Unix-based command-line tool used to intercept packets Including filtering to just the packets of interest Tshark Tcpdump-like capture program that comes w/ Wireshark Very similar behavior & flags to tcpdump Wireshark GUI for displaying tcpdump/tshark packet tracesĥ Tcpdump example Ran tcpdump on a Unix machineįirst few lines of the output: 01:46: IP danjo.CS. > adsl .2481: : (1380) ack win 12816 01:46: IP danjo.CS. > adsl .2481: P 1380:2128(748) ack 6 01:46: IP danjo.CS. > adsl .2481: :3508(1380) ack 6 01:46: IP adsl .2481 > danjo.CS.: P 1:49(48) ack 130 Cliff ZouĢ Acknowledgement uctfiles/672/wireshark.ppt UC Berkley course “EE 122: Intro to Communication Networks” ee122/presentations/Wireshark.ppt Other resources:Įssential for Network Management Router and Firewall policy Detecting abnormal/error in networking Access control Security Management Detecting abnormal traffic Traffic log for future forensic analysisĤ Tools Overview Tcpdump Tshark Wireshark Presentation on theme: 'Traffic Analysis– Wireshark'- Presentation transcript:ĬIS 6395, Incident Response Technologies Fall 2016, Dr.

Malware traffic analysis wireshark