Wireshark is a network traffic (packet) analyzer that is used for troubleshooting network issues and debugging applications at the network layer. With Wireshark you can usually isolate the device or communication link responsible for abnormal behavior in a network-based application.
The following are some of Wireshark's more useful tools for developers looking to get close inspection on network communications and data/packet movement:
Search for strings in packets: frame contains "local"
Display Filter reference: https://wiki.wireshark.org/DisplayFilters
Display Filter with Regex: frame matches "[B@]\w+" && frame.len < 55
Analyze existing pcaps: https://www.netresec.com/?page=PcapFiles
Follow Streams: Right-click packet and select "Follow" to isolate conversations.
Filler for only your IP: Filter only your local IP for src or dest to isolate your machine's traffic if you are on a switch.
Bad TCP setup: https://www.davidsudjiman.info/2018/02/08/capturing-bad-tcp-packets/
Wireshark's UI can tell you a plethora of information about packets and their relationships; the key is isolate the WS info you need to solve your specific problem
The following are some of Wireshark's more useful tools for developers looking to get close inspection on network communications and data/packet movement:
Search for strings in packets: frame contains "local"
Display Filter reference: https://wiki.wireshark.org/DisplayFilters
Display Filter with Regex: frame matches "[B@]\w+" && frame.len < 55
Analyze existing pcaps: https://www.netresec.com/?page=PcapFiles
Follow Streams: Right-click packet and select "Follow" to isolate conversations.
Filler for only your IP: Filter only your local IP for src or dest to isolate your machine's traffic if you are on a switch.
Bad TCP setup: https://www.davidsudjiman.info/2018/02/08/capturing-bad-tcp-packets/
