A short tour of Wireshark on real screenshots of one saved capture: the main window and its panes, the packet list and its columns, one packet's layers in the packet details, the fields of its IPv4 header, and its bytes in hex and ASCII, with a field, a whole header and a line of HTTP found among them.
The slides
The tour is seven slides in three sections, after an introduction, each a screenshot of Wireshark with numbered marks that the text beside it explains.
- The main window: the window's five parts, and the packet list's columns.
- A packet's layers: one line per header in the packet details, and the IPv4 header opened to its fields.
- The bytes: the offset, hex and ASCII columns; the bytes of one field, of one header, and of a line of HTTP.
The capture is one web request, curl http://example.com/, fifteen packets; packet 8, the request, is selected throughout. Installing Wireshark and starting a capture are in
Lab 1: Capture a Conversation.
The buttons on the left and right edges move between slides. So do the arrow keys and a swipe.
Sources