VII. Router Diagnostics

How do I use Wireshark?

Vigor 2620Ln
Vigor 2760
Vigor 2762
Vigor 2765
Show all

Network Capture
Packet Capture

Wireshark is an excellent and free third-party tool useful if you wish to examine the data that your PC is sending at the TCP/IP level across the Ethernet or Wireless interfaces. It is often referred to as a 'packet sniffer'. Wireshark is not a DrayTek produced or supported product but we provide some installation documentation as a courtesy here.

Wireshark will capture data packets coming in and out of the PC running wireshark and is therefore very useful to an engineer for diagnosing problems, or improving compatibility with specific applications. It is also possible to capture traffic on the network or WAN interfaces by setting up the Port Mirroring facility on most DrayTek routers so that traffic from other interfaces is sent to the port that the monitoring PC is connected to.

Initial Setup

Download Wireshark from here. Install the application (which will include WinPcap, a separate program that facilitates the capturing of network traffic by the Wireshark program) and run it once it has installed successfully.

The application will initially show the main screen:

The important menu options are located in the main toolbar:

To start capturing packets, it's necessary to select the interface to capture from, which is set from the List of Capture Interfaces and Capture Options windows.

Start Capture will start a packet capture on all selected interfaces

Stop Capture will stop an active packet capture and allow the packet capture to be saved into a file

Restart Capture is only available once a packet capture has been started or stopped, this clears the packet list and restarts the capture

The Display Filter box is used to control which packets Wireshark shows in the packet list, details on how to use this are in the Filtering Packet Captures tab. If nothing is entered here, it will show all packets received.

Listing the Capture Interfaces will show this window, which shows all detected network interfaces (wired or wireless) and clicking Start here will start a packet capture:

Viewing the Capture Options will show all detected network interfaces and offer additional options for capturing packets.

If capturing from a single interface i.e. Local Area Connection, make sure to untick Capture on all interfaces, otherwise Wireshark would capture packets from other interfaces such as the wireless network adapter.

Ticking "Use promiscuous mode on all interfaces" is recommended, Promiscuous Mode allows Wireshark to receive packets that are not intended for the PC running Wireshark, which is necessary if capturing packets from a network. Otherwise Wireshark will discard packets not intended for the PC doing the packet capture.

It is recommended to untick the Name Resolution options as this alters some values in the packet capture file to make it easier to read for high-level packet analysis. Low-level packet analysis such as observing network issues usually does not benefit from these facilities.

Selecting interfaces in this window and clicking Start would start the packet capture.

Once a packet capture has been started, it will show traffic like this. There are three elements to Wireshark's display of packets:

Packet List - this lists the packets received, clicking on a packet here will show it in the Packet Details and Packet Bytes sections

Packet Details - this shows the details of a selected packet; Wireshark is usually able to determine the protocol of each packet and will show a detailed view of the individual details in the packet, such as the MAC addresses (layer 2), IP address level source and destination addresses (layer 3) and the packet data such as the details of an HTTP request

Packet Byes - this shows the packet data in both hexadecimal and ASCII format, selecting an item here will show in the Packet Details and vice versa

How do you rate this article?

1 1 1 1 1 1 1 1 1 1