How to Monitor Network packet using Wireshark

To Monitor Network packet by using Wireshark

Wireshark is a network packet analyze which tries to capture network packets and tries to display that packet data. It is an open source network analyzer tool.

Features

• Available for UNIX and Windows.
• Capture live packet data from a network interface.
• Open files containing packet data captured with tcpdump/WinDump, and a number of other packet capture programs.
• Import packets from text files containing hex dumps of packet data.
• Display packets with very detailed protocol information.
• Save packet data captured.
• Export some or all packets in a number of capture file formats.
• Filter packets on many criteria.
• Search for packets on many criteria and many more features available.

To install

Use the following command to install Wireshark package.

[root@linuxhelp ~]# yum install wireshark
Loaded plugins: aliases, changelog, fastestmirror, kabi, presto, refresh-packagekit, security, tmprepo, verify,
              : versionlock
Loading support for CentOS kernel ABI
Setting up Install Process
Loading mirror speeds from cached hostfile
 * base: ftp.iitm.ac.in
 * extras: ftp.iitm.ac.in
 * updates: ftp.iitm.ac.in
.
.
.
Installed:
  wireshark.x86_64 0:1.8.10-17.el6                                                                                

Complete!

To install wireshark-gnome for GUI

Execute the below command to install wireshark-gnome for GUI.

[root@linuxhelp ~]# yum install wireshark-gnome
Loaded plugins: aliases, changelog, fastestmirror, kabi, presto, refresh-packagekit, security, tmprepo, verify,versionlock
Loading support for CentOS kernel ABI
Setting up Install Process
Loading mirror speeds from cached hostfile
 * base: ftp.iitm.ac.in
 * extras: ftp.iitm.ac.in
 *  updates: ftp.iitm.ac.in
.
.
Installed:
  wireshark-gnome.x86_64 0:1.8.10-17.el6                                                                          

Complete!

To launch wireshark analyzer by using the following command.

[root@linuxhelp ~]# wireshark

Once the analyzer opens press the Interface list and choose the desired interface and then press start capture on interface.

Now we can see the three terminal status. The first terminal shows the list of packet transfer details, scroll down the terminal to get the more status. The middle terminal shows the packet details of selected IP address. The final terminal shows the content of packet in ASCII and Hexadecimal format.

Now filter the packets based on source and destination IP address.

Now filter the packets based on service.

Now Filter the packets based on || or the other condition

Now Filter the packets based on port number.