#Wireshark windows portable config free

Now, the packet details pane displays the packet selected in the packet list pane in more detail. In the example below I clicked on packet number 147: Selecting a specific packet changes the packet details pane (Source: Brief) The Packet Details PaneĬlick on one of the captured packets. This changes according to the protocol.īy clicking on packets in this pane, you control what is displayed in the other two panes which I will now describe. Info – Additional information about the packet content. Length – The length of each packet, in bytes. This will be the top protocol – that is, the protocol of the highest layer.

Protocol – The protocol name in a short version. Don’t worry if you don’t understand the format of the addresses just yet, we will cover different addresses in future tutorials.ĭestination – The address where this packet is going. Source – The address where this packet is coming from. Therefore, the time for packet number 1 is always 0. It shows how much time has passed from the very first packet we have sniffed until we sniffed the packet in question.

This is just a sequential number – the first frame that you have sniffed gets the number 1, the second frame gets the number 2, and so on. This number won’t change, even if we use filters. NUMBER (No.) – The number of the packet in the capture file. In this post I will use the terms interchangeably, though to be accurate, every packet is a frame, but not every frame is a packet, as there are frames that don't hold network layer data.)Īs you can see in the image above, we have a few columns here: (Note: the term Frame belongs to a sequence of bytes in the Data Link layer, while a Packet is a sequence of bytes from the Network layer. It displays a short summary of each packet captured. The packet list pane is marked in orange. We will get back to it shortly, as this is one of the most important features of Wireshark. Next, marked in green, is the display filter. The main toolbar is marked in blue, providing quick access to some items from the menu. The section marked in red includes Wireshark’s menu, with all kinds of interesting options. Again, this can be achieved in other ways – such as going to Capture->Stop or clicking the Stop icon.Ĭonsider the different sections: Wireshark's sections (Source: Brief) Let Wireshark sniff the network for a bit, and then stop the sniff using Ctrl+E / Cmd+E. Select the relevant network interface, and then hit Enter, or click the button Start. Here we can see that Wi-Fi 3 has got traffic going through it, as the line is high. Which one is relevant? If you’re not sure at this point, you can look at the Traffic column, and see which interfaces currently have traffic. Here we can see a list of interfaces, and I happen to have quite a few. So, again, I’ve used Ctrl+K (or Cmd+K) and got this screen: The Capture Options window in Wireshark (Source: Brief) I encourage you to use keyboard shortcuts and get comfortable with them right from the start, as they'll allow you to save time and work more efficiently. Alternatively, you can click the Capture Options icon. Notice that you can reach this window in other ways. For that, you can hit Ctrl+K (PC) or Cmd+K (Mac) to get the Capture Options window. Launch Wireshark, and start by sniffing some data.

Start by downloading Wireshark from its official website:įollow the instructions on the installer and you should be good to go. In order to understand what exactly is being sent, you may use Wireshark to see the data transmitted over the wire. For example, imagine that you were implementing a chat program between two clients, and something was not working. It might be helpful for debugging problems in your network, for instance – if you can’t connect from one computer to another, and want to understand what’s going on.

#Wireshark windows portable config free

Wireshark is an open-source and free tool, and is widely used to analyze network traffic.

Wireshark is also a packer analyzer that displays lots of meaningful data about the frames that it sees. A sniffer could just display a stream of bits - ones and zeroes, that the network card sees. A sniffer shows us the data that passes through our network card.īut Wireshark does more than that. We use it to examine what’s going on inside a network cable, or in the air if we are dealing with a wireless network. You can think of a sniffer as a measuring device. Wireshark is a sniffer, as well as a packet analyzer. Be sure to check my previous post about the five layers model if you need a refresher. This post relies on basic knowledge of computer networks. In this post, you will learn about the single most important and useful tool in Computer Networks – Wireshark.