When looking at captured traffic often all outbound packets will be highlighted in red/black and the Header Checksum details for each packet are reported as incorrect. Once these changes are saved then the main Wireshark window will display the new columns. 5061) while the (resolved) entries will show the port information as a descriptive name if it can be resolved as a known defined port (e.g. The (unresolved) entry will simply show the raw port number (e.g. Also double-click the Title fields to rename the columns. Using the Add button at the bottom create two new columns and for their field types select either the resolved or unresolved selections for both Src port and Dest port types.

Open Preferences from the Edit menu and expand the Columns item.

This should be the first change applied to Wireshark after installation and makes it much easier to read through traffic as the source and destination ports can be as important as the host IP addresses.

For some reason the network ports are not listed in the default columns like they are in Network Monitor, and Wireshark also incorrectly marks a lot of traffic with bad checksums. Customizing the DisplayĪlthough Wireshark has a number of benefits over Network Monitor the least beneficial issue with using Wireshark out-of-the-box is that it can be hard to quickly identify traffic due to the default display behavior. These issues range from simply starting the capture driver to modifying and filtering the output. Using tools like Network Monitor and Wireshark are common place when dealing with troubleshooting issues in Lync Server or when simply attempting to better understand some specific behavior.Īs Wireshark is more commonly deployed and often already installed on customer’s servers then it can be beneficial to understand a few basic quirks so that one can dive right into looking at the traffic.

Wireshark capture