Chris Sanders

“How do I find bad stuff on the network?”

The path to knowledge for the practice of NSM typically always begins with that question. It’s because of that question that we refer to NSM as a practice, and someone who is a paid professional in this field as a practitioner of NSM.

Unfortunately, when I started practicing NSM there weren’t a lot of reference materials available on the topic. Quite honestly, there still aren’t. Aside from the occasional blog postings of industry… Show more

“How do I find bad stuff on the network?”

The path to knowledge for the practice of NSM typically always begins with that question. It’s because of that question that we refer to NSM as a practice, and someone who is a paid professional in this field as a practitioner of NSM.

Unfortunately, when I started practicing NSM there weren’t a lot of reference materials available on the topic. Quite honestly, there still aren’t. Aside from the occasional blog postings of industry pioneers and a few select books, most individuals seeking to learn more about this field are left to their own devices. I feel that it is pertinent to clear up one very important misconception to eliminate potential confusion regarding my previous statement. There are menageries of books available on the topics TCP/IP, packet analysis, and various intrusion detection systems. Although the concepts presented in those texts are important facets of NSM, they don’t constitute the practice of NSM as a whole. That would be like saying a book about wrenches teaches you how to diagnose a car that won’t start.

With that in mind, my co-authors and I are incredibly excited to announce our newest project, a book entitled “Applied Network Security Monitoring”. This book is dedicated to the practice of NSM. This means that rather than simply providing an overview of the tools or individuals components of NSM, we will speak to the process of NSM and how those tools and components support the practice. Show less

This significantly revised and expanded second edition of Practical Packet Analysis shows you how to use Wireshark to capture raw network traffic, filter and analyze packets, and diagnose common network problems. Take control of your network today!

Wireshark is the world's most popular "packet sniffer," allowing its users to uncover valuable information about computer networks by analyzing the TCP packets that travel through them. This significantly revised and expanded second edition of… Show more

This significantly revised and expanded second edition of Practical Packet Analysis shows you how to use Wireshark to capture raw network traffic, filter and analyze packets, and diagnose common network problems. Take control of your network today!

Wireshark is the world's most popular "packet sniffer," allowing its users to uncover valuable information about computer networks by analyzing the TCP packets that travel through them. This significantly revised and expanded second edition of Practical Packet Analysis shows you how to use Wireshark to capture raw network traffic, filter and analyze packets, and diagnose common network problems. Author Chris Sanders begins by discussing how networks work and gives you a solid understanding of how packets travel along the wire. He then explains how Wireshark can be used to monitor and troubleshoot networks. Numerous case studies help you apply your newfound knowledge to your networks.

This revision offers more detailed explanations of key networking protocols; expanded discussions of wireless protocol analysis and an examination of network security at the packet level; expanded discussion of the meaning of packets and how they can offer insight into network structure; and new scenarios and examples. Whether fighting a virus infestation or a confounding connectivity problem, Practical Packet Analysis, 2nd Edition will help you find the problem and fix it.
Show less

It's easy enough to install Wireshark and begin capturing packets off the wire--or from the air. But how do you interpret those packets once you've captured them? And how can those packets help you to better understand what's going on under the hood of your network? Practical Packet Analysis shows how to use Wireshark to capture and then analyze packets as you take an indepth look at real-world packet analysis and network troubleshooting. The way the pros do it.

Wireshark (derived from… Show more

It's easy enough to install Wireshark and begin capturing packets off the wire--or from the air. But how do you interpret those packets once you've captured them? And how can those packets help you to better understand what's going on under the hood of your network? Practical Packet Analysis shows how to use Wireshark to capture and then analyze packets as you take an indepth look at real-world packet analysis and network troubleshooting. The way the pros do it.

Wireshark (derived from the Ethereal project), has become the world's most popular network sniffing application. But while Wireshark comes with documentation, there's not a whole lot of information to show you how to use it in real-world scenarios. Practical Packet Analysis shows you how to:

* Use packet analysis to tackle common network problems, such as loss of connectivity, slow networks, malware infections, and more
* Build customized capture and display filters
* Tap into live network communication
* Graph traffic patterns to visualize the data flowing across your network
* Use advanced Wireshark features to understand confusing packets
* Build statistics and reports to help you better explain technical network information to non-technical users

Because net-centric computing requires a deep understanding of network communication at the packet level, Practical Packet Analysis is a must have for any network technician, administrator, or engineer troubleshooting network problems of any kind.

Technical review by Gerald Combs, creator of Wireshark
Show less