Practical Packet Analysis and over one million other books are available for Amazon Kindle. Learn more
CDN$ 32.92
  • List Price: CDN$ 57.95
  • You Save: CDN$ 25.03 (43%)
Only 2 left in stock (more on the way).
Ships from and sold by
Gift-wrap available.
Add to Cart
Have one to sell?
Flip to back Flip to front
Listen Playing... Paused   You're listening to a sample of the Audible audio edition.
Learn more
See all 2 images

Practical Packet Analysis: Using Wireshark to Solve Real-World Network Problems Paperback – Jul 9 2011

Amazon Price New from Used from
Kindle Edition
"Please retry"
"Please retry"
CDN$ 32.92
CDN$ 26.42 CDN$ 27.29

Join Amazon Student in Canada

Frequently Bought Together

Practical Packet Analysis: Using Wireshark to Solve Real-World Network Problems + Metasploit: The Penetration Tester's Guide + Nmap Network Scanning: The Official Nmap Project Guide to Network Discovery and Security Scanning
Price For All Three: CDN$ 98.76

Some of these items ship sooner than the others. Show details

Customers Who Bought This Item Also Bought


Product Details

  • Paperback: 280 pages
  • Publisher: No Starch Press; Second Edition edition (July 9 2011)
  • Language: English
  • ISBN-10: 1593272669
  • ISBN-13: 978-1593272661
  • Product Dimensions: 23.5 x 17.9 x 1.9 cm
  • Shipping Weight: 635 g
  • Average Customer Review: 3.5 out of 5 stars  See all reviews (2 customer reviews)
  • Amazon Bestsellers Rank: #103,242 in Books (See Top 100 in Books)
  • See Complete Table of Contents

Customer Reviews

3.5 out of 5 stars
5 star
4 star
3 star
2 star
1 star
See both customer reviews
Share your thoughts with other customers

Most helpful customer reviews

Format: Paperback
Whether you are just starting out, or are more advanced, if you need to understand what is on your network, this book should be on your bookshelf. Chris Sanders has found a way to start from the first principles necessary to perform and understand packet analysis, while at the same time providing a book which is useful to the more advanced. The writing style is very easy to read and very logically organized. Figures are used on nearly every page and real life scenarios are woven throughout the text, reinforcing the material wonderfully.

The book is divided into 11 chapters divided roughly into a beginner, intermediate, and advanced sections.

The first four chapters are aimed at the beginner who is not very familiar with Wireshark.

The first chapter provides the basics of networking and packet analysis.

The second chapter delves into the basics of sniffing and sniffer placement.

Chapter three goes into a brief history of Wireshark, installing Wireshark and how to capture and read Wireshark packet captures.

In chapter four the basics of working with the Wireshark features are covered, including saving, exporting and merging capture files as well as capture options and filtering captures.

Chapters five to eight cover more advanced material.

In chapter five some of the additional Wireshark features are covered, including how to use the protocol dissectors, following TCP streams, and graphing.

Chapter six looks into some of the common lower layer protocols and how they look in Wireshark.

Chapter seven repeats the same exercise with some higher level protocols like HTTP, DNS, and DHCP.
Read more ›
Was this review helpful to you? Yes No Sending feedback...
Thank you for your feedback. If this review is inappropriate, please let us know.
Sorry, we failed to record your vote. Please try again.
By mko TOP 1000 REVIEWER on Aug. 14 2011
Format: Paperback
Practical packet analysis is related, in fact, to a single product ' Wireshark. Chris mentions other tools as well (in an Appendix), but he mostly focuses on this, particular tool. Wireshark allows you to analyze what's going on within the wires of your network. Listening to the wire is not that easy as you may think in the first place. First of all, it's good to know the terminology. Chris provides you with the exact knowledge you need. You will learn just enough to get started and will be told what are the differences between switches, routers, hubs, taps are. You will also know what ARP and OSI mean as well as many other abbreviations. What I specially liked within theory related section was some sort of analysis when to focus on particular device for sniffing and how to utilize it to it's extent. One remark here. For people totally fresh in network terminology I'd suggest something additional and better (easier) explained. I think, at some places book might be hard to follow. Especially when Chris discusses topics like packet components, uses computer related arithmetic, and provides not that much detailed explanation of some topics. In fact, I'd suggest this book to intermediate readers who already know something about computers and networks.

What do I think about this book? It is good for people who are familiar with computer science but didn't work with networks so far. Why? It simply requires some level of knowledge related to networking and to data is processing. On the other hand it is based on well known, easy accessible, GUI based application. This way, you can follow it quite easily, even though you are not perfectly familiar with all the network based concepts. I'd suggest this book as a starter for people who are thinking about working with packet analysis.
Read more ›
Was this review helpful to you? Yes No Sending feedback...
Thank you for your feedback. If this review is inappropriate, please let us know.
Sorry, we failed to record your vote. Please try again.

Most Helpful Customer Reviews on (beta) 60 reviews
40 of 40 people found the following review helpful
This book does exactly what it's written for. It's practical! July 4 2011
By Bryon Hundley - Published on
Format: Paperback
First of all if you consider yourself an expert in packet analysis don't read this book to learn advanced techniques in packet analysis. Instead read this book as a teaching tool to help better explain packet analysis to others. I found myself reading this book and going "hey I wish someone would have explained it to me that way when I started" and "why didn't I explain it that way."
This book is written for people who have little to no experience with packet analysis. It is also a good read for those who might have been out of the packet analysis game for a little while and need a quick read to brush up the skill-set. The book is well written and Sanders does an excellent job explaining things in a manner that is well understood. He eases the reader into explanations by going from layman to more technical jargon. The examples in the book match the title, they are practical and likely to be experienced in the real world. I would highly recommend this book to those who have little to no experience with packet analysis and are looking for a solid book to help them understand what many of the other books tend to explain in a lofty manner.
16 of 16 people found the following review helpful
Very useful if you're starting out with Wireshark July 31 2011
By John Graham-Cumming - Published on
Format: Paperback
Firstly, this is mostly a book about using the Wireshark protocol analyzer tool and secondly a book about packet analysis (in the sense that it does not have space to cover in detail all the sorts of protocol problems someone is likely to encounter). Nevertheless, it's a good book and I'd recommend it to anyone who's beginner to middling with Wireshark. It does a good job of explaining the use of Wireshark and in particular the various configuration options.

