Wireshark Beginner guide

2.1 Expression Filter tool

In Wireshark/Ethereal exists tool which helps to build Filter Expression. To start it click to “Filter” button. Window like this will appear:

Display Filter

It is possible to define name of filter expression and to save it for future usage. To select a field in some specific protocol click to button “Expression…” and new window will appear:

Filter Expression

Here, it is possible to select between different protocols and fields defined in them.

3. Statistics tools (VoIP related)

Wireshark/Ethereal has great Statistics tools. After (or during) sniffing session it is possible to select menu Statistics/VoIP Calls. If ethereal was able to “hear” a phone call based on some of popular VoIP protocols (e.g. H.323, MGCP, SIP) similar window will appear:

VoIP calls

Here you can find details about VoIP phone calls. If you select some of them, Wireshark/Ethereal will show graph which shows progress of a call. Screen similar to this will appear:

VoIP call: Analysis

Wireshark/Ethereal is also able to present statistical information about RTP streams. In menu Statistics exist submenu RTP with option “Show All Streams …”. This option analyzes captured data and searches for RTP streams. If RTP stream(s) exist following window opens:

RTP streams

Here, it is possible to select one of the streams and get additional information:

RTP Stream Analysis