----- Original Message ---- > From: Dale <rdalek1...@gmail.com> > Adam Carter wrote: > > Is this easy to do? I have no idea where to start except that > > wireshark is installed. > > Yep, start the capture with Capture -> Interfaces and click on the start >button next to the correct interface, then right click on one of the packets >that is to the yahoo box and choose Decode As set the port and protocol then >apply. You'll > > need to understand the semantics of HTTP for it to be of much use tho. > You had me until the last part. No semantics here. lol May see if I can >post a little and see if anyone can figure out what the heck it is doing. >I'm >thinking some crazy bug or something. Maybe checking for updates not >realizing >it's > > Kopete instead of a Yahoo program.
Wireshark will show you the raw packet data, and decode only a little of it - enough to identify the general protocol, senders, etc. So to understand the packet, you will need to understand the application layer protocol - in this case HTTP - yourself as Wireshark won't help you there. But yet, Wireshark, nmap, and nessus security scanner are the tools, less so nessus as it really is more of a port scanner/security hole finder than a debug tool for applications (it's basically an interface for nmap for those purposes). HTH, Ben
