LoveMyTool - Open Community for Network Management and Monitoring

Wireshark: Wireless Display and Capture Filters Samples (by Joke Snelders)

Author Profile - My name is Joke (pronounced \yo-kə\ or Joan for those who do not speak Dutch). During the day, I work as a secretary for a non-profit organization providing assisted living for mentally handicapped people in the south of The Netherlands. In my spare time I like to use Wireshark. I find it interesting and necessary to monitor my home network to see what is going on. As a user I like to answer questions at the Wireshark Mailing List.

What is in it for me? Well, I learn a great deal whenever I try to solve real-world problems. I am also a member of the NGN (the Dutch Network User's Group). I write articles about how to use Wireshark and the command line tools. And if there is still some spare time left, I like to go biking in the woods near my hometown with my husband and fellow geek.

Wireshark: Wireless Display and Capture Filters samples

Display filters
You can apply display filters, when you want to look for specific data in capture files. The packets, that don't match the Display Filter are hidden, but not removed from the capture file.

There are different ways to apply display filters.
A way to use display filters is to start typing in the Filter Input Field in the Filter Toolbar.
You can take advantage of the autocomplete function. When the back-ground of the filterbox turns green the filter string is valid.
Don't forget to hit Apply or Enter to apply the filter.

You can also copy and paste filter strings into the Filter Input Field.

Here are some examples:

• Show only the beacon frames:
  wlan.fc.type_subtype == 0x08
• Show everything except the beacon frames:
  !wlan.fc.type_subtype == 0x08
• Show only beacon frames and ack frames:
  (wlan.fc.type_subtype == 0x08) || (wlan.fc.type_subtype == 0x1d) 
• Show everything except the beacon and ack frames
  (!wlan.fc.type_subtype == 0x08) && (!wlan.fc.type_subtype == 0x1d)

You will find more information in the Wireshark User's Guide and in the Wireshark Wiki.

Continue reading to learn more about capture filters.

Click on image to enlarge

Stardock Fences: Organize Your Desktop (by Joke Snelders)

Author Profile - My name is Joke (pronounced \yo-kə\ or Joan for those who do not speak Dutch). During the day, I work as a secretary for a non-profit organization providing assisted living for mentally handicapped people in the south of The Netherlands. In my spare time I like to use Wireshark. I find it interesting and necessary to monitor my home network to see what is going on. As a user I like to answer questions at the Wireshark Mailing List.

What is in it for me? Well, I learn a great deal whenever I try to solve real-world problems. I am also a member of the NGN (the Dutch Network User's Group). I write articles about how to use Wireshark and the command line tools. And if there is still some spare time left, I like to go biking in the woods near my hometown with my husband and fellow geek.

Stardock Fences: Organize Your Desktop
Fences is a program that helps you to organize your desktop.

Click here to download Fences: it is free for personal use.

A "Fence", a term coined by this program, is an icon group on your desktop.
This option makes the program very useful for people, who give frequently presentations.
You can group the files and shortcuts for each presentation in a different Fence.

Another advantage: your desktop won't get messed up, when you connect your laptop to a beamer.
The Fences will automatically scale when you switch screen resolutions. Because the icons are caught in the Fences the icon layout is preserved.

Curious to know how to get started? Continue reading...
   

PlayCap: Playback for Wireshark Capture Files (by Joke Snelders)

Author Profile - My name is Joke (pronounced \yo-kə\ or Joan for those who do not speak Dutch). During the day, I work as a secretary for a non-profit organization providing assisted living for mentally handicapped people in the south of The Netherlands. In my spare time I like to use Wireshark. I find it interesting and necessary to monitor my home network to see what is going on. As a user I like to answer questions at the Wireshark Mailing List.

What is in it for me? Well, I learn a great deal whenever I try to solve real-world problems. I am also a member of the NGN (the Dutch Network User's Group). I write articles about how to use Wireshark and the command line tools. And if there is still some spare time left, I like to go biking in the woods near my hometown with my husband and fellow geek.

PlayCap: Playback for Wireshark Capture Files.
Alan Ott has developed the tool PlayCap.
PlayCap is an application, that runs on Linux and Windows. PlayCap plays back capture files made from Wireshark, tcpdump, WinDump, or any other libpcap-based application.

You can download PlayCap here.
Continue reading to learn more.

Wireshark: The Benefits of Marking Packets (by Joke Snelders)

Author Profile - My name is Joke (pronounced \yo-kə\ or Joan for those who do not speak Dutch). During the day, I work as a secretary for a non-profit organization providing assisted living for mentally handicapped people in the south of The Netherlands. In my spare time I like to use Wireshark. I find it interesting and necessary to monitor my home network to see what is going on. As a user I like to answer questions at the Wireshark Mailing List.

