Which rules decide what kind of message Wireshark sees?
Which rules decide what kind of message Wireshark sees?
I am a beginner with Wireshark. I watched one training video but it was too long. I need specific answers about questions to help me in my coding job. How does Wireshark tell you which protocol a message uses? I have a .pcapng file and at first, the first three hex digits seemed like they were unique to a protocol. But that is not true. They are actually part of the destination address. Thanks a lot! Just to be sure: when the hexes in the third frame window show up, does that mean the whole package without anything added or taken away? Is this right? I am interested in these protocols: ARP HTTP HTTP/JSON MDNS NBNS TCP. I found some docs online at documentation.help/Wireshark/ChapterIntroduction.html#idp3107168.
There are many protocol decoders (or dissectors) for lots of protocols, see Appendix B on Protocols and Protocol Fields. Wireshark separates between protocols like tcp and fields like tcp.port. A full list is at http://www.wireshark.org/docs/dfref/. There are tons of protocols listed here too.
For HTTP and HTTP/JSON in my .pcapng file, the data stream starts with a Destination address followed by a Source address. Then there is something interesting. It shows: Type: IPv4 (0x0800). This is the same for both HTTP and HTTP/JSON. So how do I tell them apart from that packet data? On the same spot, we have 0x0806 for ARP. We also see 0x0800 for MDNS -- which is the same as HTTP. That does not help me here. Then there is NDNS with 0x0800, which is still the same for HTTP. That is not the answer either. TCP shows up at 0x0800 too, and that is also the same for HTTP. This is not the solution. Wireshark is open source. So my only other option seems to be looking through the code or finding an answer online apart from getting help.