Difference between revisions of "How to capture packets using wireshark"

From Kolmisoft Wiki
Jump to navigationJump to search
Line 16: Line 16:
  tethereal -i eth0 -w /home/capture.pcap
  tethereal -i eth0 -w /home/capture.pcap


To save a dump of packets.
To save a dump of packets please stop capturing by pressing ctrl+c


Packets will be saved to directory /home/capture.pcap
Packets will be saved to directory /home/capture.pcap

Revision as of 07:23, 15 May 2013



About

Wireshark is the world's foremost network protocol analyzer. It let you capture and interactively browse the traffic running on a computer network. More information about Wireshark can be found here

Install

To install Wireshark put this command to Terminal:

yum -y install wireshark



Usage

After that you can use command:

tethereal -i eth0 -w /home/capture.pcap

To save a dump of packets please stop capturing by pressing ctrl+c

Packets will be saved to directory /home/capture.pcap

You can send captured file capture.pcap from your server and open with Wireshark GUI and analyse the packets.

You can analyse network packets on real time on server using command:

tshark

More options with command tshark you can find here.