Learn Wireshark in 15 Minutes! Lesson 1 for BEGINNERS

So, let's go ahead and
jump into lesson one.

Now, the important thing about

Wireshark when you're starting to look

at a trace file with it, is the setup.

Now, albeit, when you're
looking at Wireshark

at the start, it's a daunting thing to

look at, especially when you're first

getting going with using the analyzer. So

I want to show you a few things, a few

tricks that you can use to get a bit

more comfort with it. Now, as you can see

here on my copy of Wireshark, this is the

default profile. Now, that's the first

thing you want to learn about setting up

Wireshark. If you look at the lower right-

hand corner, you can see which profile

you're using. But what's a profile?

Well, a profile is basically a set

of configurations or settings. Think

about it this way. If I go out to my car,

I'm six foot two.

I want a certain setup for my seat, and I

want my steering wheel in a certain place,

and the rear view mirrors, and a

lot of cars have the ability to just

touch a button, and everything goes to me.

Well my wife goes out there, and she's

five foot one, so she can't just jump in

the same kind of settings that I like to

use when I drive. So, she's got another

setting button, and when
she hits that button,

it all adjusts just to her. Now, in a

similar way with the

profiles within Wireshark, if I'm

troubleshooting tcp, I might want a

certain set of columns, and coloring

rules, and filters just for that protocol

Or maybe I'm looking at VoiceOver IP, or

TLS, or Quick.

Now, I'm going to want different things

depending on the protocol I'm looking at,

and that's exactly what profiles allow

you to do. To save filter buttons,

coloring, even dissectors. I don't

always need every single Wireshark

dissector for every profile.

So, one of the first things I want to

teach you with the Wireshark analyzer is

going down. And let's go ahead and go to

the right-hand part of the screen.

We're going to right click this.

Now, if you're on default, that's fine.

Everything that you do and change will be

saved to that profile.

But let's go ahead and create a new

profile. And as you can see, there's

several in my copy of Wireshark, but I'm

going to go ahead and start a new one,

and we're going to call this Wireshark

Master Class.
Doesn't that sound pretty cool?

And then we're going to hit 'ok'.

So now we can see in the
lower right, Wireshark

Master Class, at least this is just how

we're going to begin in getting

Wireshark set up. Now, if you notice up on

top, I've got the frame number,
I've got the time,

source and destination IP addresses,

protocol length and information.

Now this is where I want
to start to customize

things. First of all, text is a little bit

small for me, so I'm going to go to my

magnifying glass, gonna boost that up

just a little bit.

And you also notice that the columns

have kind of

come together. They've almost collided a

little bit, so I'm going to go over here

to the right, and I'm just going to click

my little column adjuster,

and that will set up everything

so nothing's overlapping.

Now, another thing that I
like to do...now,

this is a personal preference, is

typically, if I'm looking at the

packet detail and the packet bytes, in

most cases, when I'm looking at protocols

I'm looking at header values that are

over here on the left. And I typically

have this white space that's over here

on the right. So another thing that I

like to do with many of my profiles is I

like to put the packet bytes

up here on the right.

So I'm going to show you how to do that.

And an important thing to
learn about Wireshark

is the preferences. That's where we can

set up the layout, and the columns, and

the buttons, and some of the

customization with the protocols, and we

can do all that under Wireshark

preferences. Now, to get
to preferences, if

you're on a Windows machine, you're going

to go to the Edit menu, and you're going

to come down to preferences down around

this area. But I'm on a Mac system, so I'm

going to go to Wireshark preferences

over here on the left.

This brings up my preferences, and what

I'd like to do is go ahead
and go to layout,

and this is where I can set up...do I want

the packet detail, packet bytes, packet

list all stacked on top of each other?

Depending on if I have a very large

monitor, I might want to adjust that.

I usually use the next one
over to the right.

Now, another thing that's pretty fun is

in a recent version of Wireshark, here

I'm running 3.4.3, I believe,

now, under the packet, any of the panes

you can also select
'packet diagram', which

is pretty interesting to do. In fact, just

to show you that, or demonstrate that, I'm

going to go to 'packet diagram' on this

one. And let's go ahead and hit 'ok'.

And now we can see that our screen has

reconfigured, and I also have this really

neat-o feature, where I can
see the actual frame layout

and packet layout for the packet that

I've selected. So, for example, if we take

a look at packet #1, which, by the

way, I hope that you downloaded this

trace file down in the description, and

you can follow along packet for packet,

but if we go to packet #1, here

we can see that encapsulated within this

packet, we have ethernet, IP, and tcp.

