O'Reilly logo

Practical Windows Forensics by Konstantin Sapronov, Ayman Shaaban

Stay ahead with the world's most comprehensive technology and business learning platform.

With Safari, you learn the way you learn best. Get unlimited access to videos, live online training, learning paths, books, tutorials, and more.

Start Free Trial

No credit card required

Using WireShark

WireShark is used to address various issues that are related to the functioning of the network by network administrators, but it also plays an invaluable role in cases of network traffic analysis in investigations of incidents.

The WireShark interface can be divided into three main parts.

The upper part displays the list of packages. Each package information is available. By default, the packet number, timestamp, source, and destination address, protocol, packet length, and special protocols for different information.

The middle section displays detailed information about the package, which is selected in the upper part.

The bottom window displays the individual bytes package to hex and ASCII formats such as conclusions team tcpdump, ...

With Safari, you learn the way you learn best. Get unlimited access to videos, live online training, learning paths, books, interactive tutorials, and more.

Start Free Trial

No credit card required