1

I got an information that tcpdump is same like wireshark. In using tcpdump we can capture the packets, but in wireshark we can see the GUI of packet capture. Later I understand that we can use the tcpdump command, it will capture the payload as well

tcpdump -nnvvXSs 1514 -i <interface> port 80 -w output.pcap.

Actually my company tells me that when ever calling an API we need to analyse the data using wireshark. I'm a beginner could you please tell me the what should I need to check with wireshark ? I know its a packet capture tool, analyse data inside packet. What should I learn ? What are the important point that should I keep while before capturing packets ? Is anything else other than packet capture ?

I got some incomplete data, when an incomplete response is resulting back to the console or whatever the tool that are using for the response and then when sniiff the data, it is showing the incomlpete data -it is called memory leak is it correct ?

, that I got after type the tcpcump command and then open postman call an http API request, then open wireshark and then anlalyse the packets...

Is I need to learn more tcpdump command to work with wireshark ? What are the testing possibilities of wireshark ? like vulnerabilties etc..

Which language that every one using in wireshark ? In coding what everyone finding using with wireshark ?

2
  • You wont be able to make great use of tcpdump (uses the libpcap driver) and Wireshark (uses the WinPcap driver) if not familiar with general networking concepts. If you don't understand how protocols work, then tcpdump and Wireshark will not do the job for you neither. Also, you can capture with tcpdump in exact the same way as with Wireshark and import and review the capture file in Wireshark. Also worth to know, it's not even necessary to install Wireshark (this applies to Windows OS) on the machine where your going to perform the capture, you can use netsh and upload the file to Wireshark
    – cyzczy
    Feb 21, 2017 at 10:20
  • Did any answer help you? If so, you should accept the answer so that the question doesn't keep popping up forever, looking for an answer. Alternatively, you could provide and accept your own answer.
    – Ron Maupin
    Aug 16, 2017 at 22:01

1 Answer 1

1

As @adam86 points out, Wireshark can do more than just capture packets, but you need to understand what your application does and how it communicates in order to make any sense out of it.

Wireshark is a protocol analyzer. It lets you dissect most commonly used protocols down to the bit-level, so you can see why things might be going wrong. It can display conversations between two endpoints. Wireshark can also calculate throughput in TCP streams.

Wireshark can do other things, but again, if you don't understand what you are trying to do, or how the protocols work, it won't be of much help.

If I may suggest, go to the Wireshark website and watch or read some of their tutorials. That may give you a better appreciation.

1
  • @toastmaster You have asked the same question three times. The machine with wireshark must receive the data for you to capture it. That won't happen in a switched or wireless network under normal conditions
    – Ron Trunk
    Feb 22, 2017 at 14:45

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.