Wireshark is one of the most popular packet capture analysis tools available to incident response analysts. In addition to the ability to capture packets, there are a great many other features that are available. As entire volumes and training courses are built around this platform, it is impossible to identify every feature. Therefore, this chapter will focus on some of the key features of Wireshark that are most applicable to an incident investigation.
Arguably, Wireshark is the packet analyzer of choice for IT and security professionals. Due to the ubiquity of the application, there are a wide variety of resources available for additional training on Wireshark and its capability. The Wireshark site at https://www.wireshark.org/ ...