What is in it for me? Well, I learn a great deal whenever I try to solve real-world problems. I am also a member of the NGN (the Dutch Network User's Group). I write articles about how to use Wireshark and the command line tools. And if there is still some spare time left, I like to go biking in the woods near my hometown with my husband and fellow geek.

Wireshark: the benefits of marking packets
There are several reasons to mark packets:

• Mark packets of particular interest when you scroll through a trace file.
  It's easy to find previous marked packets in a large trace files.
  
• Save marked packets.
• Apply a display filter, mark the packets and save those packets to a separate trace file.
• Use Mark Packets to save 2 or more tcp and/or udp streams to a separate file.

Options
You find the options and shortcut keys under the "Edit" menu:

• Mark Packet (toggle) - CTRL+M
  Mark or unmark the selected packet.
• Find Next Mark - Shift+CTRL+N
  Jump to the next marked packet in the trace file.
• Find Previous Mark - Shift+CTRL+B
  Jump to the previous marked packet in the trace file.
• Mark All Packets - CTRL+A
  Mark all packets, that are currently displayed.
• Unmark All Packets - CTRL+D
  Unmark all marked packets, that are currently displayed.

Notes:
You can also right-click a packet in the Packet List and choose Mark Packet (toggle) from the context menu.
You cannot save the marks in a trace file. You loose the marks, when you close the file.

Continue reading, download the sample file and follow along.

Click on image to enlarge

Mozilla Firefox Add-on's: Reveal long URL's (by Joke Snelders)

Author Profile - My name is Joke (pronounced \yo-kə\ or Joan for those who do not speak Dutch). During the day, I work as a secretary for a non-profit organization providing assisted living for mentally handicapped people in the south of The Netherlands. In my spare time I like to use Wireshark. I find it interesting and necessary to monitor my home network to see what is going on. As a user I like to answer questions at the Wireshark Mailing List.

What is in it for me? Well, I learn a great deal whenever I try to solve real-world problems. I am also a member of the NGN (the Dutch Network User's Group). I write articles about how to use Wireshark and the command line tools. And if there is still some spare time left, I like to go biking in the woods near my hometown with my husband and fellow geek.

Mozilla Firefox Add-on's: Reveal long URL's
They become more and more common and lots of services can create them:
short URL's.
There are good reasons to use them, but also people with bad intentions start to use them. So I start looking for a way to see the real URL, before hitting a short one.
Mozilla Firefox has some solutions. Continue reading to see them.

If there is no solution, there is no problem.

Review of Wireshark and CACE Pilot (by Joke Snelders)

Author Profile - My name is Joke (pronounced \yo-kə\ or Joan for those who do not speak Dutch). During the day, I work as a secretary for a non-profit organization providing assisted living for mentally handicapped people in the south of The Netherlands. In my spare time I like to use Wireshark. I find it interesting and necessary to monitor my home network to see what is going on. As a user I like to answer questions at the Wireshark Mailing List.

What is in it for me? Well, I learn a great deal whenever I try to solve real-world problems. I am also a member of the NGN (the Dutch Network User's Group). I write articles about how to use Wireshark and the command line tools. And if there is still some spare time left, I like to go biking in the woods near my hometown with my husband and fellow geek.

Wireshark and CACE Pilot:
                 one plus one equals more than two
CACE Pilot is an analyzer for wired and wireless networks and is fully integrated with Wireshark.
Version 2.1 is recently released by CACE Technologies.

CACE Pilot = Visualization
It is shipped with a lot of Views, so you can start right away.
The Views consist of a collection of interactive display components like bar charts, strip charts, conversation rings, grids and so on.
After loading a capture file you can apply one or more Views. You can also use traffic from a live source: a wired ethernet adapter or a wireless adapter.
In the strip chart Bandwith Over Time you see right away when the bandwith usage drops down to zero. The bar chart TCP Errors shows for instance the number of Retransmissions, Duplicate ACK's, Zero Windows.
CACE Pilot offers the flexibility to customize the Views by using display filters. This way you can create all the Views you need for your job.

Capture files
It's amazing that CACE Pilot can handle gigabyte capture files without the need to split those files.
Use views like Capture Summary, Conversations Overview, Protocol Distribution to start and use the powerfull feature Drill-Down to zoom into the details.
By selecting one or more bars in a bar chart or select a certain amount of time in a strip chart you focus in on parts of the trace file, where you suspect a problem.
You can also send the selected traffic to Wireshark for further analyzing.

CACE Pilot has a whole lot of options; continu reading while I dig into a few of them.

Click on image to enlarge

Wireshark & Windows 7 (by Joke Snelders)

Author Profile - My name is Joke (pronounced \yō-kə\ or Joan for those who do not speak Dutch). During the day, I work as a secretary for a non-profit organization providing assisted living for mentally handicapped people in the south of The Netherlands. In my spare time I like to use Wireshark. I find it interesting and necessary to monitor my home network to see what is going on. As a user I like to answer questions at the Wireshark Mailing List.

