Screen Shot 2014-09-01 at 10.58.47 AM

A Wireshark TCP Troubleshooting Configuration Profile

 

Most network engineers and technicians are quickly discovering that with “everything over IP” we are required to understand exactly what this means.  For a lot of the standard, traditional data communications between clients and servers this means transport over TCP.  

Furthermore, it requires the ability to troubleshoot TCP.  To troubleshoot TCP you have to look at the packets.  To look at the packets, the best tool is Wireshark!

For those of you who love Wireshark and are needed to troubleshoot TCP, we would like to offer a great default profile for TCP.  A starting point. 

Consider for a moment what would be important in your network administration and troubleshooting of TCP:

  • Knowing the key components of information to tack TCP behavior
  • Being able to identify TCP packets with certain pertinent information
  • Being able to detect interesting TCP process issues

Profiles are one of the most important Wireshark capabilities.  Setting up and using different profiles for different environments, protocols, and tasks is a crucial skill that we teach in our Wireshark courses.  Let’s say you went to the Wireshark site and tried to find some!  Suprisingly, here is what you would get:

Screen Shot 2014-09-01 at 10.58.47 AM

Whaaaaat?????

No worries.  We have an answer below:

Let’s look at what you get with this default profile.

Packet List Window Columns

An important starting point for this profile is the addition of very important columns that brings to the surface the key TCP behavior and process information:

2022 01 09 10 52 02

Display Filters

With Wireshark 3.4 and onwards, you can nest display filter buttons, and this profile takes full advantage of that:

2022 01 09 10 58 04

Here are the display filters in this profile:

 2021 02 21 7 07 52

Colorization:

Here are the color rules we added:

2021 02 21 7 09 49 

Again, all of this is a great starting point.  What do you think we are missing?  What would you add?

Let us know here!

To download this ZIP file click here.  Make sure you unzip it into your personal folders, profiles subdirectory:

Screen Shot 2014-08-31 at 10.29.53 PM

We hope this helps you with TCP and Wireshark! Also a special thanks to Hansang Bae and those folks at Wireshark with their great documentation and great program.

Got a better one?  Or have a profile you would like to send to us?  Send it to andyw@cellstream.com – thanks in advance – we share profiles here.

Another way to find profiles, click on “Profile” in the tag cloud.

I hope you find this article and its content helpful.  Comments are welcomed below.  If you would like to see more articles like this, please support us by clicking the patron link where you will receive free bonus access to courses and more, or simply buying us a cup of coffee!, and all comments are welcome! 

Leave a Comment

Contact Us Here


Please verify.
Validation complete :)
Validation failed :(
 
Your contact request has been received. We usually respond within an hour, but please be patient. We will get back to you very soon.