Step 1: First we need to download and install Wireshark on our machine as per our operating system. Whenever we want to do an analysis of any data packet the the first step is to capture the packet which is coming and outgoing then we use packet analyzer tool named Wireshark. Wireshark is having a nice interface through which we can differentiate the data as per the different parameters and then we can analyze the packet transfer process. It works similar to tcpdump in linux but the problem is that there is no GUI for tcpdump. Originally the name of the tool was Ethereal, the project was renamed Wireshark in May 2006 due to trademark issues. It is used for network troubleshooting, analysis, software and communications protocol development, and education. UnixArena’s Snoop guide will help you to setup the snoop between two IP’s.Īssume you have collected the snoop output.How do you analysis it ? You can use snoop command it self to read the snoop logs.But its not user friendly.I would recommend you to use wireshark to analysis snoop output from your laptop/Desktop.Here we will see how to analysis snoop data using wireshark.ġ.Download wireshark and install it in your laptop.Wireshark is a free and open-source packet analyzer.

Most of the network issues are intermediate and you never know when it will happen again.So you need to capture complete network activity to find the issues.In Solaris we have an inbuilt tool called snoop which will capture the real network traffic and save it in file.

You never know where the problem resides on network issues since many hardwares involved like NIC,switch,cables, routers and firewalls. Network troubleshooting is most difficult part in Unix Administration.To get resolve these network issues ,you need good support from network team.

How to interpret wireshark capture