4Īfter the traffic is read and saved, Wireshark provides its users with a suite of tools to make sense of the data from their network devices.

This is simplified from the following original image: Wireshark: 6.2. Overviewĭumpcap, another utility that Wireshark uses, provides functionality to save network traffic to the hard disk. The utility that Wireshark uses to read data from network interfaces is Npcap (on Windows) or libpcap (on other OSes).įigure 2. On unencrypted networks, Wi-Fi devices and drivers that support monitor mode can also be used to passively observe communications between different devices, without actually connecting to the access point. This mode allows your network devices to observe network traffic that is not directed towards them.

To take advantage of the full feature set of Wireshark, it is necessary to have ethernet or Wi-Fi devices and drivers that support promiscuous mode. View length, frequency, timing of data being sent to/from an IP View IP address of website being accessed View length and frequency of data sent between local devices 1ĭepending on the security precautions taken by the network administrator and network users, Wireshark can allow attackers to view different things: 2 Figure 1 It can be used to observe Ethernet, Wi-Fi, Bluetooth, USB, and many other sources. Wireshark is a tool that gives computer scientists the ability to observe, record, and analyze network activity on a very broad range of hardware and protocols. Because of the vast capabilities of Wireshark, this presentation will focus on how Wireshark's ability to monitor and log traffic over Wi-Fi can be used in malicious ways. deconz-zcl.Wireshark can be used in conjunction with other tools to perform a variety of attacks on networks and their users. ' use strict ' // Since this is just an example, we'll just read the entire JSON // file in.

Wireshark arch