You can’t always see what is in the network packets when the data is encrypted. You can look up information about at IP address using an Internet registry such as ARIN. You may see some suspicious hosts that you want to block in your host-based or network-based firewall. You can generally tell which one is in use because you’ll see some spikes in the line of traffic as shown below.īy becoming familiar with what is normal on your network, you can start to spot abnormalities. Select the network interface you are using on your computer. Once you have installed the application, open it up. To get started with Wireshark, download and install it from the Wireshark website. You can also use search capabilities to find exactly what you are seeking. There are times when you want the raw output in something like tcpdump, but Wireshark has a user-friendly interface and a lot of protocol parsers, which will help you better understand the traffic. You can also use a tool called Windump on Windows. Two of the most common and popular packet sniffers are Wireshark and tcpdump. Later I got the opportunity to study more about cybersecurity and learned one of the ways I might have been able to inspect that traffic - using a packet sniffer. It always bothered me that I didn’t know how the attackers got in or what they were sending in that traffic. I just got the hackers off my system and moved on. I was also too busy trying to build systems and make money to spend a long time figuring it out. Although I could see the ports and protocols in use, I could not get into the traffic to verify this because I didn’t know how at that time. I explain a bit about ports and protocols in my book, Cybersecurity for Executives in the Age of Cloud. I could tell something was sending traffic on port 25, which is the port typically used for SMTP - a protocol used for sending email. I couldn’t see what was in the network traffic I was viewing. However, there was a missing piece to the puzzle. I knew very little about cybersecurity at that time, but I was able to glean from network logs that something was on my system that shouldn’t be there. I wrote about how network security got me into cybersecurity during one of my first security incidents.

Packet sniffer wireshark download