In this case the value 192.168.1.1 is an identifier For instance, filtering a packet for an IP address, you will end up with a filter that is similar to host 192.168.1.1. Identifiers: These are values which you would be looking for within your packets.The BPF syntax uses a combination of two arguments, identifiers and qualifiers, which are explained below: It is important to familiarize ourselves with this syntax, as it is the most commonly used by packet analyzers. The Berkley Packet Filter (BPF) syntax is used when creating capture filters. They work by filtering out traffic that does not meet the criteria specified within the filter. We can use capture filters before the initiation of the packet capture process. We need to know how to use the filters that come with Wireshark in order to ensure we are capturing the right packets for analysis.

The traffic you are interested in capturing is entirely dependent on the devices within the network.Different devices on the network respond differently and transmit different data packets.Promiscuous mode allows your machine to collect data packets that are not intended for your machine.Does your network card support promiscuous mode?.We’ll first need to answer the following questions:

We should first understand the type of traffic we are interested in collecting before we begin packet sniffing. Wireshark allows us to capture raw data which is then presented in a human-readable format, making it possible for you to understand the flow of traffic within the network.īefore we can begin capturing packets for analysis, we need to take into account the types of devices available on the network and the traffic they emit. How to use Wireshark for packet analysis and filtering

Determine systems within the network that are heavy on bandwidth consumption.

Determine network statistics by filtering network packets based on your requirements.

Determine which machines and resources to isolate from the network due to the traffic coming from them.

Detect malicious traffic from malware or network intrusions from unauthorized or malicious individuals/parties.

Analyze problems within the network by assessing the packets as traffic runs through the network.

In order for us to understand what we are dealing with and to troubleshoot the problem, we make use of packet analyzers such as Wireshark in order to perform network analysis. There are many things that can go wrong within a network.

Wireshark usage and importance