Reviewing IPv4 preferences

To modify IPv4 preferences, you can use one of the methods listed previously, or you can right-click while on the header and select Protocol Preferences, and then select the Open Internet Protocol Version 4 preferences... shortcut, as shown here:

 IPv4 preference shortcut

Once you select the shortcut, a list of preferences will be listed, as shown in the following screenshot:

 IPv4 preferences

Once there, you can modify the selections as follows:

  • Decode IPv4 TOS field as DiffServ field: RFC 791 used TOS to classify traffic. Over time, this field was modified to identify traffic using DiffServ, which allows for a wider range of classification. In most cases, this should be enabled.
  • Reassemble fragmented IP datagrams: When necessary, IPv4 packets may be fragmented. When enabled, this will reassemble fragmented IP datagrams.
  • Show IPv4 summary in protocol tree: When enabled, this summarizes the header contents. For a large capture, enabling this may impact performance.
  • Validate the IPv4 checksum if possible: In most cases, this is not enabled.
  • Support packet-capture from IP TSO-enabled hardware: TCP Segmentation Offload (TSO) is a performance-boosting technique used in a virtualized environment. When used, the packet length may be inaccurate. Enabling this option will attempt to correct any errors.
  • Enable IPv4 geolocation: Wireshark uses the IP addresses to identify packet origin using the GeoIP databases. Select if you want to use this option.
  • Interpret Reserved flag as Security flag (RFC 3514): On April 1, 2003 (April Fool's Day), Steven M. Bellovin wrote an RFC that the reserved bit in the IP header should be used by malicious actors to flag the packet if it contains malware, so that IDS and firewalls will know it contains malware. If used, the bit is called the evil bit.
  • Try heuristic sub-dissectors first: This option helps Wireshark attempt to identify what type of application is used by using the port number to properly dissect the packet.
  • IPv4 UDP port: Use this option if you want to change the protocol behavior to a specific port, when used on the LAN.

For any of the options that make a change to the default values, caution is advised, as what you enter may stick and will not allow you to undo the option without a reinstall.

As you can see, there are many ways to customize the preferences for IPv4. Next, let's take a look at the options for IPv6.

..................Content has been hidden....................

You can't read the all page of ebook, please click here login for view all page.
Reset
13.58.51.36