Tony Fortunato is a Senior Network Specialist with experience in design, implementation, and troubleshooting of LAN/WAN/Wireless networks, desktops and servers since 1989. His background in financial networks includes design and implementation of trading floor networks. Tony has taught at local high schools, Colleges/Universities, Networld/Interop and many onsite private classroom settings to thousands of analysts.

1. Quickstart – Setting up Wireshark and rpcapd for remote capture Tony Fortunato, Sr Network Specialist The Technology Firm

3. rpcapd help screen C:rogram FilesinPcap>rpcapd –h USAGE: rpcapd [-b <address>] [-p <port>] [-6] [-l <host_list>] [-a <host,port>] [-n] [-v] [-d] [-s <file>] [-f <file>] -b <address>: the address to bind to (either numeric or literal). Default: it binds to all local IPv4 addresses -p <port>: the port to bind to. Default: it binds to port 2002 -4: use only IPv4 (default both IPv4 and IPv6 waiting sockets are used) -l <host_list>: a file that keeps the list of the hosts which are allowed to connect to this server (if more than one, list them one per line). We suggest to use literal names (instead of numeric ones) in order to avoid problems with different address families -n: permit NULL authentication (usually used with '-l') -a <host,port>: run in active mode when connecting to 'host' on port 'port' In case 'port' is omitted, the default port (2003) is used -v: run in active mode only (default: if '-a' is specified, it accepts passive connections as well -d: run in daemon mode (UNIX only) or as a service (Win32 only) Warning (Win32): this switch is provided automatically when the service is started from the control panel -s <file>: save the current configuration to file -f <file>: load the current configuration from file; all the switches specified from the command line are ignored -h: print this help screen

7. rpcap Training - QuickStart Tony Fortunato, Sr Network Specialist The Technology Firm Thank you