Learn Wireshark in 15 Minutes! Lesson 1 for BEGINNERS

So, let's go ahead and
jump into lesson one.

Now, the important thing about

Wireshark when you're starting to look

at a trace file with it, is the setup.

Now, albeit, when you're
looking at Wireshark

at the start, it's a daunting thing to

look at, especially when you're first

getting going with using the analyzer. So

I want to show you a few things, a few

tricks that you can use to get a bit

more comfort with it. Now, as you can see

here on my copy of Wireshark, this is the

default profile. Now, that's the first

thing you want to learn about setting up

Wireshark. If you look at the lower right-

hand corner, you can see which profile

you're using. But what's a profile?

Well, a profile is basically a set

of configurations or settings. Think

about it this way. If I go out to my car,

I'm six foot two.

I want a certain setup for my seat, and I

want my steering wheel in a certain place,

and the rear view mirrors, and a

lot of cars have the ability to just

touch a button, and everything goes to me.

Well my wife goes out there, and she's

five foot one, so she can't just jump in

the same kind of settings that I like to

use when I drive. So, she's got another

setting button, and when
she hits that button,

it all adjusts just to her. Now, in a

similar way with the

profiles within Wireshark, if I'm

troubleshooting tcp, I might want a

certain set of columns, and coloring

rules, and filters just for that protocol

Or maybe I'm looking at VoiceOver IP, or

TLS, or Quick.

Now, I'm going to want different things

depending on the protocol I'm looking at,

and that's exactly what profiles allow

you to do. To save filter buttons,

coloring, even dissectors. I don't

always need every single Wireshark

dissector for every profile.

So, one of the first things I want to

teach you with the Wireshark analyzer is

going down. And let's go ahead and go to

the right-hand part of the screen.

We're going to right click this.

Now, if you're on default, that's fine.

Everything that you do and change will be

saved to that profile.

But let's go ahead and create a new

profile. And as you can see, there's

several in my copy of Wireshark, but I'm

going to go ahead and start a new one,

and we're going to call this Wireshark

Master Class.
Doesn't that sound pretty cool?

And then we're going to hit 'ok'.

So now we can see in the
lower right, Wireshark

Master Class, at least this is just how

we're going to begin in getting

Wireshark set up. Now, if you notice up on

top, I've got the frame number,
I've got the time,

source and destination IP addresses,

protocol length and information.

Now this is where I want
to start to customize

things. First of all, text is a little bit

small for me, so I'm going to go to my

magnifying glass, gonna boost that up

just a little bit.

And you also notice that the columns

have kind of

come together. They've almost collided a

little bit, so I'm going to go over here

to the right, and I'm just going to click

my little column adjuster,

and that will set up everything

so nothing's overlapping.

Now, another thing that I
like to do...now,

this is a personal preference, is

typically, if I'm looking at the

packet detail and the packet bytes, in

most cases, when I'm looking at protocols

I'm looking at header values that are

over here on the left. And I typically

have this white space that's over here

on the right. So another thing that I

like to do with many of my profiles is I

like to put the packet bytes

up here on the right.

So I'm going to show you how to do that.

And an important thing to
learn about Wireshark

is the preferences. That's where we can

set up the layout, and the columns, and

the buttons, and some of the

customization with the protocols, and we

can do all that under Wireshark

preferences. Now, to get
to preferences, if

you're on a Windows machine, you're going

to go to the Edit menu, and you're going

to come down to preferences down around

this area. But I'm on a Mac system, so I'm

going to go to Wireshark preferences

over here on the left.

This brings up my preferences, and what

I'd like to do is go ahead
and go to layout,

and this is where I can set up...do I want

the packet detail, packet bytes, packet

list all stacked on top of each other?

Depending on if I have a very large

monitor, I might want to adjust that.

I usually use the next one
over to the right.

Now, another thing that's pretty fun is

in a recent version of Wireshark, here

I'm running 3.4.3, I believe,

now, under the packet, any of the panes

you can also select
'packet diagram', which

is pretty interesting to do. In fact, just

to show you that, or demonstrate that, I'm

going to go to 'packet diagram' on this

one. And let's go ahead and hit 'ok'.

