Wireshark User’s Guide

List of Figures

1.1. Wireshark captures packets and lets you examine their contents.

3.1. The Main window

3.2. The Menu

3.3. The “File” Menu

3.4. The “Edit” Menu

3.5. The “View” Menu

3.6. The “Go” Menu

3.7. The “Capture” Menu

3.8. The “Analyze” Menu

3.9. The “Statistics” Menu

3.10. The “Telephony” Menu

3.11. The “Wireless” Menu

3.12. The “Tools” Menu

3.13. The “Help” Menu

3.14. The “Main” toolbar

3.15. The “Filter” toolbar

3.16. The “Packet List” pane

3.17. The “Packet Details” pane

3.18. The “Packet Bytes” pane

3.19. The “Packet Bytes” pane with tabs

3.20. The “Packet Diagram” pane

3.21. The initial Statusbar

3.22. The Statusbar with a loaded capture file

3.23. The Statusbar with a configuration profile menu

3.24. The Statusbar with a selected protocol field

3.25. The Statusbar with a display filter message

4.1. Capture interfaces on Microsoft Windows

4.2. Capture interfaces on macOS

4.3. The “Capture Options” input tab

4.4. The “Capture Options” output tab

4.5. The “Capture Options” options tab

4.6. The “Manage Interfaces” dialog box

4.7. The “Compiled Filter Output” dialog box

4.8. Capture output options

4.9. The “Capture Information” dialog box

5.1. “Open” on Microsoft Windows

5.2. “Open” - Linux and UNIX

5.3. “Save” on Microsoft Windows

5.4. “Save” on Linux and UNIX

5.5. “Merge” on Microsoft Windows

5.6. “Merge” on Linux and UNIX

5.7. The “Import from Hex Dump” dialog in Hex Dump mode

5.8. The "Regular Expression" tab inside the "Import from Hex Dump” dialog.

5.9. The “List Files” dialog box

5.10. The “Export Specified Packets” dialog box

5.11. The “Export Packet Dissections” dialog box

5.12. The “Export Selected Packet Bytes” dialog box

5.13. Export PDUs to File window

5.14. Export TLS Session Keys window

5.15. The “Export Objects” dialog box

5.16. The “Print” dialog box

5.17. The “Packet Range” frame

5.18. The “Packet Format” frame

6.1. Wireshark with a TCP packet selected for viewing

6.2. Viewing a packet in a separate window

6.3. Pop-up menu of the “Packet List” column header

6.4. Pop-up menu of the “Packet List” pane

6.5. Pop-up menu of the “Packet Details” pane

6.6. Pop-up menu of the “Packet Bytes” pane

6.7. Pop-up menu of the “Packet Diagram” pane

6.8. Filtering on the TCP protocol

6.9. The “Display Filter Expression” dialog box

6.10. The “Capture Filters” and “Display Filters” dialog boxes

6.11. Display Filter Macros window

6.12. The “Find Packet” toolbar

6.13. The “Go To Packet” toolbar

6.14. Wireshark showing a time referenced packet

6.15. The “Time Shift” dialog

6.16. A Time Shifted Packet

7.1. The “Follow TCP Stream” dialog box

7.2. The “Follow HTTP/2 Stream” dialog box

7.3. The “Follow SIP Call” dialog box

7.4. The “Expert Information” dialog box

7.5. The “Colorized” protocol details tree

7.6. The “Expert” packet list column

7.7. “TCP Analysis” packet detail items

7.8. The “Packet Bytes” pane with a reassembled tab

8.1. The “Capture File Properties” dialog

8.2. Resolved Addresses window

8.3. The “Protocol Hierarchy” Window

8.4. The “Conversations” window

8.5. The “Endpoints” window

8.6. The “Packet Lengths” window

8.7. The “I/O Graphs” window

8.8. The “SMB2 Service Response Time Statistics” window

8.9. NetPerfMeter Statistics window

8.10. DNS statistics window

8.11. Flow Graph window

8.12. Flow Graph window showing VoIP call sequences

8.13. The “HTTP Request Sequences” window

8.14. UDP Multicast Streams window

8.15. ASAP Statistics window

8.16. ENRP Statistics window

8.17. Component Status Protocol Statistics window

8.18. CalcApp Protocol Statistics window

8.19. Fractal Generator Protocol Statistics window

8.20. Ping Pong Protocol Statistics window

8.21. Scripting Service Protocol Statistics window

9.1. List of supported codecs

9.2. Play Streams button with opened action menu

9.3. Tools for modifying playlist in RTP Player window

9.4. VoIP Calls window

9.5. The “3GPP MAC Traffic Statistics” window

9.6. The RLC Graph window

9.7. The “LTE RLC Traffic Statistics” window

9.8. The “RTP Streams” window

9.9. The “RTP Stream Analysis” window

9.10. Error indicated in “RTP Stream Analysis” window

9.11. Graph in “RTP Stream Analysis” window

9.12. RTP Player window

9.13. Waveform with error marks

9.14. RTP stream state indication

9.15. SCTP Analyze Association window

9.16. SCTP Associations window

10.1. Bluetooth Devices window

10.2. Bluetooth HCI Summary window

10.3. The “WLAN Traffic Statistics” window

11.1. The “Coloring Rules” dialog box

11.2. A color chooser

11.3. Using color filters with Wireshark

11.4. The “Enabled Protocols” dialog box

11.5. The “Decode As” dialog box

11.6. The preferences dialog box

11.7. Column preferences

11.8. Font and colors preferences

11.9. Layout preferences

11.10. Capture preferences

11.11. Expert item preferences

11.12. Filter buttons

11.13. Name resolution preferences

11.14. Protocol preferences

11.15. RSA keys

11.16. Statistics preferences

11.17. Advanced preferences

11.18. The configuration profiles dialog box

11.19. "IEEE 802.11 wireless LAN" preferences

11.20. 802.11 Decryption Key Types

11.21. 802.11 Decryption Key Examples

12.1. Packet Details - MATE TCP Session (tcp.mate)

12.2. MATE Analysis (PDU→GOP→GOG) flowchart

12.3. Wireshark window - fields for PDU extraction

12.4. Frame fields mapped to PDU attributes

12.5. Frame containing multiple PDUs

12.6. Frame with encapsulated (tunneled) fields

12.7. Extract from Payload fields

12.8. Grouping PDUs (GOP) flowchart

12.9. Grouping GOPs (GOG) flowchart

12.10. Applying Transform flowchart