What is in it for me? Well, I learn a great deal whenever I try to solve real-world problems. I am also a member of the NGN (the Dutch Network User's Group). I write articles about how to use Wireshark and the command line tools. And if there is still some spare time left, I like to go biking in the woods near my hometown with my husband and fellow geek.

Wireshark & Windows 7
In fact the title should sound like HowTo run Wireshark and HowTo install WinPcap 4.1 beta 5 on Windows 7.
Well, there are some issues:
one concerns Wireshark and the other WinPcap.

Let's start with running the previous versions on Windows 7.
Here you can download all the versions of Wireshark.

Installing Wireshark 1.0.8 or 1.1.3 with WinPcap 4.0.2 on Windows 7.
The Wireshark Installer includes WinPcap.
Previous versions of Wireshark, e.g. stable release 1.0.8 or development release 1.1.3 come together with WinPcap 4.0.2. It's no problem to install those on Windows 7.

You might get surprised, when you try to run wireshark:

Why Encrypt Virtual Machines (by Joke Snelders)

Author Profile - My name is Joke (pronounced \yō-kə\ or Joan for those who do not speak Dutch). During the day, I work as a secretary for a non-profit organization providing assisted living for mentally handicapped people in the south of The Netherlands. In my spare time I like to use Wireshark. I find it interesting and necessary to monitor my home network to see what is going on. As a user I like to answer questions at the Wireshark Mailing List.

What is in it for me? Well, I learn a great deal whenever I try to solve real-world problems. I am also a member of the NGN (the Dutch Network User's Group). I write articles about how to use Wireshark and the command line tools. And if there is still some spare time left, I like to go biking in the woods near my hometown with my husband and fellow geek.

Virtual machines
It's great to use virtual machines.
VMware Server is free.
You can use virtual machines for different operating systems, e.g. Windows 7 RC or Linux distros.
Or install a virtual machine, make a copy and use the virtual machine for different software, different applications, different...whatever.
If it does not work the way you want, delete the virtual machine and start all over again with a fresh copy.
Virtual machines are so easy to copy...

But what if the virtual machine contains sensitive data?

Review of Wireshark 1.2.0 & GeoIP (by Joke Snelders)

Author Profile - My name is Joke (pronounced \yō-kə\ or Joan for those who do not speak Dutch). During the day, I work as a secretary for a non-profit organization providing assisted living for mentally handicapped people in the south of The Netherlands. In my spare time I like to use Wireshark. I find it interesting and necessary to monitor my home network to see what is going on. As a user I like to answer questions at the Wireshark Mailing List.

What is in it for me? Well, I learn a great deal whenever I try to solve real-world problems. I am also a member of the NGN (the Dutch Network User's Group). I write articles about how to use Wireshark and the command line tools. And if there is still some spare time left, I like to go biking in the woods near my hometown with my husband and fellow geek.

Wireshark 1.2.0 & GeoIP

A cool new feature in Wireshark.

Wireshark supports MaxMind's GeoIP. You can use their databases to match IP addresses to countries, city's and other bits of information. The information about all known IP address locations can be displayed on a map.

In this article I will tell you which steps you have to take to use this new feature.

Get Wireshark Now

Click here to get the latest version.

It's free!

Windows - OS X - Linux - Others

Show Notes from Sharkfest 2009 (by Joke Snelders)

Author Profile - My name is Joke (pronounced \yō-kə\ or Joan for those who do not speak Dutch). During the day, I work as a secretary for a non-profit organization providing assisted living for mentally handicapped people in the south of The Netherlands. In my spare time I like to use Wireshark. I find it interesting and necessary to monitor my home network to see what is going on. As a user I like to answer questions at the Wireshark Mailing List.

What is in it for me? Well, I learn a great deal whenever I try to solve real-world problems. I am also a member of the NGN (the Dutch Network User's Group). I write articles about how to use Wireshark and the command line tools. And if there is still some spare time left, I like to go biking in the woods near my hometown with my husband and fellow geek.

Flickr Photo Stream - Stanford University

Hey guys, where were you? Sharkfest was great!

From June 15 till June 18 the second annual Sharkfest was held at Stanford University in California. The beautiful campus itself is worth visiting: try to find some time to visit the Rodin Sculpture Garden or walk down The Oval Park and Palm Drive toward downtown Palo Alto.

Sharkfest started on Monday with registration. The attendees received the original Sharkfest bag, an AirPcap Classic Adapter, conference materials and other cool takeaways.

During the well organized Welcome Barbeque in Dohrmann Grove we met the coordinating crew, presenters and other attendees, including Long Distance Travellers from Israel, Germany, Canada, Maleysia, Indonesia and The Netherlands.

During these days we had to get up early. The conference started daily at 7.00 AM with breakfast and a keynote. The sessions started at 9.00 AM. You could choose to attend Development, Basic User or Advanced User tracks.