L16
Wireshark and packet analysis from zero
Cram this first — memory hook
Request, reply, timing: find the conversation before guessing the cause.
Exam trap
No packet in your capture does not prove no packet existed elsewhere. Observation point, capture filters and capture loss affect what you see.
The slide facts
Packet capture records network conversations. Wireshark provides graphical analysis; tcpdump provides command-line capture. The troubleshooting slide follows Domain Name System , Dynamic Host Configuration Protocol , Transmission Control Protocol setup and retransmissions.
If you have time — extra
A capture is a record of packets visible at the observation point. Wireshark lets you inspect their times, endpoints, protocols, flags and decoded fields. Domain Name System () resolves names; Dynamic Host Configuration Protocol () supplies address settings; Transmission Control Protocol () sets up an ordered connection with SYN, SYN/ACK, ACK: synchronize, synchronize/acknowledge, acknowledge. A capture filter decides what gets collected; a display filter hides/shows packets already collected without deleting them. Examples of display filters are dns, arp, tcp.port == 443, udp.port == 53, ip.addr == 192.0.2.10 and tcp.analysis.retransmission. A capture expression such as port 53 uses a different syntax. Retransmissions are clues to lost data or acknowledgments and capture conditions; they do not prove one unique faulty cable. Ordinary encrypted Hypertext Transfer Protocol Secure content cannot be read merely by opening the capture.
Walkthrough
Capture at a useful authorized point, reproduce the issue, stop recording, filter to the relevant conversation, identify request/reply order, compare timestamps, and look for missing responses, resets or repeated transmissions. Test the suspected cause using additional evidence.