How to capture basic information using wireshark.

I’m often asking people to provide wireshark logs or check issues in wireshark, a lot of people also have no idea how to do this. I hope this helps.

Firstly download and install Wireshark, it will also install WinPCap, this is fine.

Run Wireshark.

Image

Click the second icon from the left to open the capture dialogue box.

wireshark1

Depending on the problem you are trying to diagnose it is sensible to tick the option to capture on all interfaces and un-tick promiscuous mode.

wireshark2

You can, and should, also fill in a capture filter.
host ip.or.server.name.here – to capture information sent to just a single host, useful if you want to diagnose problems with transfer speeds to a website or server.
port 80 – or another port number if you want to capture all the web requests, smtp requests or similar traffic to and from your computer.
host server.ip.or.name and not port 3389 – if you want to get all traffic except your remote control traffic.
port 80 or port 443 – if you want to capture information on two or more sets of ports.

Click on start. Wait for your problem to happen or go to the website or access the service with the issue.

wireshark3

 

Once done, click the stop button. You could now also save the capture to a file so you can send it to a colleague or support department.

If you want to look at the information in a request such as a web request or SMTP transaction .. right click on the first request in the list and select Follow TCP Stream.

wireshark4

 

wireshark5

 

Tips on understanding what is going on include watching an app hang and looking at wireshark for related DNS requests or SYN pacekts that are not being responded to. Remember that you can always save the packet capture and send it to a friend, colleague or support department.

Advertisements
This entry was posted in Uncategorized. Bookmark the permalink.

Comment on this topic

Fill in your details below or click an icon to log in:

WordPress.com Logo

You are commenting using your WordPress.com account. Log Out / Change )

Twitter picture

You are commenting using your Twitter account. Log Out / Change )

Facebook photo

You are commenting using your Facebook account. Log Out / Change )

Google+ photo

You are commenting using your Google+ account. Log Out / Change )

Connecting to %s