The free and open source packet analysis tool Wireshark provides many capabilities for analyzing network traffic. Among its capabilities is the capability to provide statistical information regarding captured network traffic. Looking at a pcap file with Wireshark for traffic captured during a data flow test, I saw what seemed to be a fair amount of Simple Network Management Protocol (SNMP) and Secure Shell (SSH) traffic with systems on an external network. I wanted to determine the actual percentage that traffic represented within the overall traffic during the test period. Fortunately, that is easy to do within Wireshark. One way to view statistics on bandwidth utilization by protocol while viewing captured data is by clicking on Statistics then selecting Protocol Hierarchy. Note: you may need to wait a little while for the statistics to be displayed if the amount of data to be processed is large.

[ More Info ]

[/network/tools/sniffing/wireshark] permanent link

1. Open Wireshark and click on Analyze.
2. Select Display Filters.
3. Click on New.
4. For filter name, type HTTP cookie or whatever name you would like and for filter string type http.cookie.
5. Click on OK. You should then see only the packets containing HTTP cookies displayed.

Note: written for Wireshark 1.8.4, but should apply to other versions as well.

References:

1. cookie and query strings
   Wireshark Q&A

[/network/tools/sniffing/wireshark] permanent link

I needed to install WinPcap in order to utilize Wireshark, so I downloaded WinPcap 4.1.2. When I ran the installation program, a Program Compatibility Assistant window opened stating "This program has compatibility issues." There were two options: (1) Get help online and (2) Run the program without getting help. I chose the latter. That resulted in a WinPcap 4.1.2 Setup window opening with the message "This version of Windows is not supported by WinPcap 4.1.2. The installation will be aborted."

To resolve the problem, the following steps can be taken.

1. Right-click on the installation file, WinPcap_4_1_2.exe and select Properties.
2. Click on the Compatibility tab.
3. Check the box next to "Run this program in compatibility mode for" and select "Windows 7".
4. Check the box for "Run this program as an administrator" under Privilege level.

   

5. Click on the OK button.
6. Run the installation program again and allow it to make changes to the system.
7. When the Program Compatibility Assistant window opens informing you that "This program has compatibility issues", select "Run the program without getting help". The WinPcap 4.1.2 Setup window should then open allowing you to proceed with the installation.

   

References:

1. [Winpcap-users] Windows 8
   By Andrew Stewart
   Date: July 6, 2012
   WinPcap
2. Installing WIRESHARK/WinPCap on Windows 8 RTM
   By Kaushal Kumar Panday
   Date: August 7, 2012
   Unleashed

[/network/tools/sniffing/wireshark] permanent link

I ran yum install ethereal, which installed wireshark and its dependency, libsmi. Wireshark was installed, because development of ethereal has stopped and the core development team is now developing wireshark.

The FAQ for wireshark offers the following explanation of the name change.

In May of 2006, Gerald Combs (the original author of Ethereal) went to work for CACE Technologies (best known for WinPcap). Unfortunately, he had to leave the Ethereal trademarks behind.

This left the project in an awkward position. The only reasonable way to ensure the continued success of the project was to change the name. This is how Wireshark was born.

Wireshark is almost (but not quite) a fork. Normally a "fork" of an open source project results in two names, web sites, development teams, support infrastructures, etc. This is the case with Wireshark except for one notable exception -- every member of the core development team is now working on Wireshark. There has been no active development on Ethereal since the name change. Several parts of the Ethereal web site (such as the mailing lists, source code repository, and build farm) have gone offline.

After the installation completed, I tried running wireshark by issuing the command wireshark.

# wireshark
bash: wireshark: command not found

I then discovered that installing the wireshark RPM only installs a command line program, tshark. The program was installed in /usr/sbin/tshark. You can obtain help on tshark using man tshark or tshark -h. There is also documentation installed in /usr/share/wireshark/help.

I had to install wireshark-gnome to get the GUI version, which I did with yum -y install wireshark-gnome. I could then start the GUI version from a shell prompt with wireshark or start it by clicking on Applications, Internet, and then Wireshark Network Analyzer.

Since I wanted to capture only HTTP traffic, I typed HTTP in the Filter field and then clicked on the Apply button. I then clicked on Capture, Interfaces, and clicked on the Start button next to the eth0 interface to start capturing all HTTP traffic.

[/network/tools/sniffing/wireshark] permanent link