And now we can see that our screen has

reconfigured, and I also have this really

neat-o feature, where I can
see the actual frame layout

and packet layout for the packet that

I've selected. So, for example, if we take

a look at packet #1, which, by the

way, I hope that you downloaded this

trace file down in the description, and

you can follow along packet for packet,

but if we go to packet #1, here

we can see that encapsulated within this

packet, we have ethernet, IP, and tcp.

Well, over here on the right, now that I

have that packet layout,
I can see the ethernet framing.

So there's my six-byte, destination six-

byte source, and my ether type, and then I

have the IP header values. And in fact, if

I right-click this guy, and I can go to

'show field values', it'll actually pull

the values over from the packet itself

and put them in that layout. Now, this is

pretty handy, nice way to visualize a

protocol and the structure of that

protocol for the headers, and neat

feature that was just added. So I'm going

to go ahead and go back to preferences,

and I'm actually going to change this on

my layout. Let's go to pane three.

I'm going to go back to packet bytes.

Alright? Now, while I'm here under

preferences, there's a couple other

things that we're going to adjust. Again,

just to make things
a little bit easier for us.

I'm going to go to columns,

and every packet head has to know how to

use and read a delta time column, alright?

If you haven't done that yet, this is

something that surely you want to make

sure that you know how to add. So I'm

going to come down here
under columns, hit plus,

and I'm going to name this column 'Delta',

and I'm going to choose...the type is

going to be Delta Time Displayed. Alright?

Once I have that set up, I can go ahead

and drag it up next to the time column,

so now I can have a running total of

time, or I can have a time of day, or I

can have UTC time, and then right next to

that column, I can have a Delta time,

which is going to display the amount of

time between displayed packets.

Very useful column to have when I'm

troubleshooting. So I'm going to go ahead

and select 'ok'. And
if we notice up top, we

have our running total of time, and our

Delta time. Now, by the way, the time

column. This is an adjustable time column.

