WIRESHARK - Packet Sniffer and Analysis Tools

Wireshark is open source network protocol analysis software program started by Gerald Combs in 1998. A global organization of network specialists and software developers and support Wireshark and continues to make updates for new network technologies and encryption methods.

It is world's foremost network protocol analyzer. Its let you see what is happening at microscopic level.Orginally named Ethereal and renamed Wireshark in May 2006 due to trademark issues.

Wireshark has a special feature set which includes following:

Wireshark is a data capturing programs that understands the structure of different networking protocols. It can parse and display the fields , along with their meaningful as specified by different networking protocols.

1. Live capture and offline analysis.
2. Multi platforms:-runs on windows, Linux, OS X and many others.
3. Standard three-pane packet browser.
4. The most powerful display filters in the industry.
5. Rich VoIP analysis.

Security:

Capturing raw network traffic from an interface requires elevated privileges on some platform. Considering the huge numbers of protocols dissectors they are called when traffic is captured and recognizing the possibility of a bug dissectors, a serious security risked can be posed. Due to rather large numbers of vulnerabilities in the past and developers doubt for better future of development.

Wireshark is packet sniffer and analysis tools.It captures network traffic on local network and stores that data for offline analysis. Wireshark captures network traffic from Ethernet, Bluetooth and many more.

Wireshark allows you to filter a log either before the capture starts or during analysis, so you can narrow down and zero into what you are looking for the network trace.

Wireshark Commands:

Wire shark provides command line interface if you operate a system without a GUI.

Wireshark: - Runs Wireshark on GUI mode
Wireshark-h: - Show available commands line parameters.

Capturing Data On Wireshark:

When you open Wireshark, you see a screen that shows you a list of all of the network connections you can monitor. You also have a capture filter field, so you only capture the network traffic you want to see.

You can select one or more of the network interfaces using "shift left-click". Once you have the network interface selected, you can start the capture, and there are several ways to do that.

Click the first button on the toolbar, titled "Start Capturing Packets".

You can select the menu item Capture -> Start.

Or you could use the keystroke Control – E.

During the capture, Wireshark will show you the packets that it captures in real-time.

Once you have captured all the packets you need, you use the same buttons or menu options to stop the capture.

Best practice says that you should stop Wireshark packet capture before you do analysis.

Installation:

Downloading and installing Wireshark is easy. Step one to check the offical page of Wireshark download page for operating system you need and the basic version of Wireshark is free.
https://www.wireshark.org/download.html

For more tools information link given below:- https://www.isoeh.com/tools.html