Networking/Computing Tips/Tricks

Most network engineers and technicians are quickly discovering that with "everything over IP" we are required to understand exactly what this means.  For most data communications this means transport over TCP.  Furthermore, it requires the ability to troubleshoot TCP.  To troubleshoot TCP you have to look at the packets.  To look at the packets, the best tool is Wireshark!

Troubleshooting TCP is not easy, and this article is not a guide to troubleshooting TCP.   However, this article is about making the use of Wireshark easier, and providing you a great foundation upon which to learn TCP more deeply.

For those of you who love Wireshark and are supporting TCP, we would like to offer a great default profile for TCP.  Consider for a moment what would be important in your network administration in TCP:

• Knowing the key components of information to tack TCP behavior
• Being able to identify TCP packets with certain pertinent information
• Being able to detect interesting TCP process issues

All this would be a great starting point.

Profiles are one of the most important Wireshark capabilities.  Setting up and using different profiles for different environments, protocols, and tasks is a crucial skill that we teach in our Wireshark courses.  Let's say you went to the Wireshark site and tried to find some!  Suprisingly, here is what you would get:

Whaaaaat?????

No worries.  We have an answer below:

Let's look at what you get with this default profile.

Packet List Window Columns

An important starting point for this profile is the addition of very important columns that brings to the surface the key TCP behavior and process information:

Display Filters

With Wireshark 3.4 and onwards, you can nest display filter buttons, and this profile takes full advantage of that:

Here are the display filters in this profile:

Colorization:

Here are the color rules we added:

Again, all of this is a great starting point.  What do you think we are missing?  What would you add?

Let us know here!

To download this ZIP file click here.  Make sure you unzip it into your personal folders, profiles subdirectory:

We hope this helps you with TCP and Wireshark! Also a special thanks to Hansang Bae and those folks at Wireshark with their great documentation and great program.

Got a better one?  Or have a profile you would like to send to us?  Send it to andyw@cellstream.com - thanks in advance - we share profiles here.

Another way to find profiles, click on "Profile" in the tag cloud.