Navigating with Wireshark
I get a lot of requests from people asking how to use Wireshark, what to look for, and what filters to use. Most people said that they didn’t have time for a five-day course and wanted tips and tricks on how to get going.
Even though I created a 20 minute, $20 course in January (https://www.udemy.com/wireshark-2-fundementals/learn/v4/overview) which was well received, I got requests for the same topics asking for more specifics.
It is important to separate ping and ICMP. Even though ping uses ICMP, ICMP can be used as an error reporting protocol sent by servers, routers, firewalls, etc. I've seen many analysts blindly filter out or ignore ICMP packets, missing valuable clues in their troubleshooting. ICMP can also ‘fix' your applications quietly in the background which can easily break if someone decides to block it without doing his or her homework.
In this video take you through how I captured packets and how to start analyzing ICMP, DNS, and ping packets. I figured I would pick two of the most common protocols that you would encounter in the field. ICMP, DNS, and ping is also something you can play with at home or on most networks.
I cover DNS transaction IDs and how to find/jump to the response packet to determine response time.
I plan to do more articles explaining troubleshooting scenarios and my methodology.
Recommended For You
IBN is set to take network management to the next level. Is your organization ready to join the ride?
We have updated the Network Computing site to make it easier to find the information you need. Please take a look at our new features.
Low-Power WANs offer an alternative to 5G for connecting a fast-growing array of basic devices and sensors that transmit small amounts of data.
An effective network visibility strategy requires understanding the technical, financial, political, and legal aspects impacting your network operations.
Emerging organizational structures for IT include placement of IT pros in user areas and departments forming their own "micro IT's."
Comparing a good and bad trace helps identify performance issues. Dynamic baselining can be used when you do not have a good trace to reference.