Protocols

Our next category is Protocols, and when you expand the Protocols category, you have a huge list of all the protocols supported by Wireshark, and all of their associated configuration options that you can tweak.

Now, most of these you can leave alone at their defaults and everything will work just fine. There are two that you're probably going to want to tweak at some point in your career, and that'll be IP and TCP; or three if you count IPv6 now. IPv4, IPv6, and TCP are probably the most common ones that you're going to adjust, if you adjust them at all. What we'll do is, we'll go to IPv4, and you'll see there's a checkbox called Validate the IPv4 checksum if possible that's actually disabled by default:

Now this used to be enabled by default, so depending on the version of Wireshark you're running, if you are not using the latest version of 2.0, the Validate the IPv4 checksum if possible would potentially be enabled. When that is done, it would sometimes show up based on your system with a whole lot of bad checksum errors. The reason for this is that a lot of newer systems, especially servers, have been starting to do checksum offloading where the software does not do the checksum creation but the hardware does, right before it gets sent onto the wire. But Wireshark didn't see that, so it always thought that the checksum didn't match because it couldn't see the hardware creating the checksum as it got put onto the wire. This is one thing to go into check as you most likely will want to have Validate the IPv4 checksum if possible off nowadays due to most network cards doing checksum offloading.

..................Content has been hidden....................

You can't read the all page of ebook, please click here login for view all page.
Reset
3.133.147.252