleshooting RTSP
Chapter 13: Troubleshooting Bandwidth and Delay Problems
Introduction
Measuring total bandwidth on a communication link
Measuring bandwidth and throughput per user and per application over a network connection
Monitoring jitter and delay using Wireshark
Discovering delay/jitter-related application problems
Chapter 14: Understanding Network Security
Introduction
Discovering unusual traffic patterns
Discovering MAC- and ARP-based attacks
Discovering ICMP and TCP SYN/Port scans
Discovering DoS and DDoS attacks
Locating smart TCP attacks
Discovering brute-force and application attacks

Book Details

ISBN 139781849517645
Paperback452 pages
Read More