Wireshark Instructions

From ITCwiki
Revision as of 21:39, 11 February 2010 by Nels4388 (talk | contribs) (→‎Color Code)
Jump to navigation Jump to search

Wireshark Instructions This is a walk through to help new students learn how to install and run wireshark for future lab assignments. We will be doing all of this through your Virtual Machine as though you were in the lab during class. If needed the same steps will apply to your home computer with the exception of using a your specific network adaptor.

Downloading & Installing Wireshark

This is a quick overview of how to download and install wireshark on to any windows operating system.

  • Step 1

First go to the following link Wireshark Download

  • Step 2

Click on the Windows Installer (32-bit)

Wireshark.2.jpg
  • Step 3

Click the Save button

Wireshark.3.jpg
  • Step 4

Click the Run button after the file has been downloaded

Wireshark.4.jpg
  • Step 5

If an older version is installed replace it by clicking the Yes button

Wireshark.6.jpg
  • Step 6

Click the Next button untill you arrive at the Finish button

Wireshark.8.jpg
  • Step 7

Click the Finish button

Wireshark.10.jpg
  • Step 8

Click the I Agree button to start the install

Wireshark.12.jpg
  • Step 9

Click the Next button untill you arrive at the Install WinPcap

Wireshark.13.jpg
  • Step 10

Click the Install button

Wireshark.16.jpg
  • Step 11

Click the Next button untill you get to WinPcap License Agreement

Wireshark.17.jpg
  • Step 12

Click the I Agree button

Wireshark.19.jpg
  • Step 13

Click the Install button

Wireshark.20.jpg
  • Step 14

When installation is complete click the Next button

Wireshark.27.jpg
  • Step 15

Click the Finish button

Wireshark.28.jpg

Basic Operation of Wireshark

This will cover opening and running Wireshark in a virtual machine to capture packets.

  • Step 1

First open Wireshark by double clicking on the icon.

Wireshark.29.jpg
  • Step 2

Click on the Capture Options on the left side of the window, will give you a screen that looks like this.

Wireshark.30.jpg
  • Step 3

Click on the drop arrow button on the top right of the window and select the VMware network adapter.

Wireshark.31.jpg
  • Step 4

Click on the Start button. You are now capturing packets!!!

Wireshark.32.jpg
  • Step 5

To stop a capture click on the red x button on the top left side on the capture window.

Wireshark.33.jpg

Examining Capture Data

In this section we will be showing you how to capture protocols and where to locate the important values given by the use of wireshark.

Color Code

  • YELLOW: Indicates the MAC Address of both the destination and source.
  • GREEN: Indicates the NIC Manufacturer of both the destination and source.
  • RED: Indicates the NIC Serial Number of both the destination and source.
  • BLUE: Indicates the Frame Type of the packet.
  • PINK: Indicates the IPv4 of both the destination and source.
  • NOTE: The the Preamble and the FCS are not shown on wireshark.

FTP

Wireshark.ftp..jpg

HTTP

Wireshark.http.jpg

ARP

Wireshark.arp.jpg

DNS

Wireshark.dns.jpg

ICMP

External links