How to use wireshark simply

The ideal access environment for wireshark is a hub, but there are basically no pure hubs on the market now. Most of the so-called hubs on the market are small switches and the like. As we all know, the traffic of the switch router is sent to the destination port, that is, the destination port will only receive data packets sent to itself, while the hub is broadcast and sends data packets to all ports in the entire broadcast domain, so on the hub Packet capture is ideal.

Wireshark can use filtering when capturing packets, and only capture the data packets you want to capture. You can also set no filtering, and then all data packets on the network will be captured. In the data packets captured by wireshark, data packets of different protocols are highlighted in different colors, and the color displayed for each protocol can be manually changed by selecting coloring rules in the view of the main menu.

After opening wireshark, select the interface in capture in the main menu (or select the first icon among the icons under the main menu), and select a more active network connection (network card) in the pop-up dialog box ), and finally select start. When you want to stop capturing packets, you only need to select the stop option in capture, or the stop icon under the main menu. Then the captured data packets can be analyzed.

If you only need to view one or two types of data packets, you can filter the captured data packets, which makes it very convenient to view data packets of a specific protocol. For example: enter tcp in the input field of filter:, then the captured data packets will only display the tcp protocol.

Finally, we can also save the captured packet results, so that we can re-check the packet capture results next time.

(The wireshark I use is 1.10.5)

The above is the detailed content of How to use wireshark simply. For more information, please follow other related articles on the PHP Chinese website!