Wireshark Training

4.

Capturing Live Network Traffic

4.1.

Understanding Network Interfaces

4.1.1.

Interface Types

4.1.1.1.

Wired Interfaces

4.1.1.2.

Wireless Interfaces

4.1.1.3.

Loopback Interfaces

4.1.1.4.

Virtual Interfaces

4.1.2.

Interface Capabilities

4.1.2.1.

Promiscuous Mode Support

4.1.2.2.

Monitor Mode Support

4.1.2.3.

Hardware Timestamping

4.1.3.

Interface Selection Criteria

4.1.3.1.

Traffic Visibility

4.1.3.2.

Performance Considerations

4.1.3.3.

Security Implications

4.2.

Capture Operations

4.2.1.

Starting Captures

4.2.1.1.

Single Interface Capture

4.2.1.2.

Multiple Interface Capture

4.2.1.3.

Capture Start Options

4.2.2.

Managing Active Captures

4.2.2.1.

Pausing Captures

4.2.2.2.

Resuming Captures

4.2.2.3.

Monitoring Capture Statistics

4.2.3.

Stopping Captures

4.2.3.1.

4.2.3.2.

Automatic Stop Conditions

4.2.3.3.

Saving Captured Data

4.3.

Capture Configuration

4.3.1.

Basic Capture Options

4.3.1.1.

Interface Selection

4.3.1.2.

Promiscuous Mode

4.3.1.2.1.

Enabling Promiscuous Mode

4.3.1.2.2.

Security Implications

4.3.1.2.3.

Limitations and Considerations

4.3.1.3.

Buffer Size Configuration

4.3.1.3.1.

Memory Usage Considerations

4.3.1.3.2.

Performance Impact

4.3.2.

Advanced Capture Options

4.3.2.1.

Monitor Mode for Wireless

4.3.2.1.1.

Requirements and Setup

4.3.2.1.2.

Channel Selection

4.3.2.1.3.

Limitations and Challenges

4.3.2.2.

4.3.2.2.1.

Packet Count Limits

4.3.2.2.2.

File Size Limits

4.3.2.2.3.

Time-Based Limits

4.3.2.3.

Multiple File Options

4.3.2.3.1.

Ring Buffer Configuration

4.3.2.3.2.

File Naming Patterns

4.4.

Capture Filters

4.4.1.

Berkeley Packet Filter Syntax

4.4.2.

Basic Filter Types

4.4.2.1.

4.4.2.1.1.

Source Host Filtering

4.4.2.1.2.

Destination Host Filtering

4.4.2.1.3.

Bidirectional Host Filtering

4.4.2.2.

4.4.2.2.1.

Single Port Filtering

4.4.2.2.2.

Port Range Filtering

4.4.2.2.3.

Multiple Port Filtering

4.4.2.3.

Protocol Filters

4.4.2.3.1.

Layer 2 Protocol Filters

4.4.2.3.2.

Layer 3 Protocol Filters

4.4.2.3.3.

Layer 4 Protocol Filters

4.4.3.

Advanced Filter Techniques

4.4.3.1.

Combining Filters

4.4.3.1.1.

4.4.3.1.2.

4.4.3.1.3.

4.4.3.2.

Complex Filter Expressions

4.4.3.3.

Filter Optimization

4.4.4.

Filter Testing and Validation

4.4.4.1.

Syntax Checking

4.4.4.2.

Filter Performance Testing

4.5.

Capture File Management

4.5.1.

4.5.1.1.

4.5.1.2.

4.5.1.3.

Format Conversion

4.5.2.

Saving Captures

4.5.2.1.

Full Capture Saves

4.5.2.2.

Partial Capture Saves

4.5.2.3.

Filtered Capture Saves

4.5.3.

File Organization

4.5.3.1.

Naming Conventions

4.5.3.2.

Directory Structure

4.5.3.3.

4.5.4.

Advanced File Operations

4.5.4.1.

Merging Capture Files

4.5.4.1.1.

Chronological Merging

4.5.4.1.2.

Handling Time Overlaps

4.5.4.2.

Splitting Capture Files

4.5.4.2.1.

Size-Based Splitting

4.5.4.2.2.

Time-Based Splitting

4.5.4.3.

File Compression

Previous

3. The Wireshark Graphical User Interface

Go to top

Next

5. Analyzing Traffic with Display Filters