Materiais

Conteúdo Programatico

What is Wireshark?

1. Protocol analysers,
2. Wireshark features,
3. versions,
4. troubleshooting techniques with Wireshark.

Installing Wireshark

1. Downloading Wireshark,
2. UNIX issues,
3. Microsoft issues,
4. The role of winpcap,
5. Promiscuous mode,
6. Installing Wireshark.
7. Wireshark documentation and help.
8. Hands on Downloading and installing Wireshark.

Capturing traffic

1. Starting and stopping basic packet captures,
2. the packet list pane, packet details pane, packet bytes pane, interfaces, using Wireshark in a switched architecture.
3. Hands on Capturing packets with Wireshark.

Troubleshooting networks with Wireshark

Common packet flows.
Hands on Analysing a variety of problems with Wireshark.

Capture filters

1. Capture filter expressions,
2. Capture filter examples (host, port, network, protocol, worm),
3. primitives,
4. combining primitives,
5. payload matching.
6. Hands on Configuring capture filters.

Working with captured packets

1. Live packet capture, saving to a file, capture file formats, reading capture files from other analysers, merging capture files, finding packets, going to a specific packet, display filters, display filter expressions.
2. Hands on Saving captured data, configuring display filters.

Analysis and statistics with Wireshark

1. Enabling/disabling protocols,
2. user specified decodes,
3. following TCP streams,
4. protocol statistics,
5. conversation lists,
6. endpoint lists,
7. I/O graphs,
8. protocol specific statistics.
9. Hands on Using the analysis and statistics menus.

Command line tools

1. Tshark,
2. capinfos,
3. editcap,
4. mergecap,
5. text2pcap,
6. idl2eth.
7. Hands on Using tshark.

Advanced issues

1. 802.11 issues,
2. management frames,
3. monitor mode,
4. packet reassembling,
5. name resolution,
6. customising Wireshark.
7. Hands on Customising name resolution.