Wireshark - Revision history

NKirnbauer: /* References */

2024-11-22T22:36:55Z

References

← Older revision		Revision as of 22:36, 22 November 2024
Line 176:		Line 176:
	* Comparative study of two most popular packet sniffing tools-Tcpdump and Wireshark - https://ieeexplore.ieee.org/document/8319360/		* Comparative study of two most popular packet sniffing tools-Tcpdump and Wireshark - https://ieeexplore.ieee.org/document/8319360/
	* Packet tracing and analysis of network cameras with Wireshark - https://ieeexplore.ieee.org/document/7916510/		* Packet tracing and analysis of network cameras with Wireshark - https://ieeexplore.ieee.org/document/7916510/
	* Network Traffic Monitoring and Analysis Using Packet Sniffer -		* Network Traffic Monitoring and Analysis Using Packet Sniffer - https://ieeexplore.ieee.org/document/8742369/
	https://ieeexplore.ieee.org/document/8742369/		* P. Goyal and A. Goyal, "Comparative study of two most popular packet sniffing tools-Tcpdump and Wireshark," 2017 9th International Conference on Computational Intelligence and Communication Networks (CICN), Girne, Northern Cyprus, 2017, pp. 77-81, doi: 10.1109/CICN.2017.8319360
	* P. Goyal and A. Goyal, "Comparative study of two most popular packet sniffing tools-Tcpdump and Wireshark," 2017 9th International Conference on Computational Intelligence and Communication Networks (CICN), Girne, Northern Cyprus, 2017, pp. 77-81, doi: 10.1109/CICN.2017.8319360~~. keywords: {Tools;Monitoring;Batteries;Protocols;Memory management;Computer hacking;Sensors;Packet Sniffer;Promiscuous mode;Wireshark;Tcpdump;Monitor mode;Network sensing},~~
	* OWASP. Wireshark basics. in: OWASP.org, 2019.- https://owasp.org/www-pdf-archive//Owaspwireshark.pdf, Accessed: 2022-09-14.		* OWASP. Wireshark basics. in: OWASP.org, 2019.- https://owasp.org/www-pdf-archive//Owaspwireshark.pdf, Accessed: 2022-09-14.


	[[Category:Documentation]]		[[Category:Documentation]]

NKirnbauer: reference fix

2024-11-22T22:35:04Z

reference fix

← Older revision		Revision as of 22:35, 22 November 2024
Line 178:		Line 178:
	* Network Traffic Monitoring and Analysis Using Packet Sniffer -		* Network Traffic Monitoring and Analysis Using Packet Sniffer -
	https://ieeexplore.ieee.org/document/8742369/		https://ieeexplore.ieee.org/document/8742369/
	* ~~Piyush~~ Goyal and ~~Anurag~~ Goyal. Comparative study of two most popular packet sniffing tools-~~tcpdump~~ and ~~wireshark. in: IEEExplore-1ieee.org~~, 2017.- ~~https~~:/~~/ieeexplore-1ieee-1org-1tn53mdiy09fc~~.~~han~~.~~fh-campuswien~~.~~ac.at/document/8319360~~, ~~Accessed: 2022-09-14.~~		* P. Goyal and A. Goyal, "Comparative study of two most popular packet sniffing tools-Tcpdump and Wireshark," 2017 9th International Conference on Computational Intelligence and Communication Networks (CICN), Girne, Northern Cyprus, 2017, pp. 77-81, doi: 10.1109/CICN.2017.8319360. keywords: {Tools;Monitoring;Batteries;Protocols;Memory management;Computer hacking;Sensors;Packet Sniffer;Promiscuous mode;Wireshark;Tcpdump;Monitor mode;Network sensing},
	* OWASP. Wireshark basics. in: OWASP.org, 2019.- https://owasp.org/www-pdf-archive//Owaspwireshark.pdf, Accessed: 2022-09-14.		* OWASP. Wireshark basics. in: OWASP.org, 2019.- https://owasp.org/www-pdf-archive//Owaspwireshark.pdf, Accessed: 2022-09-14.