There are odd faults (for example, there's a diagram showing a Cisco router, except it's not). There are also some colloquialisms (such as when the author says "Why have chicken when you can have steak?"). And I was disappointed that IPv6 wasn't really covered at all.

If you're experienced with packet analysis and want to learn Wireshark, this book is good for you. If you're a beginner at packet analysis this book is also good.
13 of 13 people found the following review helpful
"Practical Packet Analysis - Using Wireshark to Solve Real-World Network Problems" by Chris Sanders; No starch Press. July 31 2011
By Joe Colantonio - Published on
Format: Paperback
If you have done any type of performance testing, you've inevitably come across an application or two that could not be scripted using standard protocols in a performance test tool like LoadRunner. The Loadrunner protocol of last resort -- when no other protocol will work -- is called Winsock, and it can be pretty nasty to debug. That's the main reason I picked up this book.

Wireshark is a free, open-source tool that allows you to capture and analyze network traffic. With the communication captured, you can then easily tell it to filter on certain protocols, making reading the packet info much easier than it is in LoadRunner.

This book starts at ground level, assuming no user experience with packet analysis and/or packet sniffers. It can basically be divided into four sections.

The first covers packet analysis and network basics, and gives a nice overview of the OSI model.
The second covers Wireshark's basic and advance features.
The next covers common protocols like ARP, TCP and HTTP,
and in the last section, the author ties it all together with real world examples using familiar sites like, Facebook and ESPN, while explaining how to troubleshoot common network issues.

I like the hands-on approach the writer uses throughout the book. He clearly explains everything in a clear, concise manner. I also appreciated the fact that the author uses packet capture files in each example that can be downloaded and opened in Wireshark in order to follow along. I was able to follow all of the examples without any confusion -- which is kind of a big deal, since packet analysis at this level is a new subject for me. Well done!

10 of 10 people found the following review helpful
A Concise But Thorough Guide To Understanding The Packets on Your Network Feb. 11 2012
By Jim Johnson - Published on
Format: Paperback Verified Purchase
The book starts out with some requisite background knowledge about networking needed to understand the packets that will be analyzed. This will not make you a networking expert, but it is very informative for the newcomer and a great refresher for the oldies. After learning about the basics of networking and comparing layer 1, 2, and 3 devices, the book explains techniques for successfully sniffing traffic. The author does not steer clear of the valuable (but sometimes controversial) ARP Cache Poisoning and flood attacks that frequently work for sniffing through a switch.

The author also compares WIreshark (the selected sniffing tool) to some of the others, and clearly explains why he made the choice to use Wireshark. Time is spent familiarizing the reader with using Wireshark, covering installation and usage. The author also discusses how to write filters for capturing and displaying, which is essential to properly use the tool to wade through all the clutter. Finally, the packets that are typically found on a network are discussed and analyzed. The author points out many useful things that can be discovered by zeroing in on things like client/server latency (at different points throughout the TCP handshake) DNS abnormalities, and strange packets.

Also Security implications and intrusion detection are discussed, which I found to be extremely informative for the typical network administrator. FInally some real world scenarios are presented, at which point we examine real life packets to determine the cause of the network problems. This exercise was very helpful to tie in the previous knowledge with a practical hands on approach. Also much appreciated were the example packets. The author provides capture files that can be downloaded from his web site that allow you to follow along easily without requiring you to sniff the packets yourself. Screenshots are provided for those who don't have access to a computer with Wireshark installed, so it is easy to follow along regardless of your situation.

A very logical and easy to follow flow, mixed with excellent writing style make this a must read for any administrator. It is not a massive esoteric tome like a lot of the other books in its class, which makes it an excellent choice. Highly recommended!
5 of 5 people found the following review helpful
Outstanding book! Nov. 10 2012
By Ken Pryor - Published on
Format: Paperback
After reading this book, I have a much better understanding of the capabilities of Wireshark, but I really learned so much more. The author does a great job introducing the reader to basic networking concepts, such as the OSI model, data encapsulation, ports, MAC and IP addresses and so on. Chris Sanders does an excellent job teaching the basics and moving on from there in a way that even those very new to the material can keep up.

Networking has always been something I've known just a little about, but I've never been anywhere close to an expert. While I knew about setting up a basic Windows network, that was about it. I took SANS Network Forensics (FOR 558) last year, which uses Wireshark some and learned a lot. Looking back, I can see how much better off I would have been had I read Practical Packet Analysis before the class. So much of what was discussed in class is covered in PPA in clear, concise explanations that would have made it easier for me when I took the forensics course.

This really is one of the best tech books I've ever read. I don't say that lightly, as I've read many good IT and computer forensics books. It is well written and easy to follow. The author has .pcap files available for download from the publisher website so the reader can follow along with the examples in the book. To me, this made learning the material that much easier, allowing me to see first hand what was being taught.

Another thing I like about this and other books from the publisher, No Starch Press, are the graphics. Screenshots of computer screens are often very difficult to make out in other publishers books, but I've noticed in all of my No Starch books they are easy to see.

Practical Packet Analysis is a must-read for anyone wanting to learn how to sniff and analyze packets. Highly recommended!

Product Images from Customers