2 ms·

Do you have any favorite sources for really understanding Wireshark? I’m not a networking professional per se, but I’m network-adjacent and I’ve dabbled in Wire

Do you have any favorite sources for really understanding Wireshark? I’m not a networking professional per se, but I’m network-adjacent and I’ve dabbled in Wireshark from time to time. I can see the power, but it’s also one of those tools that’s totally overwhelming when I first approach it unless I have a very small, very specific problem. Or is it one of those tools that you learn as you need it?

baby_souffle 3y ago
There’s a million little features and tricks you can do but you’ll never stumble into them unless you’re actively googleing “how do I …”. You might look for some pcap based CTFs with walkthroughs to get exposure to some of the more unique things you can do. Just letting it run for a few min on your router and then powering a device up can also yield some interesting captures…
wolrah 3y ago
Unfortunately I can't really help there, I'm a "learn by doing" type of person who just jumps in the deep end and hopes he figures out how to swim. Most of my learning was just "capture the problem happening, capture what happens when it works right if possible, open up the relevant RFCs, then try to understand what's different and why. I work in the VoIP industry so I'm dealing with a lot of NAT problems (insert rant here about lazy ISPs that still haven't enabled IPv6 on their networks) and my main protocol (SIP) is heavily inspired by HTTP and as a result is more or less human readable plaintext, so it was a relatively easy learning curve to just have Wireshark open on one side of the screen and the relevant RFCs on the other side. All I can really say is have a problem you want to solve and start from there.
- el_benhameen 3y ago
  Sounds reasonable to me, thanks. That’s how I always end up learning, but sometimes I wonder if there’s a better way.

2 ms·

Do you have any favorite sources for really understanding Wireshark? I’m not a networking professional per se, but I’m network-adjacent and I’ve dabbled in Wire

by el_benhameen 3y ago

baby_souffle 3y ago
There’s a million little features and tricks you can do but you’ll never stumble into them unless you’re actively googleing “how do I …”. You might look for some pcap based CTFs with walkthroughs to get exposure to some of the more unique things you can do. Just letting it run for a few min on your router and then powering a device up can also yield some interesting captures…
wolrah 3y ago
Unfortunately I can't really help there, I'm a "learn by doing" type of person who just jumps in the deep end and hopes he figures out how to swim. Most of my learning was just "capture the problem happening, capture what happens when it works right if possible, open up the relevant RFCs, then try to understand what's different and why. I work in the VoIP industry so I'm dealing with a lot of NAT problems (insert rant here about lazy ISPs that still haven't enabled IPv6 on their networks) and my main protocol (SIP) is heavily inspired by HTTP and as a result is more or less human readable plaintext, so it was a relatively easy learning curve to just have Wireshark open on one side of the screen and the relevant RFCs on the other side. All I can really say is have a problem you want to solve and start from there.
- el_benhameen 3y ago
  Sounds reasonable to me, thanks. That’s how I always end up learning, but sometimes I wonder if there’s a better way.