1 Getting started 2 --------------- 3 This text will try to take you though the first steps of using Wireshark. 4 5 6 Display 7 ------- 8 When you start Wireshark, you will see the program window vertically divided into the following parts: 9 10 -window title 11 -menu 12 -main toolbar 13 -packet list (empty) 14 -packet details (empty) 15 -packet bytes (empty) 16 -statusbar (with filter toolbar) 17 18 As Wireshark has no packet data when started, most of the program's window is just empty. 19 20 Many of the features available in the menu will also be on the main toolbar. 21 22 First capture file 23 ------------------ 24 The first thing you probably want to do is look at some captured network data/packets. 25 This can be achieved by two methods: 26 27 -open an already existing capture file 28 -capture something from your own network 29 30 It might be easier to start with an example capture file from "http://www.wireshark.org/sample" before capturing your own data. 31 32 You can open a capture file through the menu "File->Open..." (or the toolbar). 33 34 Please note: the common file extension for capture files is ".cap" (or ".cap.gz" for gzipped ones). 35 36 After opening a capture file, you will hopefully see some more packet data on the screen. :-) 37 38 Display fields 39 -------------- 40 In the "packet list", you will see several columns with a packet number, timestamp(s), addresses and a protocol specific summary of that packet. Here you can select a packet to be shown in the "packet details" below. 41 42 In the "packet details", the details of the currently selected packet are shown. You can expand the tree nodes to get even more details about that packet. 43 44 The "packet bytes" will simply show all the packet data in a hexdump style. It will show the same packet as in the "packet details", only with a different representation. 45 When you select something in the "packet details", it will be highlighted in the "packet bytes" and vice-versa. 46 47 All three display fields have their own context menu, available by clicking the right mouse button inside that part of the window. 48 49 How to analyze protocol specific network data itself is not in the scope of this text. 50 51 Display filters 52 --------------- 53 You can reduce the number of packets shown (to filter out the uninteresting ones) by setting a display filter. Please see "Display Filters" in this help dialog for further information how the display filters should be used. 54 55 Coloring Rules 56 -------------- 57 The packet list can be colored; this means applying different colors for different packets. For example you could choose to have all HTTP packets shown in red and all other TCP traffic shown in yellow. There are two types of color rules, temporary (only used in this session) and permanent (save between sessions). 58 59 Temporary coloring rules can be created by either pressing <ctrl> and one of the number keys (0-9). This will create a conversation color rule based on the currently selected packet. Temporary color rules can also be added by choosing "color X" from different menus. 60 61 Under "View->Coloring Rules..." you will see a list of permanentcolor rules. This list is processed for each packet from top to bottom, until one of the rules matches (in which case the color settings of that rule are used for that packet). If no rule matches, the packet will not be colored at all. 62 63 Please note: setting lots of color rules can slow down processing time a bit when showing huge capture files. 64 65 Other display things 66 -------------------- 67 You can mark packets, so that you can easily find packets of interest again later. 68 You can set a time reference, if you are interested in seeing timings relative to a specific packet (e.g. get time differences relative to the start of some data transfer). 69 But remember: These settings will not be saved - they are forgotten when the capture file is closed. 70 71 72 Capture from the network 73 ------------------------ 74 Most likely you will now want to get some "real life" packet data captured from your own network interface. 75 76 When opening the capture dialog with "Capture->Start...", you will see lots of settings to choose from. For your first test, just keep the default settings. 77 78 After clicking "OK", the capture starts and a dialog shows up, giving the actual count of captured packets and some very basic packet statistics. 79 80 When you stop the capture, you will get the same screen as if you had opened a capture file from disk, using the "File->Open" command. 81 82 See the "Capturing" section of this help for further information about capturing. 83 84 85 Conclusion 86 ---------- 87 There are a lot more features than described here. Just have a look at the menus to see them all. :-) 88 89 For more information about Wireshark, see: "http://www.wireshark.org". You can get a user's guide and other useful information there. 90 91 We hope this helped you with the first steps of using Wireshark and that you will enjoy using this program.
Attached FilesTo refer to attachments on a page, use attachment:filename, as shown below in the list of files. Do NOT use the URL of the [get] link, since this is subject to change and can break easily.
You are not allowed to attach a file to this page.