Well, over here on the right, now that I

have that packet layout,
I can see the ethernet framing.

So there's my six-byte, destination six-

byte source, and my ether type, and then I

have the IP header values. And in fact, if

I right-click this guy, and I can go to

'show field values', it'll actually pull

the values over from the packet itself

and put them in that layout. Now, this is

pretty handy, nice way to visualize a

protocol and the structure of that

protocol for the headers, and neat

feature that was just added. So I'm going

to go ahead and go back to preferences,

and I'm actually going to change this on

my layout. Let's go to pane three.

I'm going to go back to packet bytes.

Alright? Now, while I'm here under

preferences, there's a couple other

things that we're going to adjust. Again,

just to make things
a little bit easier for us.

I'm going to go to columns,

and every packet head has to know how to

use and read a delta time column, alright?

If you haven't done that yet, this is

something that surely you want to make

sure that you know how to add. So I'm

going to come down here
under columns, hit plus,

and I'm going to name this column 'Delta',

and I'm going to choose...the type is

going to be Delta Time Displayed. Alright?

Once I have that set up, I can go ahead

and drag it up next to the time column,

so now I can have a running total of

time, or I can have a time of day, or I

can have UTC time, and then right next to

that column, I can have a Delta time,

which is going to display the amount of

time between displayed packets.

Very useful column to have when I'm

troubleshooting. So I'm going to go ahead

and select 'ok'. And
if we notice up top, we

have our running total of time, and our

Delta time. Now, by the way, the time

column. This is an adjustable time column.

Like I mentioned, it can be time of day

it can be year, month, day, and then

actual time of day if I want. So to

adjust this and what it shows, that's

where we can go to 'view', and we go to

'time display format',
and this is where we

can select how we want time to be

represented in that time column.

Now, usually, I start out with seconds

since beginning of capture, but hey,

sometimes I have a client in New York

City, and they send me a trace and I go

ahead and open it,
and if I do time of day,

Wireshark will get the time of day off

of my system clock. So if it says three

o'clock for them, that means noon for me,

so sometimes that's also why I would

like to use UTC time.

Alright, so we went ahead and
adjusted our screen layout,

we looked at the packet layout view,

or those header values, and we
went ahead and added a Delta time.

Now, another thing that I like to do is I

like to color certain things. Because if

we look over here on the right, this is

our intelligent scroll bar, and at least

for this trace file, you can see how

there's just a lot of
beige and light blue, and

not a lot's going to jump out at you in

this trace, because there's not a lot of

TCP errors and such. But this is where

you would look for things like black

lines with red letters,
those are TCP errors.

But something else that I like to do is

I like to color my TCP syns, and I'm

going to show you how to create a

coloring rule, because then that will

help certain things jump out to you.

Now again, there's a...as a side note i

just want to thank Hansung, if he's

watching this video, he's a friend of

mine from Shark Fest,
but he has a really good

saying, if you will, and he often says "my

way or the highway". That means your

settings for Wireshark are good for you,

that's your troubleshooting style, so no

one can ever tell you that that's wrong.

If it works for you, go to town. That's

why there's all these great
configurations within Wireshark.

I like to paint my TCP syns bright green,

you might like to make them

some odd color of brown. That's totally

up to you, and it's your way or the highway.

But right now, you're on my highway,
so let me show you how to paint

those green. I'm going to go ahead and go

up to the view menu, and I'm going to

come down to 'coloring rules',

and this will show you the standard

default coloring rules that come with

the default profile.

Some people hate these coloring rules,

they delete them all, or they just turn

off coloring altogether. To do that, you

just hit the button up on top, that'll

enable or disable the coloring

altogether. But to add a coloring rule, we

hit our little plus button, and I'm going
to call this one 'TCP syn',

and my filter is going to be

tcp dot flags dot sin equals equals one.

So, I like to color any packet with

a syn flag, even the syn and syn ack,

I want that to be green,

both of them, so I want to see the

client trying to connect,
and the server response.

Now you might think, well, I just

want to have only the syn, or only the

synax. This is where you can start to

goof around with our display filter. You

can come back here to flags, show me that

flags field equals equals 0x002.

I'm going to show you
how to get to that value,

but this would just color the syn

not the synack.

I don't like that, I like to go
tcp dot flags dot syn...

if I could type...equals equals one.

So there's my display filter. So what I'm

saying is any packet
that meets this filter,

this is how you should color it.

