When I teach Wireshark classes, I commonly get asked, “What do I do when I get back to my desk?”, “What if I can’t span a port, or don’t have a TAP?”
I typically show my attendees dozens of “Baselines” that would only take a few minutes to complete.
Here’s an example of one of my favorite baselines; Start a capture and analyze whatever you see. No taps, span or mirror ports.
All the packets you see will be there for a reason from certain devices based on their current configuration. I won’t kid you, the first time you go through this it might take a bit of time, but when you get the hang of it you will be able to identify how devices are configured and how to tune them.
In this video I show you some tips and tricks to get you started and create filters for captures of IPv4, IPv6, STP, SSDP, CDP, as well as how to define end points.
Let me know if you find this helpful and I will make more videos covering other protocols and scenarios.
Then subscribe to Garland’s blog and get my feed.