	[[Category:Documentation]]		[[Category:Documentation]]

NKirnbauer: gendering

2024-10-07T17:40:48Z

gendering

← Older revision		Revision as of 17:40, 7 October 2024
Line 157:		Line 157:
	In terms of needed resources, Tcpdump is much more undemanding compared to Wireshark. Wireshark needs ten times more memory and hundreds of times more energy than Tcpdump. However, it should be noted that Wireshark accesses the processor much more often, has more wakeups, which leads to more accurate and up-to-date data, but requires more resources		In terms of needed resources, Tcpdump is much more undemanding compared to Wireshark. Wireshark needs ten times more memory and hundreds of times more energy than Tcpdump. However, it should be noted that Wireshark accesses the processor much more often, has more wakeups, which leads to more accurate and up-to-date data, but requires more resources

	'''Wireshark''' offers a graphical user interface and colouring of different protocols with different color schemes (Packet Colorization). Tcpdump, on the other hand, does not distinguish between different packet types, i.e. the user must classify the individual packets ~~himself~~. It's also very easy to apply different filters to captured traffic.		'''Wireshark''' offers a graphical user interface and colouring of different protocols with different color schemes (Packet Colorization). Tcpdump, on the other hand, does not distinguish between different packet types, i.e. the user must classify the individual packets themself. It's also very easy to apply different filters to captured traffic.
	Wireshark can save dumps in different files, like ring buffer, while Tcpdump can write one file only. As stated before, it can show current traffic statistics, which Tcpdump can't.		Wireshark can save dumps in different files, like ring buffer, while Tcpdump can write one file only. As stated before, it can show current traffic statistics, which Tcpdump can't.
	Also Wireshark is 2-3% faster at capturing traffic. This can make a difference at high data rates. The biggest advantage of Wireshark is the flexibility in terms on analyzing and saving dumps. This can be changed in Wireshark after the capturing (= in real time), while in Tcpdump everything has to be specified before you start capturing and can't be changed afterwards.		Also Wireshark is 2-3% faster at capturing traffic. This can make a difference at high data rates. The biggest advantage of Wireshark is the flexibility in terms on analyzing and saving dumps. This can be changed in Wireshark after the capturing (= in real time), while in Tcpdump everything has to be specified before you start capturing and can't be changed afterwards.

SAbou: /* USBPcap */

2023-01-09T00:08:53Z

USBPcap

← Older revision		Revision as of 00:08, 9 January 2023
Line 101:		Line 101:
	packets are exchanged (request-response) to couple the keyboard to the computer. After		packets are exchanged (request-response) to couple the keyboard to the computer. After
	the keyboard has been successfully coupled, a few letters are entered into the keyboard.		the keyboard has been successfully coupled, a few letters are entered into the keyboard.
	These inputs can be seen under ”URB INTERRUPT in”- IN means from device to host, OUT means from host to device. Under the column Protocol, you can see that the protocol ~~used~~ is USB.		These inputs can be seen under ”URB INTERRUPT in”- IN means from device to host, OUT means from host to device. Under the column Protocol, you can see that the used protocol is USB.
	[[File:Wireshark_USBPcapInstall.jpg\|thumb\|USBPcap_installation]]		[[File:Wireshark_USBPcapInstall.jpg\|thumb\|USBPcap_installation]]

SAbou: /* USBPcap */

2023-01-09T00:07:54Z

USBPcap

← Older revision		Revision as of 00:07, 9 January 2023
Line 101:		Line 101:
	packets are exchanged (request-response) to couple the keyboard to the computer. After		packets are exchanged (request-response) to couple the keyboard to the computer. After
	the keyboard has been successfully coupled, a few letters are entered into the keyboard.		the keyboard has been successfully coupled, a few letters are entered into the keyboard.
	These inputs can be seen under ”URB INTERRUPT in”. IN means from device to host, OUT means from host to device. Under the column Protocol, you can see that the protocol used is USB.		These inputs can be seen under ”URB INTERRUPT in”- IN means from device to host, OUT means from host to device. Under the column Protocol, you can see that the protocol used is USB.
	[[File:Wireshark_USBPcapInstall.jpg\|thumb\|USBPcap_installation]]		[[File:Wireshark_USBPcapInstall.jpg\|thumb\|USBPcap_installation]]

