how to use wireshark as a troubleshooting tool

For instance, to see just NetFlow packets on port 2055, we can use filter udp.port = 2055 as shown: Like Wireshark, we can use filters to narrow our focus towards any traffic of interest. If a trace file is large, console output will scroll very quickly. The above sample trace appears to be an open capture with various exchanges between different hosts, possibly taken without any specific filter. It has similar features as Wireshark.įor someone who is more comfortable on command line, using tshark along with various Linux tools allows for more advanced filtering. Another lessor known command line tool that comes with Wireshark is tshark. One typically uses other tools to take a packet trace on network devices and then analyse it in Wireshark. It allows one to take a trace on a client host to look deep inside frames to understand an operation or to look for clues of any misbehaving network applications or protocols. Wireshark is one of the must have tool in the arsenal of network professional.

How to use wireshark as a troubleshooting tool