Tips and tutorials for Wireshark?

I'd like to try and gather any times and tutorials on using Wireshark. It is a highly recommended tool for a lot of ethernet troubleshooting here but looks like it has a rather sharp learning curve.

Thanks,

E

Wireshark is actually quite easy to use. To start just select the adapter to use and click the green shark fin to start the capture.

Filtering can be a little more tricky. It follows C++ patterns. For example to filter on a specific IP address:

IP.addr==192.168.0.1

You don't even need to know the C++ patterns. Highlight a packet that you want or don't want to see. In the lower panel drill down and select what is unique about that packet that you want to filter on like port number, source IP, source MAC, type (ARP, NetBIOS, etc), etc... Right click on that portion of the packet and select "Selected" in the menu if you want to see only packets of that type or "Not Selected" if you want to remove all packets of that type. If that didn't filter enough for you, you can add to the filter by right clicking and choosing "and Not Selected" or "and Selected"

Laura Chappell's website and books are outstanding ways to learn about TCP/IP and how to analyze networks with Wireshark.

http://www.wiresharktraining.com/

I have her Wireshark 101 book and turn to it often when I'm doing network analysis.

http://www.lovemytool.com/

Yes, it's safe for work.

I find in nearly all cases when someone says 'I want to learn Wireshark' what they really want to learn is Ethernet and TCP/IP. Wireshark is straightforward to use as a tool, but the value is in interpreting what the tool gives you, and drawing the correct conclusions. So I usually recommend

http://books.google.com/books/about/TCP_IP_Illustrated_Volume_1.html?id=a23OAn5i8R0C

The first edition is actually better than the second - Stevens died a number of years ago and the second addition is a rework with a different author. Work through this book with Wireshark at your side and you will be a very advanced Wireshark user. You will also have excellent network skills.