Shark SE400 User's Guide download pdf (Page 68)

Chapter 4. Capturing Live Network

Data

4.1. Introduction

Capturing live network data is one of the major features of Wireshark.

The Wireshark capture engine provides the following features:

• Capture from different kinds of network hardware such as Ethernet or 802.11.

• Stop the capture on different triggers such as the amount of captured data, elapsed time, or the

number of packets.

• Simultaneously show decoded packets while Wireshark is capturing.

• Filter packets, reducing the amount of data to be captured. See Section 4.13, “Filtering while

capturing”.

• Save packets in multiple files while doing a long term capture, optionally rotating through a fixed

number of files (a “ringbuffer”). See Section 4.11, “Capture files and file modes”.

• Simultaneously capture from multiple network interfaces.

The capture engine still lacks the following features:

• Stop capturing (or perform some other action) depending on the captured data.

4.2. Prerequisites

Setting up Wireshark to capture packets for the first time can be tricky. A comprehensive guide “How

To setup a Capture” is available at https://wiki.wireshark.org/CaptureSetup.

Here are some common pitfalls:

• You may need special privileges to start a live capture.

• You need to choose the right network interface to capture packet data from.

• You need to capture at the right place in the network to see the traffic you want to see.

If you have any problems setting up your capture environment you should have a look at the guide

mentioned above.

4.3. Start Capturing

The following methods can be used to start capturing packets with Wireshark:

• You can double-click on an interface in the main window.

• You can get an overview of the available interfaces using the “Capture Interfaces” dialog box

(Capture → Options…). See Figure 4.1, “The “Capture Interfaces” dialog box on Microsoft

1 2 ... 63 64 65 66 67 68 69 70 71 72 73 ... 227 228

No comments

Shark SE400 User's Guide Page 68