Wireshark is a shining example of an open source project completely and utterly crapping on the closed source competition. As a result we all benefit. I recall spending a lot of someone else's money on buying a sort of ruggedized laptop with two ethernet ports to do the job back in the day.

Nowdays, I can run up a tcpdump session on a firewall remotely with some carefully chosen timings and filters and download it to my PC and analyse it with Wireshark.

OK, all so convenient but is it any use?

Say you have a VoIP issue of some sort. The PCAP from tcpdump that you pass to Wireshark can analyse it to the nth degree. Wireshark knows all about SIP and RTP (and IAX) and you can even play back the voice streams or have them graphed so you can see what is wrong or whatever. That's just VoIP, it has loads of other dissectors and decorators built in.

So what?

The UK (for example) will be dispensing with boring old, but reliable, POTS (Plain Old Telephony System) by 2025. Our entire copper telephony and things like RedCare (defunct soon) will go away.

We are swapping out circuit switching for packet switching. To be fair, a lot of the backend is already TCP/UDP/IP that is shielded away from us proles. When SoGEA (Single Order Generic Ethernet Access) really kicks in then the old school electric end to end connection will be lost in favour of packet switching, which never fails (honest guv).

If you are an IT bod of any sort, you really should be conversant with Wireshark.

[–] AceFuzzLord@lemm.ee 2 points 1 year ago (4 children)

For the past week and a half of a networking fundamentals class I just finished Tuesday, we were learning the basics of Wireshark. So far the biggest problem I've found with it is that I couldn't find a version for Linux so I could use it on my laptop (couldn't get it to work on wine either).

[–] gerdesj@lemmy.ml 3 points 1 year ago (1 children)

Which distro do you use? Ubuntu, Debian, Arch and Gentoo have packages and I've no doubt that most others do too. On Linux you should not have to go to random websites and download stuff and faff around - use the built in distribution packages. If you are not sure what you've got try this at a command prompt and read the output:

$ cat /etc/os-release

As a last resort, you can run tcpdump on nearly anything and dump to .pcap, transfer that and then open that in Wireshark. Note that modern Windows has a OpenSSH client and server available so getting files around via scp is a doddle. Windows can even do NFS too and there is of course Samba - but CIFS/SMB can be tricksy.

load more comments (2 replies)

load more comments (12 replies)