Packt+ | Advance your knowledge in tech

You're reading from Network Analysis using Wireshark 2 Cookbook Practical recipes to analyze and secure your network using Wireshark 2

Product type Paperback

Published in Mar 2018

Publisher

ISBN-13 9781786461674

Length 626 pages

Edition 2nd Edition

Tools

Wireshark

Concepts

Network Security

Authors (3):

Nagendra Kumar Nainar

Yoram Orzach

Yogesh Ramdoss

View More author details

Table of Contents (25) Chapters

Title Page

Dedication

Packt Upsell

Contributors

Preface

1. Introduction to Wireshark Version 2 FREE CHAPTER

2. Mastering Wireshark for Network Troubleshooting

3. Using Capture Filters

4. Using Display Filters

5. Using Basic Statistics Tools

6. Using Advanced Statistics Tools

7. Using the Expert System

8. Ethernet and LAN Switching

9. Wireless LAN

10. Network Layer Protocols and Operations

11. Transport Layer Protocol Analysis

12. FTP, HTTP/1, and HTTP/2

13. DNS Protocol Analysis

14. Analyzing Mail Protocols

15. NetBIOS and SMB Protocol Analysis

16. Analyzing Enterprise Applications' Behavior

17. Troubleshooting SIP, Multimedia, and IP Telephony

18. Troubleshooting Bandwidth and Delay Issues

19. Security and Network Forensics

Index

Configuring a flow graph for viewing TCP flows

In this recipe, we will learn how to use the flow graph feature.

Getting ready

Open Wireshark, click Statistics, and choose Flow Graph around the middle of the statistics menu.

How to do it...

Choosing flow graph, the following window will open:

In the window, we see the packet time on the left, the originating and destination addresses of the packets, as well as the port numbers on the two sides of the flow arrows.

Clicking on one of the session arrows will bring you to the packet in the Wireshark main window packet list pane.

You can choose from several options in the flow graph window:

Show all the captured packets or just displayed packets, filtered by display filter.
Show all flows or just TCP flows. This will show only TCP operation, for example, in HTTP requests it will show that it is a TCP PUSH (explained in Chapter 12, FTP, HTTP/1, and HTTP/2), and the fact that it is an HTTP GET command.
Show any type of address, for example MAC addresses,...