Content that refers to the Wireshark packet analysis tool.
Views: 5,417Many technicians and network engineering staff, as well as IT staff, often need to “tap” into the Ethernet to capture and troubleshoot network traffic. A full-duplex tap (also called a network tap) is a hardware device placed inline on an Ethernet link that allows network engineers to capture all traffic traveling in both directions
Ethernet Taps to Capture Network Traffic Read More »
Views: 8,102I am a ChatGPT subscriber to the basic (not PRO) service. I saw the following post on LinkedIn and was fascinated: Think about the implications. You don’t need to know how to use Wireshark other than to do a capture. You certainly don’t need to know how to troubleshoot packet captures as ChatGPT can
Can ChatGPT 5 analyze PCAP’s? Read More »
Views: 3,315Great question. In one sentence it is a purple tool, meaning both! Wireshark itself is a passive tool, it is non-intrusive — it doesn’t create attacks — but it’s a force multiplier for both Red and Blue Teams depending on who controls the capture point and how the data is used. Let me dig
Is Wireshark a Red Team or Blue Team Tool? Read More »
Views: 4,298RFMON stands for Radio Frequency MONitor mode. It is a special mode for wireless network interfaces that allows a device to capture all radio traffic it can receive on a wireless channel, regardless of the intended recipient. All Wi-Fi radios can go into different modes, but that does not mean you can make that
Views: 4,008As a frequent reader here will know, my Wi-Fi Analyzer of choice is called WinFi. It has been around many years as is fabulous. In version 2, and the new version 3, you can capture Wi-Fi Beacon Frames and examine them. This post will explain what you can capture and how this is useful.
Capturing Wi-Fi Beacon Frames with WinFi Read More »
Views: 48,686In this tutorial I am going to make you a pro at using and leveraging the Wireshark TCP Graphing tools. As many of you who have taken my Wireshark Courses know, I am a big fan of visualizing what is going on in a given packet capture or conversation. My #2 troubleshooting step is
Zero to Hero with Wireshark TCP Graphs: A Tutorial Read More »
Views: 14,610A Wireshark TCP Analysis Flags cheat sheet is essential because TCP is the foundation of most modern network communications, and Wireshark’s built-in TCP Analysis engine automatically identifies performance problems, retransmissions, latency conditions, packet loss, flow-control issues, and connection anomalies that would otherwise require deep manual packet inspection. For many users, the TCP Analysis Flags
Wireshark TCP Analysis Flags Cheat Sheet Read More »
Views: 7,841As QUIC has emerged to begin its takeover of the Transport Layer (OK – we will never see TCP totally disappear), I have written multiple articles on QUIC. You can look them over here. In the early days Google made this really easy right within the Chrome web browser. As time has gone on
Troubleshooting QUIC Traffic – Not Easy Read More »
Views: 3,369Let’s start with some simple definitions of these protocols and how they work together. In Voice over IP (VoIP) to PSTN (telephone) network integration, MGCP and C15 can work together as part of a layered signaling architecture that bridges IP-based call control with traditional PSTN switching systems. Here’s how they fit and interact: MGCP
Troubleshooting C15 and MGCP Protocols for VoIP Read More »
Views: 12,476Capturing network traffic with VLAN tags on a Windows computer can be tricky due to how network adapters and capture software handle VLAN-tagged frames. By default, Windows often strips VLAN tags before passing packets to capture applications like Wireshark. However, there are ways to configure your setup to properly capture VLAN information. 1. Install
Capturing Packet Traffic with VLAN Tags on Windows Read More »
Views: 9,533So often in Wireshark videos and classes we spend a lot of time on TCP behavior. But what I am about to discuss is hardly ever brought up. The answer to flavor is simple right? The truth is that there are multiple “flavors” of TCP, and TCP does not have a version number in
Which Flavor of TCP are you using? Read More »
Views: 15,026As most of my readers, students, and clients know, I absolutely love Wireshark. I am deeply infatuated with Wireshark’s Profiles, more properly called configuration profiles. So much so that many years ago now, I set up the first Wireshark Profiles Repository. Hundreds of thousands of downloads have resulted, and I hope I have helped
Automatically Switch Configuration Profiles in Wireshark Read More »
Views: 4,925Are you new to Wireshark? Someone asked the following “getting started” question on the Wireshark Discord site, and it prompted me to write this FAQ to help newcomers to Wireshark understand how to navigate the initial complexity of packet capture. Hi everyone! I’m new here and just downloaded wireshark for a Computer Comm class.
A Simple Capture and Filter Exercise for Wireshark Read More »
Views: 4,278In our prior article on companion tools for Wireshark (link), we provided a list of tools that network analysts, operations, maintainers or just curious people should consider. All these were stand alone tools. What about Internet/Web Browser based sites that you may find useful? This thought raises certain issues, like this scenario: the network
Web Sites that can be Companion Tools to Wireshark Read More »
Views: 4,840Wireshark is a powerful network protocol analyzer used by network professionals for troubleshooting, analysis, development, and education. Companion tools can enhance its functionality or help in related tasks. If you are looking for hard tools we have a list of what we carry in our “go bag” here. Here are some websites and tools
Stand Alone Companion Tools to Wireshark Read More »
