The above graph is showing typical traffic generated by a home office. For this in Wireshark, just go to statistics > I/O graph, and there we can see a graph like shown below:

It is also possible to view the input/output statistics of an entire packet capture. In Wireshark, we are not limited to just interpreting packets by colors. It’s possible, even, to colorize specific conversations between computers. It’s a toggle, so if you want the coloring back, simply go back and click Colorize Packet List again. If you don’t want any coloring at all, go to View, then click Colorize Packet List. We can even change the defaults or apply a custom rule. You can view this by going to View > Coloring Rules. The default coloring scheme is shown below figure. Windows-specific traffic, including Server Message Blocks (SMB) and NetBIOS So Wireshark tries to help you identify packet types by applying common-sense color coding. Now we’ll go a bit more deep into Wireshark and see how to read the captured packets. This displays all packets that where source or destination (or both) are non-ephemeral.Īt the root of all this is the concept of 'opposite'.In my previous blog, I explained Wireshark, Its installation, and how to use it. You have the same problem (but this time Wireshark doesn't warn you). Now let's say you want the opposite - packets where *neither* port is ephemeral. It got me to thinking about other forms of inequality, like '>' or ' 49152 You'll get way more packets than you wanted. In other words, instead of eliminating packets with either source or destination of 12000, it only eliminates packets with both source and destination of 12000. Which, doing a little boolean algebra is the same as:

So if you want the opposite of tcp.port=12000, it seems logical to use tcp.port!=12000, thinking that it will eliminate all packets with either source or destination equal to 12000. Those expressions do an implicit 'or'ing of the corresponding source and destination fields. The problem is related to 'combined expressions', like eth.addr, ip.addr, tcp.port, and udp.port. Here's a direct link to the section ' A Common Mistake with !='. My first thought: 'There's a User's Guide?' My second: 'Couldn't you give me a link to it?' '!=' may have unexpected results (See the User's Guide) Like when using the '!=' operator, a yellow warning flashes a few times saying:

How is it that I haven't sung the praises of Wireshark in this blog? It's one of my favorite tools of all time! I can't get over how powerful it has become.

Wireshark display filter yellow