A free, self-paced textbook in 7 chapters. Read a chapter, then drill it with the 728 companion flashcards using spaced repetition.
Wireshark is a widely used network protocol analyzer designed for troubleshooting, protocol development, education, and detailed inspection of network traffic. It captures packets...
Almost every protocol Wireshark can dissect has a short, intuitive filter name. The core transport and network protocols use just their names: tcp, udp, icmp, arp, ip, and ipv6 all...
Because TCP is connection-oriented and stateful, much of Wireshark's analytical power is devoted to inspecting TCP behavior. The six control flags — SYN, ACK, FIN, RST, PSH, and UR...
HTTP filtering is one of the most common tasks in Wireshark, and the http filter alone captures every HTTP packet. Requests can be narrowed further by method using http.request.met...
Beyond individual packet filters, Wireshark provides a Statistics menu full of tools that summarize entire captures. The Protocol Hierarchy view (Statistics > Protocol Hierarchy) s...
Before capturing, the Capture > Options dialog controls how the trace is collected. The interface list shows every available network adapter, and the chosen interface determines wh...
Wireshark ships with a family of command-line companions that support scripted and remote workflows. TShark is the CLI counterpart to the GUI, capable of capturing with tshark -i e...