Content that refers to the Wireshark packet analysis tool.
Post Views: 164 Network Engineers and folks learning networking – my OSPF Lab series is now available. There are three Labs that include GNS3 topologies, and PCAPS to emulate and capture these awesome labs: We have also begun our BGP series as well with new labs coming each week. If you would like to help […]
OSPF Lab Series Now Available Read More »
Post Views: 176 Those of us doing packet capture in the early days, knew what today we call Wireshark to be The Ethereal Network Analyzer – originally released in mid 1998. That was it’s original name. Ethereal was renamed to Wireshark in 2006 if I recall correctly. Here is what it looked like: This 1st
The Ethereal Network Analyzer – Before Wireshark Read More »
Post Views: 383 TLS 1.3, QUIC, HTTP/3, encrypted DNS, and Encrypted Client Hello increasingly conceal application and transport information that network operators traditionally used for troubleshooting, security inspection, filtering, performance optimization, and policy enforcement. Here is a little reference chart: This produces two defensible but conflicting positions: For most of the Internet’s history, and certainly
End-to-End Encryption: A Privacy Victory or a Networking Blind Spot? Read More »
Post Views: 362 MPTS stands for Multi-Program Transport Stream. It is a format defined within MPEG-2 Transport Stream (MPEG-TS) standards where multiple independent programs (channels) are multiplexed into a single transport stream. A simple definition would be one MPTS carries multiple programs with each program containing a complete service of video plus audio plus metadata.
What is MPTS? Plus a hands-on Lab Read More »
Post Views: 410 Do not troubleshoot Wireshark captures by chasing random red and black packets. Start with triage, classify the traffic, branch into the correct protocol workflow, and then prove the finding with packet evidence. The following is a shortened version of our structured “Triage → Classify → Branch → Prove” Wireshark troubleshooting workflow built
Wireshark Troubleshooting Workflow Read More »
Post Views: 5,540 I am often asked this question of where to access PCAP or PCAP-NG files so that folks can explore packet captures using Wireshark. I have always provided these resources in my Wireshark classes at the Online School, but thought I should also just list them here for public consumption. Before you click!
Where can I get PCAP Packet Captures for Learning and Exploration? Read More »
Post Views: 2,224 If you have upgraded Wireshark to the latest version 4.6.5 and later, you will note a big change to the “welcome” screen, or home screen of Wireshark. It now looks like this: The two “boxes” on the right are new and bold. The tips and tricks is great for new Wireshark users,
A New Wireshark Welcome Screen Read More »
Post Views: 758 Let’s say you are a CO Tech/Engineer or an enterprise network engineer that works with Voice over IP (VoIP). Let’s further say that there are issues with one or more users so you have done a bunch of packet captures, perhaps even used Wireshark’s Ring Buffer capability, and now you want to
Extracting VoIP Packets from Multiple Captures Read More »
Post Views: 1,531 Learning how to manually control Wi-Fi channels in Linux is a foundational skill for wireless troubleshooting and packet analysis. Proper channel selection is critical because Wi-Fi troubleshooting is highly dependent on capturing the correct RF environment at the correct moment in time. When combined with Wireshark, Linux monitor mode provides one of
How to Set a WLAN Frequency or Channel in Linux for Wireshark Packet Capture Read More »
Post Views: 734 Net neutrality is typically framed as a policy debate (see my background Net Neutrality post here), but its real implications are observable in packet-level behavior. For network engineers and broadband technicians, the question is not abstract: can you see evidence of blocking, throttling, or prioritization in a packet capture? To read more
Net Neutrality at the Packet Level Read More »
Post Views: 1,085 I described what Adaptive Bit Rate Streaming (ABR) is in my prior article, if you need that background. Also there is an ABR Lab Exercise if you want some hands on learning with ABR that will show you visually some of the items discussed below. Here, I wanted to dive a little
Mapping ABR to TCP Congestion Control and QUIC Read More »
Post Views: 1,145 Adaptive Bitrate Streaming (ABR) is a video delivery method that dynamically adjusts the quality of a stream in real time based on three things: network conditions, device capability, and player performance. Instead of delivering a single fixed-quality, and therefore fixed transfer rate video, ABR continuously selects the most appropriate bitrate to maintain
What Is Adaptive Bitrate Streaming (ABR)? Read More »
Post Views: 695 The following is a step by step lab exercise to examine ABR – Adaptive Bit Rate used in modern video content delivery. I won’t explain ABR here – you can read about ABR and what it is, and how it works here in a recent post. We will analyze a synthetic but
A Synthetic ABR Lab Exercise Read More »
Post Views: 2,993 Most people do not know this, but TCP CUBIC is the dominant congestion control algorithm used in modern TCP/IP networks. It is designed to efficiently utilize high-speed, long-distance links while maintaining fairness across flows with different round-trip times (RTTs). Today, it is the default congestion control algorithm in most Linux systems, and
What is TCP CUBIC and Why so popular? Read More »
Post Views: 2,210 I have been teaching Wireshark classes since the early 2000’s, and using it since it was called Ethereal. My usage has primarily focused around troubleshooting network issues that have a packet capture associated with them. My fellow troubleshooters will tell you that this is not always the case. But, if we are
Create your own Wireshark Labs with AI Read More »
