Most network engineers and technicians are quickly discovering that with “everything over IP” we are required to understand exactly what this means. For a lot of the standard, traditional data communications between clients and servers this means transport over TCP.
Furthermore, it requires the ability to troubleshoot TCP. To troubleshoot TCP you have to look at the packets. To look at the packets, the best tool is Wireshark!
For those of you who love Wireshark and are needed to troubleshoot TCP, we would like to offer a great default profile for TCP. A starting point.
Consider for a moment what would be important in your network administration and troubleshooting of TCP:
- Knowing the key components of information to tack TCP behavior
- Being able to identify TCP packets with certain pertinent information
- Being able to detect interesting TCP process issues
Profiles are one of the most important Wireshark capabilities. Setting up and using different profiles for different environments, protocols, and tasks is a crucial skill that we teach in our Wireshark courses. Let’s say you went to the Wireshark site and tried to find some! Suprisingly, here is what you would get:
Whaaaaat?????
No worries. We have an answer below:
Let’s look at what you get with this default profile.
Packet List Window Columns
An important starting point for this profile is the addition of very important columns that brings to the surface the key TCP behavior and process information:
Display Filters
With Wireshark 3.4 and onwards, you can nest display filter buttons, and this profile takes full advantage of that:
Here are the display filters in this profile:
Colorization:
Here are the color rules we added:
Again, all of this is a great starting point. What do you think we are missing? What would you add?
To download this ZIP file click here. Make sure you unzip it into your personal folders, profiles subdirectory:
We hope this helps you with TCP and Wireshark! Also a special thanks to Hansang Bae and those folks at Wireshark with their great documentation and great program.
Got a better one? Or have a profile you would like to send to us? Send it to andyw@cellstream.com – thanks in advance – we share profiles here.
Another way to find profiles, click on “Profile” in the tag cloud.
I hope you find this article and its content helpful. Comments are welcomed below. If you would like to see more articles like this, please support us by clicking the patron link where you will receive free bonus access to courses and more, or simply buying us a cup of coffee!, and all comments are welcome!