Okay, so now that I've got my

tcp dot flags dot syn equals one,

now I want to come down and actually

color it. So I'm going to go to the

background, and I'm going to go over here,

pick a nice bright

packet pioneer green, if you will, a nice

packet head green,
and I'm going to say 'ok'.

and there we go. So now all packets that

meet tcp dot flags
dot syn equals equals one,

all of those will be green. But what I

want to do is I'm going to
actually drag this below,

the bad tcp. So what this
means is if I have a syn,

if I send off that syn

and if i have to retransmit it, the first

syn is going to be bright green, the

second one will be according to the bad

TCP rules. It'll be black and red.

Right, so I only want

the first syn to be green, any

re-transmissions, go ahead and make those

that error indicator, that bad TCP.

Let's say 'ok'.

Now, initially, you notice
how my first packet is white

and the second one is green. If you come

up here and just do a refresh, it's

called another pass. That'll just refresh

the view and run this trace file back

through the rules that we have enabled,

so that will make sure that we have

everything colored right. So there we go,

we just added a coloring rule. Now again,

you can add coloring rules for all kinds

of thing. Do you want to color the TLS

handshake? Do you want to color

the fins? Do you want to have the resets

be some type of interesting color that

really jump out at you? So the coloring

rules are a nice thing to add.

Now, along with that, in this profile,

what we also want to do is
learn how to add buttons.

Now, throughout this course, and if you

take any of my courses, you're going to

notice our display filters. We quickly

get into how to set
different display filters.

So, let's go ahead and create a button

that will set a filter just for our TCP

syns. How about that?

So, if I come down here, and go ahead and

pick that first packet...I'm going to show

you a trick, so you don't have
to remember the syntax for

display filters. If you select our packet

that has whatever it is you're going to

filter for, come down into our detail

view. I'm going to go down to flags, and

I'm going to go down to syn.

Let's say I want to filter for only

packets with the syn bit.

So I come down here, and I'm going to

right click that, and I'm going to say

'prepare as filter'...

selected...not not selected, so I'm not

saying everything but. Let's go and hit

'selected'. Okay, so
we can see up above in

the display filter, we got tcp dot flags

dot syn equals equals one. Okay, that's

great. So if I apply that, now I can see

just the two packets in the trace that

have that syn bit set. But I don't want

to have to type that again, it's just one

of those things, I just want to click a

button and have it be there. But to do

that, if i come over here
to the plus button,

now I'll go ahead and see our filter

button where we can add a label, I'm

going to call this 'TCP syn'.

Snd my filter is that same filter as

above, and I can say, 'ok'. Now I have a

button over here on the right, so if I

ever open up a trace file and I quickly

just want to see the syns, I can come

over here and click that button, and I

only see those packets.

Now, this is where we can do a lot of

customization with Wireshark. You can

have a lot of buttons up here, and that

can highlight things that you're

specifically looking for in a trace file.

Don't worry, as we go forward, those are

the kind of things that I'm going to

teach you. Now, one final thing I'd like

to teach you in this first lesson is how

to add columns up on top.

That's something that you're going
to constantly be doing.

Now to add a column, I showed

you how to do it the long way.

We can go to 'preferences', we can go

to columns, and we can manually add one

like we did with the Delta time view, but

instead, let's go ahead and add one

the more typical way that you're going

to do this. So what I'm going to do is

I'm going to come down to TCP, and I'm

going to take a look at TCP segment

length. I'm going to right click this, and

I'm going to come down to
'apply as column'.

Now, if you notice, I have the standard

frame length here by default, but I want

to see the TCP segment length,
and the reason

is that I'm often interested in how much

data is actually encompassed in the

payload, so this shows me how much is

this packet actually carrying

in form of bytes of data.

Length is nice,

but this is often what I'm digging for.

So TCP segment length is a frequent one

that I have up here. In fact, it's so

frequent, I'll often come over here to

'length', and I'll right-click this, and I

can either come down to 'length' and

uncheck it, so it will disappear,

or I can remove this column from this

profile completely. So I'm going to say

'remove column', and
now I just have my TCP

segment length. So this is an initial way

that you can set up Wireshark. What did

we learn? Let's go down our list. We

talked about our screen layout, so how to

adjust that. We talked about how we can

change from packet bytes to the actual

header values of the packet or the

protocols. We also talked about how to

add a button, how to do a coloring rule,

how to add and remove columns, how to add

a custom column for our Delta time, and

to do some simple display filters. So

look how much you were able to learn in

lesson one of the Wireshark Master Class.

So thanks for stopping by. Make sure that

you subscribe and hit the notification

bell, because as I come out with these

master classes, I want to make sure that

you're notified. Great to have you, and

we'll see you on the next class.

[Music]