SAbou: /* USBPcap */

2023-01-09T00:07:11Z

USBPcap

← Older revision		Revision as of 00:07, 9 January 2023
Line 101:		Line 101:
	packets are exchanged (request-response) to couple the keyboard to the computer. After		packets are exchanged (request-response) to couple the keyboard to the computer. After
	the keyboard has been successfully coupled, a few letters are entered into the keyboard.		the keyboard has been successfully coupled, a few letters are entered into the keyboard.
	These inputs can be seen under ”URB INTERRUPT in” ~~(USB Request Blocks)~~. IN means from device to host, OUT means from host to device. Under the column Protocol, you can see that the protocol used is USB.		These inputs can be seen under ”URB INTERRUPT in”. IN means from device to host, OUT means from host to device. Under the column Protocol, you can see that the protocol used is USB.
	[[File:Wireshark_USBPcapInstall.jpg\|thumb\|USBPcap_installation]]		[[File:Wireshark_USBPcapInstall.jpg\|thumb\|USBPcap_installation]]

SAbou at 00:06, 9 January 2023

2023-01-09T00:06:22Z

← Older revision		Revision as of 00:06, 9 January 2023
Line 101:		Line 101:
	packets are exchanged (request-response) to couple the keyboard to the computer. After		packets are exchanged (request-response) to couple the keyboard to the computer. After
	the keyboard has been successfully coupled, a few letters are entered into the keyboard.		the keyboard has been successfully coupled, a few letters are entered into the keyboard.
	These inputs can be seen under ”URB INTERRUPT in” (USB Request Blocks). Under		These inputs can be seen under ”URB INTERRUPT in” (USB Request Blocks). IN means from device to host, OUT means from host to device. Under the column Protocol, you can see that the protocol used is USB.
	the column Protocol, you can see that the protocol used is USB.
	[[File:Wireshark_USBPcapInstall.jpg\|thumb\|USBPcap_installation]]		[[File:Wireshark_USBPcapInstall.jpg\|thumb\|USBPcap_installation]]

SAbou: /* USBPcap */

2023-01-08T23:50:41Z

USBPcap

← Older revision		Revision as of 23:50, 8 January 2023
Line 107:		Line 107:

	'''Side Note:'''		'''Side Note:'''
	If you already have Wireshark installed but you are missing USBPcap and you are ready now, you can easily install it afterwards as shown in the following Figure.		If you already have Wireshark installed but you are missing USBPcap and you are ready now, you can easily install it afterwards as shown in the following Figure (USBPcap_installation).

	'''Limits of USBPcap:'''		'''Limits of USBPcap:'''

SAbou: /* USBPcap */

2023-01-08T23:50:04Z

USBPcap

← Older revision		Revision as of 23:50, 8 January 2023
Line 108:		Line 108:
	'''Side Note:'''		'''Side Note:'''
	If you already have Wireshark installed but you are missing USBPcap and you are ready now, you can easily install it afterwards as shown in the following Figure.		If you already have Wireshark installed but you are missing USBPcap and you are ready now, you can easily install it afterwards as shown in the following Figure.

			'''Limits of USBPcap:'''
			With USBPcap you only see the USB control transmission sent to the device after the device has been assigned its address.
			This means exactly, that only URBs passed between functional device object (FDO) and physical device object (PDO) can be captured.

			Bus states (Suspended, Power ON, Power OFF, Reset, High Speed Detection Handshake), Packet ID (PID), duration of bus state and time used to transfer packet over the wire and Transfer speed (Low Speed, Full Speed, High Speed) are information you can only get when using hardware USB sniffer.

	=== Not so well known Features ===		=== Not so well known Features ===

SAbou: /* USBPcap */

2023-01-08T23:37:34Z

USBPcap

← Older revision		Revision as of 23:37, 8 January 2023
Line 91:		Line 91:

	=== USBPcap ===		=== USBPcap ===
	USBPcap is a product of Wireshark that allows sniffing USB traffic.		USBPcap is a product of Wireshark that allows sniffing USB traffic.
			It captures data from USB request blocks (URBs), which are transmitted in I/O request packets (IRP). These packets are then represented as frames.
			Note: the packets and frames of USBPcap do not conform to the USB specifications and therefore differ.

	[[File:USBPcap.jpg\|thumb\|USBPcap packet list window]]		[[File:USBPcap.jpg\|thumb\|USBPcap packet list window]]
Line 106:		Line 108:
	'''Side Note:'''		'''Side Note:'''
	If you already have Wireshark installed but you are missing USBPcap and you are ready now, you can easily install it afterwards as shown in the following Figure.		If you already have Wireshark installed but you are missing USBPcap and you are ready now, you can easily install it afterwards as shown in the following Figure.












	=== Not so well known Features ===		=== Not so well known Features ===