Download practical packet analysis practical packet analysis - My E

show all supported and recognized endpoints in the current capture file. Click
a tab to narrow the list of endpoints to specific protocols. Check the box
next to the words Name Resolution to use name resolution within the endpoints dialog.
Figure 5-8: The Endpoints dialog lets you view each of the endpoints in a capture file.
You can use the Endpoints dialog to filter out specific packets for
display in the Packet List pane. If you right-click a specific endpoint, you will
notice several options, including the ability to create a filter to display only
traffic related to this endpoint or all traffic excluding the selected endpoint. As
a bonus, you can also directly export the endpoint into a colorization rule.
Conversations
A conversation on a network, like a conversation between two people, describes
the communication that takes place between two hosts (endpoints). For
example, whereas Jim and Sally’s conversation might consist of “Hey, how
are you?” “I’m great! Yourself?” and “Couldn’t be better!” a conversation
between 192.168.1.5 and 192.168.0.8 might look like “SYN,” “SYN/ACK,” and
“ACK.” (We’ll look at the TCP/IP communication process in more detail in
Chapter 6.)
Wireshark provides a Conversations dialog (Statistics Conversations),
shown in Figure 5-9. You will see the addresses of the endpoints involved in
the conversation listed as Address A and Address B as well as columns displaying the packets and bytes transmitted to and from each device.
58
C ha pt er 5