Wireshark
Useful tutorial article: https://www.varonis.com/blog/how-to-use-wireshark
Install Wireshark on RHEL8.8 with GUI
In RHEL8.8, if you install wireshark using
dzdo yum install wireshark
you will see that you will not be able to open it as you will get the error: wireshark: error while loading shared libraries: libQt5PrintSupport.so.5: cannot oopen shared object file: No such file or directory
To identify what packages provides libQt5PrintSupport.so.5, run:
dzdo yum whatprovides libQt5PrintSupport.so.5
To resolve this error, run:
dzdo yum -y install qt5-qtbase-gui
Then you will run into this error: wireshark: error while loading shared libraries: libQt5Multimedia.so.5: cannot open shared object file: No such file or directory
To identify what packages provides libQt5Multimedia.so.5, run:
dzdo yum whatprovides llibQt5Multimedia.so.5
To resolve this error, run:
dzdo yum -y install qt5-qtmultimedia
Voila. You should now be able to open wireshark in the GUI.
How to Capture
- You can simply click start
- You can click "Capture" > "start"
- You can select a specific interface by clicking "Capture" > "Options" > then select the interface and click "start"
Useful tutorial article: https://www.varonis.com/blog/how-to-use-wireshark
Wireshark Options
Here are some examples of Wireshark preferences.
- Wireshark -> Preferences -> Protocols -> TCP -> untick the relative sequence numbers option. This will allow us to see the absolute sequence numbers of TCP packets in flight.
- View -> Untick Packet Bytes. This is a useless section and just eats up space on the screen.
Per James, be sure to follow 1 tcp stream. You can do so by doing the following steps in Wireshark: Analyze > Follow > TCP Stream.
How to filter in Wireshark
In the filter box at the top of wireshark, some common ways to filter to make things easier to read:
- ip.addr == x.x.x.x
- tcp.flags.reset==1
- tcp.srcport==443
- tcp.port==25
- tcp.seq == 3817801554
- Click on a packet, in the bottom details of wireshark, search for Transmission Control Protocl > right click on Sequence Number: 3817801554 > Apply as filter > selected.
For example:
ip.addr == x.x.x.x && tcp.port==25