Wireshark: analyze network protocols more easily using a reference file Overview Routing protocols IPv6- Crash course unencrypted Outlook Article in c’t 24/2020 read If you have to check the network traffic for communication errors, you need plenty of patience when analyzing packet recordings (traces). Expired certificates, incompatibilities due to different versions, incorrect implementations, expired timers – the devil is in the details.

Of course you can open a trace in the Wireshark analysis tool and compare the recording package by package and field by field with the specifications. An error is more likely to catch the eye if you use a functioning protocol sequence for comparison.

Some network admins therefore collect traces of functioning transmissions for later use as references. The author of this article has also collected important traces over the years. Instead of looking for the associated reference file in the manually created archive before each analysis, he put the important recordings in a single PCAP file. As usual, you can open this with a double-click in Wireshark and then use the program’s powerful filter engine to display the protocol sequence you are looking for. This article is about a reference file of around 9 Mbytes. It currently contains about 60 Traces of protocols that are based on the Ethernet transmission medium.

Access to all contents of heise + exclusive tests, advice & background: independent, critically sound c’t, iX, Technology Review, Mac & i, Make, c’t read photography directly in the browser register once – read on all devices – can be canceled monthly first month free, then monthly 9, 95 € Weekly newsletter with personal reading recommendations from the editor-in-chief start FREE month Start the FREE month now Heise + already subscribed?

Sign in and read Register now and read the article immediately More information about heise +