Appearance

The Appearance section of the Wireshark preferences allows you to change the UI settings of Wireshark. In this section, you can adjust the text for the window title, specify the columns that you want to see when using Wireshark, and set the font and colors and the layout of Wireshark UI. For instance, if you want to change the default layout of Wireshark to a layout that is more comfortable for you, you can change what information the different panes in the layout will display. Figure 2-2 displays the modified layout where Pane 1 displays the packet list, Pane 2 displays the packet details, and Pane 3 displays the packet bytes in the layout that you selected in the Preferences window.

Capture

Expert

The Expert section of the Wireshark Preferences window allows you to define different field names and set the severity for those fields.

Filter Buttons

The Filter Buttons options allow the user to create custom shortcuts on the toolbar for various filter expressions. By using these buttons, users don’t have to repeatedly type the filter expressions; instead they can just click the button to apply the filter on the captured traffic. Figure 2-3 displays how to create a filter button for the HTTP GET method.

Name Resolution

The Name Resolution settings allow users to update the settings with regard to MAC address resolution and transport and network address resolution. These settings also allow users to use Domain Name System (DNS) packets for address resolution, use an external network name resolver, and also use the list of DNS servers for name resolution. The Name Resolution section also has options to list the DNS servers that can be used by Wireshark.

Protocols

The Protocols section of the Preferences window allows the user to configure settings for various lists of protocols supported by Wireshark. This is useful for analyzing traffic in network environments where the protocols are being used ports different than the default port numbers.

RSA Keys

The RSA Keys section allows user to configure the RSA private keys for decryption. In this section, use the Add New Keyfile button to select a file. The user will be prompted for a password if necessary. The Add New Token button can be used to add keys from a hardware security module (HSM), which might require using Add New Provider to add a vendor-specific configuration.

Statistics

This section allows you to customize the settings used by Wireshark to perform and display statistical analysis of the captured traffic. Settings such as burst rate resolution, burst rate window size, tab update interval, and so on, can be configured under this section.

Advanced

The Advanced section of the Preferences window allows user to view and edit all Wireshark preferences. If you are familiar with about:config in Firefox or chrom:flags in the Chrome web browser, then making changes using the Advanced pane will be a walk in the park. Users can search for a preference by typing text in the Search box on this window as shown in Figure 2-4.

Capture Filters

As stated previously, the capture filter in Wireshark is used to limit the packets that can be captured during a live capture. This means that the capture filter cannot be applied on existing packet capture or pcap files. In scenarios where the network is busy with heavy traffic or during network troubleshooting when a user wants to capture a specific packet, capture filters are a very useful feature. Capture filters are applied on the packets after they are processed by WinPcap in a Windows installation or the libpcap library in a Linux installation. Once the packets are passed through the filter criteria, they are then passed to the Wireshark capture engine as shown in Figure 2-7. Note that once the packets are parsed through the capture filter, only the filtered packets are received by the capture engine. The remaining packets are dropped and discarded before being sent to the capture engine.

Users can also create custom cfilters that can be part of the default profile or a custom profile. Let’s now create a custom capture filter for capturing only VXLAN traffic. To filter VXLAN encapsulated traffic, we can simply filter on UDP port 4789. This filter can be created in a few simple steps:

1. 1.

   Go to the Capture menu and select Capture Filters to open the Capture Filters dialog box.

    
2. 2.

   In the Capture Filters dialog box, click the + icon, which will add an entry at the end of the existing default list.

    
3. 3.

   Edit the name of the filter and set it to VXLAN only and then edit the Filter Expression and set it to udp port 4789.

    
4. 4.

   Click OK to save.

    
5. 5.

   Once saved, go to the Capture menu and select Options. This will open the Wireshark Capture Options dialog box.

    
6. 6.

   In this dialog box, click the green bookmark icon next to Capture Filter for Selected Interfaces. This displays the list of all capture filters that are available. Select the VXLAN Only option as shown in Figure 2-8.

    
7. 7.

   Once the interface and capture filter are selected, click Start to start the capture.

    

You will now notice that only the VXLAN packets are being captured in Wireshark. This method of capturing packets has the benefit of capturing only specific traffic, but if the user is unsure about which traffic to capture, it might be a better option to use display filters.

Display Filters

Before moving on to checking different ways of implementing display filters, let’s talk about the syntax for display filters. Wireshark uses a proprietary Wireshark display filter that is different than the capture filter’s BPF format. Even though the syntax for both capture and display filters is different, there are a few examples where the syntax for both of them happens to be the same. For instance, the syntax for filtering TCP traffic on both filters is specifying the tcp keyword. Figure 2-9 illustrates how the packets are filtered after applying the display filter for TCP traffic. Notice that in this example, there are 76 packets that have been identified and filtered for TCP traffic out of 1,452 packets.

Because there is a different set of fields within each header, it is nearly impossible to remember all the fields to create the display filters. Wireshark comes with an auto-complete feature that helps users to create filters. Users are only required to know the top-level header and the Wireshark Intellisense or auto-complete feature kicks in as soon as any character is typed. The Wireshark auto-complete feature displays all the available options within that header that can be used to create the filter. For example, if the user wants to check for any traffic with destination port 53 or DNS traffic, the user can just type in tcp and it will display all the available options. In this case, the option would be tcp.dstport, as shown in Figure 2-10. Once the user identifies the right filter option, he or she can then complete the expression by using the comparison operators. For this example, the display filter is tcp.dstport == 53.

Users are also allowed to select display filters from previously used filters or save their display filter like a capture filter. To use the previously searched display filter, use the drop-down list seen at the end of the display filter bar. To save the current display filter, use the bookmark icon at the beginning of the display filter area, as shown in Figure 2-11. The drop-down list shows the default display filters available as well as other options to save or manage the display filters. Selecting the Save This Filter option opens the Display Filters dialog box. There you can click the + icon to add the current display filter.

