Using WireShark
WireShark is used to address various issues that are related to the functioning of the network by network administrators, but it also plays an invaluable role in cases of network traffic analysis in investigations of incidents.
The WireShark interface can be divided into three main parts.
The upper part displays the list of packages. Each package information is available. By default, the packet number, timestamp, source, and destination address, protocol, packet length, and special protocols for different information.
The middle section displays detailed information about the package, which is selected in the upper part.
The bottom window displays the individual bytes package to hex and ASCII formats such as conclusions team tcpdump, ...
Get Practical Windows Forensics now with the O’Reilly learning platform.
O’Reilly members experience books, live events, courses curated by job role, and more from O’Reilly and nearly 200 top publishers.
