Understanding Wireshark

Wireshark is the most capable free instrument a network technician will ever own, and most people use five percent of it. This book teaches it as an instrument: what it measures, what it cannot, where to connect it so the measurement is true, how to ask it questions in its own filter language, and how to read the summaries it produces so a fault becomes a finding.

It covers the tools that live around Wireshark, the industrial protocols that carry a plant's work, scripting analysis with tshark and Python, writing a Lua dissector for a vendor protocol, and building synthetic captures for training. Every chapter closes with what it established.

The method fits on one page: eight steps from statement and prediction through capture, analysis, finding, and verification; six filters that isolate a conversation, strip the noise, and surface every TCP problem; six common misreads to avoid; and three tshark and editcap commands you will use every week.