June 2016
Beginner to intermediate
322 pages
6h 18m
English
Content preview from Practical Windows ForensicsBecome an O’Reilly member and get unlimited access to this title plus top books and audiobooks from O’Reilly and nearly 200 top publishers, thousands of courses curated by job role, 150+ live events each month,
Start your free trial
Using WireShark
WireShark is used to address various issues that are related to the functioning of the network by network administrators, but it also plays an invaluable role in cases of network traffic analysis in investigations of incidents.
The WireShark interface can be divided into three main parts.
The upper part displays the list of packages. Each package information is available. By default, the packet number, timestamp, source, and destination address, protocol, packet length, and special protocols for different information.
The middle section displays detailed information about the package, which is selected in the upper part.
The bottom window displays the individual bytes package to hex and ASCII formats such as conclusions team tcpdump, ...