5.2Packet capture with Wireshark

The ping and nslookup you learn elsewhere confirm "does it connect?" and "can a name be resolved?", but they do not show what packets are actually being exchanged. This is where a packet analyzer comes in, the classic example being the free and widely used Wireshark. This section covers, at an introductory level, the purpose of a packet analyzer that captures communication packet by packet and visualizes its contents (source, destination, protocol, and payload), and the basic workflow of saving a capture as a .pcap file and reopening it later for analysis.

5.2.1The purpose of a packet analyzer

• A packet analyzer is software that captures traffic on the network packet by packet and shows its contents. You can see source/destination addresses, the protocols in use (TCP/UDP/DNS, etc.), and even the exchange itself; Wireshark is the leading example.
• The purpose is to confirm with your own eyes "what is actually happening." ping tells you only up or down, but a capture reveals a deeper cause—"the request goes out but no reply returns," or "another protocol is interrupting midway."
• To capture, select the target interface and start. Because a flood of packets flows, filtering (e.g., ip.addr 192.168.1.10 or dns) to narrow down to only the traffic of interest is the practical basic.