Like I mentioned, it can be time of day

it can be year, month, day, and then

actual time of day if I want. So to

adjust this and what it shows, that's

where we can go to view and we go to

time display format and this is where we

can select how we want time to be

represented in that time column

now usually i start out with seconds

since beginning of capture but hey

sometimes i have a client in new york

city and they send me a trace and i go

ahead and open it and if i do time of

day

wireshark will get the time of day off

of my system clock so if it says three

o'clock for them that means noon for me

so sometimes that's also why i would

like to use utc time

all right so we went ahead and adjusted

our screen layout we looked at the

packet layout view or those header

values and we went ahead and added a

delta time

now another thing that i like to do is i

like to color certain things because if

we look over here on the right this is

our intelligent scroll bar and at least

for this trace file you can see how

there's just a lot of beige and light

blue and

not a lot's going to jump out at you in

this trace because there's not a lot of

tcp errors and such but this is where

you would look for things like black

lines with red letters those are tcp

errors

but something else that i like to do is

i like to color my tcp syns and i'm

going to show you how to create a

coloring rule because then that will

help certain things jump out to you

now again uh there's a as a side note i

just want to thank hansung if he's

watching this video he's a friend of

mine from shark fest but he has a really

good

saying if you will and he often says my

way or the highway that means your

settings for wireshark are good for you

that's your troubleshooting style so no

one can ever tell you that that's wrong

if it works for you go to town that's

why there's all these great

configurations within wireshark

i like to paint my tcp sins bright green

you might like to make them

some odd color of brown that's totally

up to you and it's your way or the

highway but right now you're on my

highway so let me show you how to paint

those green i'm going to go ahead and go

up to the view menu and i'm going to

come down to coloring rules

and this will show you the standard

default coloring rules that come with

the default profile

some people hate these coloring rules

they delete them all or they just turn

off coloring altogether to do that you

just hit the button up on top that'll

enable or disable the coloring

altogether but to add a coloring rule we

hit our little plus button and i'm going

to call this one tcp

syn

and my filter is going to be tcp dot

flags dot sin

equals equals one so i like to color any

packet with a sin flag even the syn and

syn ack

i want that to be

green both of them so i want to see the

client trying to connect and the server

response now you might think well i just

want to have only this in or only the

synax this is where you can start to

goof around with our display filter you

can come back here to flags show me that

flags field equals equals 0x002

i'm going to show you how to get to that

value but this would just color the sin

not the synack

i don't like that i like to go

tcp.flags.sin

if i could type equals equals one so

there's my display filter so what i'm

saying is any packet that meets this

filter

this is how you should color it

okay so now that i've got my

tcp.flags.sin equals

one now i want to come down and actually

color it so i'm going to go to the

background and i'm going to go over here

pick a nice bright

packet pioneer green if you will a nice

packet head green and i'm going to say

ok

and there we go so now all packets that

meet tcp.flags.cent equals equals one

all of those will be green but what i

want to do is i'm going to actually drag

this below

the bad tcp

so what this means is if i have a sin if

i send off that sin

and if i have to retransmit it the first

sin is going to be bright green the

second one will be according to the bad

tcp rules it'll be black and red

right so i only want

the first sin to be green any

re-transmissions go ahead and make those

that that error indicator that bad tcp

let's say okay

now initially

you notice how my first packet is white

and the second one is green if you come

up here and just do a refresh it's

called another pass that'll just refresh

the view and run this trace file back

through the rules that we have enabled

so that will make sure that we have

everything colored right so there we go

we just added a coloring rule now again

you can add coloring rules for all kinds

of things do you want to color the tls

handshake do you want to color

the fins do you want to have the resets

be some type of interesting color that

really jump out of you so the coloring

rules are a nice thing to add

now along with that in this profile

what we also want to do is learn how to

add buttons

now throughout this course and if you

take any of my courses you're going to

notice our display filters we quickly

get into how to set different display

filters

so let's go ahead and create a button

that will set a filter just for our tcp

synths how about that

so if i come down here and go ahead and

pick that first packet i'm going to show

you a trick so you don't have to

remember the syntax for

display filters if you select our packet

that has whatever it is you're going to

filter for come down into our detail

view i'm going to go down to flags and

i'm going to go down to syn

let's say i want to filter for only

packets with the send bit

so i come down here and i'm going to

right click that and i'm going to say

prepare as filter

selected not not selected so i'm not

saying everything but let's go and hit

selected okay so we can see up above in

the display filter we got tcp dot flags

that's in equals equals one okay that's

great so if i apply that now i can see

just the two packets in the trace that

have that send bit set but i don't want

to have to type that again it's just one

of those things i just want to click a

button and have it be there but to do

that if i come over here to the plus

button

now i'll go ahead and see our filter

button where we can add a label i'm

going to call this tcp

syn

and my filter is that same filter as

above and i can say ok now i have a

button over here on the right so if i

ever open up a trace file and i quickly

just want to see the sims i can come

over here and click that button and i

only see those packets

now this is where we can do a lot of

customization with wireshark you can

have a lot of buttons up here and that

can highlight things that you're

specifically looking for in a trace file

don't worry as we go forward those are

the kind of things that i'm going to

teach you now one final thing i'd like

to teach you in this first lesson is how

to add columns up on top that's

something that you're going to

constantly be doing now to add a column

we i showed you how to do it the long

way we can go to preferences we can go

to columns and we can manually add one

like we did with the delta time view but

instead let's go ahead and add one

the more typical way that you're going

to do this so what i'm going to do is

i'm going to come down to tcp and i'm

going to take a look at tcp segment

length i'm going to right click this and

i'm going to come down to apply as

column

now if you notice i have the standard

frame length here by default but i want

to see the tcb segment length and the

reason

is that i'm often interested in how much

data is actually encompassed in the

payload so this shows me how much is

this packet actually carrying

in form of bytes of data

length is nice

but this is often what i'm digging for

so tcp segment length is a frequent one

that i have up here in fact it's so

frequent i'll often come over here to

length and i'll right click this and i

can either come down to length and

uncheck it so it will disappear

or i can remove this column from this

profile completely so i'm going to say

remove column and now i just have my tcp

segment length so this is an initial way

that you can set up wireshark what did

we learn let's go down our list we

talked about our screen layout so how to

adjust that we talked about how we can

change from packet bytes to the actual

header values of the packet or the

protocols we also talked about how to

add a button how to do a coloring rule

how to add and remove columns how to add

a custom column for our delta time and

to do some simple display filters so

look how much you were able to learn in

lesson one of the wireshark master class

so thanks for stopping by make sure that

you subscribe and hit the notification

bell because as i come out with these

master classes i want to make sure that

you're notified great to have you and

we'll see you on the next class

[Music]

you