Filters in Wireshark – It can isolate and show all the different components that are present in a packet and filter out, just the keywords that we want to analyze or something that we are sure is a threat to the network.Therefore Wireshark comes with certain features that would help to further narrow down the process and make it easier to protect the network from attacks. Another such tool is tcpdump but it runs on command line interface hence Wireshark is preferred more which is based on the graphical interface and is open source i.e., free of cost.īut even if the incoming data and outgoing data is recorded and observed it is very difficult to identify and pinpoint each and every communication between servers and then in turn identifying the threats and malicious attacks becomes a tedious job like finding a needle in a haystack. This data analysis could be easily done if there was any tool for capturing both the incoming and outgoing data and Wireshark is such a tool that helps to capture and observe the incoming and outgoing data. The second aspect is to diagnose a network in case of an attack.The first aspect is that we can know the state of the network whether it is built in such a way that an attack is possible or not.If a big institution is connected with each other through a network then again the analysis becomes important for the above-mentioned reasons and to gain certain other information like where a major chunk of data is utilized and why this helps the network engineers to clean up the network.Īnother reason for analyzing data packets can be understood in two aspects:. This network traffic analysis would give us a number of information like – the destination and source of communication, amount of data transferred, location of the destination server, any ongoing attacks on the server, and much more that is why a continuous monitoring of the network becomes important. Even though these data is accessed as a whole at both the source and the destination but this data is not sent across the internet as a whole, these are sent separately as different characters or as small packages known as packets, these packets when received at the destination is reassembled in the form of your originally intended message and because there would exchange of a large number of packets via the network there would resulting traffic and this is known as N etwork Traffic.

Wireshark linux time to live