Practical Packet Analysis
Using Wireshark to Solve Real-World Network Problems
2nd Edition
Published on 9. July 2011
Book
Paperback/Softback
XX, 258 pages
978-1-59327-266-1 (ISBN)
Description
It's easy to capture packets with Wireshark, the world's most popular network sniffer, whether off the wire or from the air. But how do you use those packets to understand what's happening on your network?
With an expanded discussion of network protocols and 45 completely new scenarios, this extensively revised second edition of the best-selling Pactical Packet Analysis will teach you how to make sense of your PCAP data. You'll find new sections on troubleshooting slow networks and packet analysis for security to help you better understand how modern exploits and malware behave at the packet level. Add to this a thorough introduction to the TCP/IP network stack and you're on your way to packet analysis proficiency.
Learn how to:
- Use packet analysis to identify and resolve common network problems like loss of connectivity, DNS issues, sluggish speeds, and malware infections
- Build customized capture and display filters
- Monitor your network in real-time and tap live network communications
- Graph traffic patterns to visualize the data flowing across your network
- Use advanced Wireshark features to understand confusing captures
- Build statistics and reports to help you better explain technical network information to non-techies
Practical Packet Analysis is a must for any network technician, administrator, or engineer. Stop guessing and start troubleshooting the problems on your network.
With an expanded discussion of network protocols and 45 completely new scenarios, this extensively revised second edition of the best-selling Pactical Packet Analysis will teach you how to make sense of your PCAP data. You'll find new sections on troubleshooting slow networks and packet analysis for security to help you better understand how modern exploits and malware behave at the packet level. Add to this a thorough introduction to the TCP/IP network stack and you're on your way to packet analysis proficiency.
Learn how to:
- Use packet analysis to identify and resolve common network problems like loss of connectivity, DNS issues, sluggish speeds, and malware infections
- Build customized capture and display filters
- Monitor your network in real-time and tap live network communications
- Graph traffic patterns to visualize the data flowing across your network
- Use advanced Wireshark features to understand confusing captures
- Build statistics and reports to help you better explain technical network information to non-techies
Practical Packet Analysis is a must for any network technician, administrator, or engineer. Stop guessing and start troubleshooting the problems on your network.
More details
Edition
2nd Edition
Language
English
Place of publication
San Francisco
Germany
Target group
Professional and scholarly
Systems administrators
- Hackers and security specialists
Edition type
Revised edition
Product notice
Unsewn / adhesive bound
Illustrations
black & white illustrations
Dimensions
Height: 23.5 cm
Width: 17.5 cm
Thickness: 19 mm
Weight
632 gr
ISBN-13
978-1-59327-266-1 (9781593272661)
Schweitzer Classification
Other editions
New editions
Book
03/2017
3rd Edition
No Starch Press
€47.00
Available immediately
Previous edition
Book
06/2007
1st Edition
No Starch Press
€36.00
Withdrawn from sale
Person
Chris Sanders is a computer security consultant, author, and researcher. A SANS Mentor who holds several industry certifications, including CISSP, GCIA, GCIH, and GREM, he writes regularly for WindowSecurity.com and his blog, ChrisSanders.org. Sanders uses Wireshark daily for packet analysis. He lives in Charleston, South Carolina, where he works as a government defense contractor.
Content
Praise for the First Edition of Practical Packet Analysis; Dedication; Acknowledgments; Introduction; Why This Book?; Concepts and Approach; How to Use This Book; About the Sample Capture Files; The Rural Technology Fund; Contacting Me; Chapter 1: Packet Analysis and Network Basics; 1.1 Packet Analysis and Packet Sniffers; 1.2 How Computers Communicate; 1.3 Traffic Classifications; 1.4 Final Thoughts; Chapter 2: Tapping into the Wire; 2.1 Living Promiscuously; 2.2 Sniffing Around Hubs; 2.3 Sniffing in a Switched Environment; 2.4 Sniffing in a Routed Environment; 2.5 Sniffer Placement in Practice; Chapter 3: Introduction to Wireshark; 3.1 A Brief History of Wireshark; 3.2 The Benefits of Wireshark; 3.3 Installing Wireshark; 3.4 Wireshark Fundamentals; Chapter 4: Working with Captured Packets; 4.1 Working with Capture Files; 4.2 Working with Packets; 4.3 Setting Time Display Formats and References; 4.4 Setting Capture Options; 4.5 Using Filters; Chapter 5: Advanced Wireshark Features; 5.1 Network Endpoints and Conversations; 5.2 Protocol Hierarchy Statistics; 5.3 Name Resolution; 5.4 Protocol Dissection; 5.5 Following TCP Streams; 5.6 Packet Lengths; 5.7 Graphing; 5.8 Expert Information; Chapter 6: Common Lower-Layer Protocols; 6.1 Address Resolution Protocol; 6.2 Internet Protocol; 6.3 Transmission Control Protocol; 6.4 User Datagram Protocol; 6.5 Internet Control Message Protocol; Chapter 7: Common Upper-Layer Protocols; 7.1 Dynamic Host Configuration Protocol; 7.2 Domain Name System; 7.3 Hypertext Transfer Protocol; 7.4 Final Thoughts; Chapter 8: Basic Real-World Scenarios; 8.1 Social Networking at the Packet Level; 8.2 Capturing ESPN.com Traffic; 8.3 Real-World Problems; 8.4 Final Thoughts; Chapter 9: Fighting a Slow Network; 9.1 TCP Error-Recovery Features; 9.2 TCP Flow Control; 9.3 Learning from TCP Error-Control and Flow-Control Packets; 9.4 Locating the Source of High Latency; 9.5 Network Baselining; 9.6 Final Thoughts; Chapter 10: Packet Analysis for Security; 10.1 Reconnaissance; 10.2 Exploitation; 10.3 Final Thoughts; Chapter 11: Wireless Packet Analysis; 11.1 Physical Considerations; 11.2 Wireless Card Modes; 11.3 Sniffing Wirelessly in Windows; 11.4 Sniffing Wirelessly in Linux; 11.5 802.11 Packet Structure; 11.6 Adding Wireless-Specific Columns to the Packet List Pane; 11.7 Wireless-Specific Filters; 11.8 Wireless Security; 11.9 Final Thoughts; Further Reading; Packet Analysis Tools; Packet Analysis Resources; Colophon; Updates;