1.
bnatarajan5@gmail.com 1
Wireshark
By
Balasubramaniam Natarajan

2.
bnatarajan5@gmail.com 2
What's Wireshark
● It is a GUI tool which runs on many OS and
helps to look at network traffic.

3.
bnatarajan5@gmail.com 3
Filters
ip.addr == 192.168.1.30 http or dns
ip.addr == 192.168.1.4 && ip.addr ==
192.168.1.30
udp contains 57:68:65
udp contains debian
tcp.flags.reset==1 http.request
tcp.port==80 !(arp or icmp or dns)
tcp contains pscp
tcp.analysis.retransmission
tcp.analysis.duplicate_ack
tcp.ack == 737527 || tcp.seq == 737527
tcp.seq == 166359 || tcp.ack == 166359

4.
bnatarajan5@gmail.com 4
● All pcap were taken from here for practice
● https://wiki.wireshark.org/SampleCaptures#Sample_Captures
● dns-remoteshell.pcap
● http://bullet-bala.blogspot.in/2010/09/four-stages-of-dhcp-capture-by.html
● dhcp.pcapng
● telnet-cooked.pcap
Examples Pcap

5.
bnatarajan5@gmail.com 5
ACL Creation
● Tool > Firewall ACL
● Statistics > Conversation
●