Capturing close to the two device in question allow us to see the perspective of the conversation from both endpoints.There are times when this can negatively affect impact performance or make it difficult to properly analyze packets within Wireshark. Firewalls have a tendency of altering the TCP parameters with the packet headers depending on their configuration. By capturing on both sides of the firewall, we can see how the firewall interacts with the packets.In the above example, we have two captures setup in front of two servers on the separate sides of a firewall. It is also best to ensure you are capturing on both sides of the conversation to ensure you can see the full scope of the conversation. This can assist with your analysis or it can actually hinder your analysis. It’s important to remember when you are analyzing packets you are viewing the packets from the perspective of the capture point. Placement – Knowing where to capture is key.Lets go over a few best practices when using Wireshark to make sure you get the most out of it. However there are a few quick an easy tricks you can use to ensure you are getting the most out of your packet captures. There are definitely many variables out there that make capturing and analyzing data a very convoluted and difficult.

Wireshark can be a very powerful however getting the most out of this tool can be tricky.

Analyzing wireshark packet captures