Another quick method of filtering the packets is using the right-click filtering method. While navigating through the list of packets, if you come across a packet that looks suspicious or you are interested in checking out similar packets, you can simply right-click the packet or field of interest and select either the Apply as Filter | Selected or the Prepare as Filter | Selected option as shown in Figure 2-12. The Apply as Filter | Selected option directly places the filter on the live traffic or captured packets, whereas the Prepare as Filter | Selected option prepares the display filter and gives the user an option to edit the filter before it is applied on the live traffic or captured packets.

Users can also leverage the Copy | As Filter feature available in Wireshark as part of right-click filtering. This feature allows users to copy the filter expression without applying or listing the filter in the display filter pane. This feature can be very useful for creating complex display filters or for copying filters between different Wireshark instances where we want to trace the packets across multiple capture files.

Although there are many ways of creating display filters, one of the features that really stands out in Wireshark is its ability to catch errors or mistakes in display filters, which prevents users from applying the wrong display filters on the packet captures. The display filter pane turns red and disables the option to apply a filter if there is an incomplete or incorrect display filter expression typed in the pane.

Capture from Multiple Interfaces

The pcap format contains some information about the capture interface but does not have support for multiple interfaces. This is because the interface information is included as part of the common header and not stored on a per-packet basis, making it difficult to capture traffic from multiple interfaces in the same capture file. On the other hand, the pcapng file format supports multiple interfaces by using the interface description block defined in the PCAP Next Generation (pcapng) capture file format IETF draft. Using the interface description block, each packet can be associated with a specific interface. Figure 2-13 displays the interface description block as defined in the IETF draft. Note that the block type of the interface description block is 1 (0x00000001).

When a packet capture is initiated for multiple interfaces, a user can see the packet of each interface in the pcapng file using their interface_id field. Figure 2-14 displays the packets belonging to interface id 1, which in this case is a loopback interface (IP address 127.0.0.1) of the PC itself.

Timestamps

With pcap format, one of the major concerns for network analysts was its resolution on packet timestamps. Each packet in the pcap format has a time resolution accurate to the microsecond level (i.e., 10^-6 seconds), which provides a resolution for 999,999 packets per second. On first look, this number looks reasonable, but with the modern-day networks evolving to 25 Gig, 40 Gig, and 100 Gig links, microsecond-level accuracy can create a huge gap. It is imperative to note that even a common 1 Gig link can easily exceed this link. The pcapng file format provides the capability to adjust the resolution using a flexible timestamp format, which is now expressed as a 64-bit time unit that can easily accommodate evolving network speeds. The default resolution value on packet timestamps is still given in microseconds, but this can be altered by setting the if_tsresol option in the interface description block.

Embedding Comments

Troubleshooting networks can be complex and time consuming and could be further delayed when information is shared across peers or customers. The pcapng format allows the user to embed both top-level and per-packet comments that can be helpful when traces are shared across multiple users for analysis. To add a comment to a packet, select a packet and right-click to choose the Packet Comment option. Once selected, this opens a window that will allow the user to add a comment on the packet, as shown in Figure 2-15.

Once the comment is added, the packet headers will also have a packet comments section added at the top, as shown in Figure 2-16.

To add top-level comments or file-level comments, go to Statistics | Capture File Properties. This opens a window that includes a Capture File Comments section. Users can add the comments and then click Save Comments to save the top-level comments.

Metadata

Additional information is always useful when investigating network issues. Although adding top-level and per-packet comments can be extremely useful, additional information such as the source of the packet capture can be very useful. With pcapng, additional fields such as a description field, OS field, and filter field within the interface description block can provide additional information regarding the capture source.

Extendable Format

Because the pcapng format is standardized and deploys a generic block structure, it allows the format to evolve over time. In pcapng, specific blocks are defined for packets (enhanced packet block or simple packet block) and interfaces (interface description block). Additional information such as metadata can be stored in other optional blocks, such as a name resolution block or interface statistics block. With the options to define experimental blocks and metadata, pcapng allows organizations to develop their own customized yet compatible network analysis tools.

Time

After selecting one of these options, click OK in the edit column pane. Figure 2-21 displays the packet list pane with Time column displayed in UTC date and time option.

Length

In Wireshark, the length column displays the number of bytes captured for that packet. The number of bytes usually corresponds to the raw data bytes listed at the bottom of the Wireshark window. Now, you must be wondering what is so significant about these captured bytes of the packet. The significance is the statistics that can be gathered from these captured bytes. Based on the captured bytes of each packet, users can examine the distribution of lengths across the captured traffic. To do so, users can go to the Statistics menu and select Packet Length. This will open the Packet Lengths window, which displays the statistical information for varied packet lengths and includes the following columns, as shown in Figure 2-22:

• Packet Lengths

• Count

• Average

• Min Val

• Max Val

• Rate (ms)

• Percent

• Burst Rate

• Burst Start

Capture File Properties

Wireshark provides a summarized view of the captured packets in the Capture File Properties dialog box. Users can select Capture File Properties from the Statistics menu. This opens the Capture File Properties dialog box, which shows when the first and the last packets were captured, the device hardware on which the packet was captured, interfaces on which the packets were captured, and statistics from the captured packets as shown in Figure 2-23:

• Packets (total packets captured)

• Time span (total time span for which the capture was running)

• Average pps

• Average packet size in bytes

• Bytes

• Average bytes/second

• Average bits/second

There is other statistical and deep packet analysis that can be done, but those topics are covered in the coming chapters once we have built a more foundational knowledge on troubleshooting issues with different packet types.