User manual WIRESHARK WIRESHARK 1.4 34391

[. . . ] Wireshark User's Guide 34391 for Wireshark 1. 4 Ulf Lamping, Richard Sharpe, NS Computer Software and Services P/L Ed Warnicke, Wireshark User's Guide: 34391 for Wireshark 1. 4 by Ulf Lamping, Richard Sharpe, and Ed Warnicke Copyright © 2004-2010 Ulf Lamping , Richard Sharpe , Ed Warnicke Permission is granted to copy, distribute and/or modify this document under the terms of the GNU General Public License, Version 2 or any later version published by the Free Software Foundation. All logos and trademarks in this document are property of their respective owner. Preface . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . Foreword . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . [. . . ] Close: Close this dialog box, leaving the current display filter in effect. You can choose to view the data in one of the following formats: 1. ASCII: In this view you see the data from each direction in ASCII. Obviously best for ASCII based protocols, e. g. EBCDIC: For the big-iron freaks out there. HEX Dump: This allows you to see all the data. This will require a lot of screen space and is best used with binary protocols. C Arrays: This allows you to import the stream data into your own C program. Raw: This allows you to load the unaltered stream data into a different program for further examination. The display will look the same as the ASCII setting, but "Save As" will result in a binary file. 7. 3. Expert Infos The expert infos is a kind of log of the anomalies found by Wireshark in a capture file. The general idea behind the following "Expert Info" is to have a better display of "uncommon" or just notable network behaviour. This way, both novice and expert users will hopefully find probable network problems a lot faster, compared to scanning the packet list "manually" . Expert infos are only a hint! Take expert infos as a hint what's worth looking at, but not more. For example: The absence of expert infos doesn't necessarily mean everything is ok! The amount of expert infos largely depends on the protocol being used! While some common protocols like TCP/IP will show detailed expert infos, most other protocols currently won't show any expert infos at all. 100 Advanced Topics The following will first describe the components of a single expert info, then the User Interface. 7. 3. 1. Expert Info Entries Each expert info will contain the following things which will be described in detail below: Table 7. 1. Some example expert infos Packet # 1 2 8 9 Severity Note Chat Note Warn Group Sequence Sequence Sequence Sequence Protocol TCP TCP TCP TCP Summary Duplicate ACK (#1) Connection reset (RST) Keep-Alive Fast retransmission (suspected) 7. 3. 1. 1. Severity Every expert info has a specific severity level. The following severity levels are used, in parentheses are the colors in which the items will be marked in the GUI: · Chat (grey): information about usual workflow, e. g. a TCP packet with the SYN flag set · Note (cyan): notable things, e. g. an application returned an "usual" error code like HTTP 404 · Warn (yellow): warning, e. g. application returned an "unusual" error code like a connection problem · Error (red): serious problem, e. g. Group There are some common groups of expert infos. [. . . ] If the Program specifies a version number of this License which applies to it and "any later version", you have the option of following the terms and conditions either of that version or of any later version published by the Free Software Foundation. If the Program does not specify a version number of this License, you may choose any version ever published by the Free Software Foundation. If you wish to incorporate parts of the Program into other free programs whose distribution conditions are different, write to the author to ask for permission. For software which is copyrighted by the Free 215 This Document's License (GPL) Software Foundation, write to the Free Software Foundation; we sometimes make exceptions for this. [. . . ]