The (unresolved) entry will simply show the raw port number (e.g. Also double-click the Title fields to rename the columns. Using the Add button at the bottom create two new columns and for their field types select either the resolved or unresolved selections for both Src port and Dest port types. Open Preferences from the Edit menu and expand the Columns item.This should be the first change applied to Wireshark after installation and makes it much easier to read through traffic as the source and destination ports can be as important as the host IP addresses. For some reason the network ports are not listed in the default columns like they are in Network Monitor, and Wireshark also incorrectly marks a lot of traffic with bad checksums. Customizing the DisplayĪlthough Wireshark has a number of benefits over Network Monitor the least beneficial issue with using Wireshark out-of-the-box is that it can be hard to quickly identify traffic due to the default display behavior. These issues range from simply starting the capture driver to modifying and filtering the output.

Using tools like Network Monitor and Wireshark are common place when dealing with troubleshooting issues in Lync Server or when simply attempting to better understand some specific behavior.Īs Wireshark is more commonly deployed and often already installed on customer’s servers then it can be beneficial to understand a few basic quirks so that one can dive right into looking at the traffic.

Wireshark search for string in packets